This privacy policy explains how [Registered company name], trading as Data On Demand ("Data On Demand", "we", "us"), collects and uses personal data when you visit our website, contact us, or work with us as a client or supplier. It also explains your rights and how to exercise them.
1. Who we are
Data On Demand is a managed web data extraction company. For the purposes of data protection law, we are the controller of the personal data described in this policy. Our registered address is [Registered address]. You can contact us about privacy matters at info@dataondemand.net.
When we collect or process data on behalf of a client as part of a project, we generally act as a processor or service provider for that client, and the client's own privacy notice governs that processing. Section 9 explains how we handle personal data in client projects.
2. Personal data we collect
Website visitors
- Technical data such as IP address, browser type, device information, pages visited and referring page, collected through server logs and, where you consent, analytics cookies.
- Preferences you set on our site, such as cookie choices.
Enquiries and prospective clients
- Name, business email address, telephone number, company name, job title and country.
- The content of your enquiry, including project requirements and any files you share.
- Records of our correspondence and meetings.
Clients and suppliers
- Business contact details of the individuals we work with.
- Contract, billing and payment information, including billing addresses and tax identifiers.
- Account and access details for any client portal, API or delivery destination we provide.
- Records of support requests and communications.
Job applicants
- Your CV, contact details, work history, and any information you provide during the application and interview process.
We do not intentionally collect special category data, such as health, religious or biometric data, through our website or business relationships. Please do not send it to us.
3. How we use personal data and our legal bases
Where the GDPR or UK GDPR applies, we rely on the following legal bases. Equivalent bases or grounds are relied upon under other applicable laws.
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and preparing proposals or samples | Legitimate interests in responding to business enquiries; steps prior to entering a contract |
| Delivering services and managing the client relationship | Performance of a contract |
| Invoicing, accounting and tax records | Legal obligation |
| Operating, securing and improving our website | Legitimate interests in running a secure, functional website |
| Website analytics using non-essential cookies | Consent |
| Sending business updates to clients and prospects | Legitimate interests, or consent where required by law; you can opt out at any time |
| Assessing job applications | Steps prior to entering a contract; legitimate interests in recruitment |
| Establishing, exercising or defending legal claims | Legitimate interests; legal obligation |
We do not sell personal data, and we do not use personal data from our website or business relationships for automated decision-making that produces legal or similarly significant effects.
4. Sharing personal data
We share personal data only where necessary, with:
- Service providers that support our operations, such as hosting, email, cloud storage, accounting and communication tools, under contracts that require them to protect the data and use it only on our instructions.
- Professional advisers, such as lawyers, accountants and auditors, under duties of confidentiality.
- Authorities, regulators or courts where required by law or to protect our rights.
- A buyer or successor in the event of a merger, acquisition or reorganisation, subject to appropriate confidentiality protections.
5. International transfers
Our team works remotely and serves clients in several regions, so personal data may be processed in countries other than your own. Where we transfer personal data from the European Economic Area, the United Kingdom or another jurisdiction with transfer restrictions, we use appropriate safeguards. These include adequacy decisions, standard contractual clauses approved by the relevant authority, or other mechanisms permitted by applicable law, such as those under the UAE PDPL, Saudi PDPL, Singapore PDPA and LGPD. You can request information about the safeguards we use by contacting us.
6. Retention
We keep personal data only for as long as necessary for the purposes described above.
- Enquiry records: up to 24 months after our last contact, unless a client relationship begins.
- Client and supplier records: for the duration of the relationship and afterwards for as long as required for legal, tax and accounting purposes.
- Job applications: up to 12 months after the recruitment process ends, unless you agree to a longer period or join us.
- Website logs: for a limited period for security and troubleshooting, normally no longer than 12 months.
- Analytics data: in line with the cookie durations described in our cookie policy.
7. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls based on role and need, multi-factor authentication for internal systems, logging, and confidentiality obligations for staff and contractors. No system is completely secure, and we will notify affected individuals and authorities of a personal data breach where required by law.
8. Your rights
Your rights depend on where you are located and which laws apply. We will respond to requests in line with the applicable law and may need to verify your identity first.
| Law | Main rights |
|---|---|
| GDPR (EEA) and UK GDPR | Access, rectification, erasure, restriction, data portability, objection (including to direct marketing), withdrawal of consent, and complaint to a supervisory authority |
| CCPA/CPRA (California) | Right to know, access, delete and correct personal information; right to opt out of sale or sharing; right to limit use of sensitive personal information; freedom from discrimination for exercising rights |
| Singapore PDPA | Access, correction, withdrawal of consent, and complaint to the Personal Data Protection Commission |
| UAE PDPL and Saudi PDPL | Information about processing, access, correction, erasure in certain cases, restriction or objection in certain cases, and complaint to the competent authority |
| LGPD (Brazil) | Confirmation of processing, access, correction, anonymisation or deletion of unnecessary data, portability, information about sharing, withdrawal of consent, and complaint to the national authority |
Residents of other jurisdictions, including India, Malaysia, Indonesia, Australia, Canada, Mexico, Colombia and Chile, may have similar rights under their local laws. To exercise any right, email info@dataondemand.net with the subject line "Privacy request". California residents may use an authorised agent. We do not sell or share personal information for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA.
9. Personal data in client projects
Our services involve collecting publicly available web data for clients. Our responsible data policy explains how we approach this. In summary, we design personal data out of datasets wherever possible, collect personal data only where a client has a documented lawful purpose, exclude special category data by default, and process such data only on the client's instructions. If you believe data about you has been collected in one of our projects and wish to raise a concern or request removal, contact info@dataondemand.net and we will investigate and, where appropriate, coordinate with the relevant client.
10. Cookies
We use cookies and similar technologies on our website. Strictly necessary cookies are always active. Other categories are used only with your consent. See our cookie policy for details and how to change your choices.
11. Children
Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last revised. Material changes will be highlighted on our website.
13. Contact
[Registered company name], [Registered address]. Email: info@dataondemand.net.