Privacy Policy

1. Introduction

This Privacy Policy explains how Gibney Technology Enterprises Limited ("Gibney", "we", "us", or "our") collects, uses, discloses, and protects personal data in connection with HipTrack.io (the "Service"), a social bookmarking software-as-a-service platform.

We are committed to protecting your personal data and your right to privacy. This Policy applies to personal data we process as a data controller (for example, in relation to our customers, prospects, website visitors, and the authorised users of our customers) and explains the role we play when we process personal data as a data processor on behalf of our customers.

If you have questions or concerns about this Policy or our practices, please contact us using the details in section 14.

2. Who we are

The data controller responsible for your personal data is:

3. Scope of this Policy

This Policy applies to personal data processed through:

• The HipTrack.io web application and any associated mobile or desktop applications
• The HipTrack.io marketing website and related domains
• Sales, support, and other business communications with us

This Policy does not apply to third-party websites, products, or services that may be linked from or integrated with the Service. We encourage you to review the privacy policies of any third parties before providing them with personal data.

4. Our role: controller and processor

HipTrack.io is a business-to-business product. The way we handle personal data depends on the context:

As a data processor. When our business customers ("Customers") use the Service to bookmark, organise, share, and collaborate on content, the Customer is the controller of personal data submitted into the Service ("Customer Data"). We process Customer Data on the Customer's behalf and in accordance with our agreement with that Customer (including any Data Processing Addendum). If you are an authorised user of a Customer's account and want to exercise rights in relation to Customer Data, please contact your organisation directly.

As a data controller. We act as a controller in relation to: account registration and administration data; billing and payment data; data we collect through our website and marketing activities; and data we collect when providing support. The remainder of this Policy primarily addresses processing where we act as controller.

5. Personal data we collect

We collect the following categories of personal data:

Account and identity data

Name, work email address, job title, employer/organisation name, username, password (stored in hashed form), and profile preferences.

Billing and transactional data

Billing contact details, billing address, VAT/tax identification number, subscription plan, and records of payments. Payment card details are collected and processed directly by our payment processor; we do not store full card numbers on our systems.

Service usage data

Bookmarks, tags, folders, collections, notes, comments, and other content you save or create in the Service; URLs, titles, descriptions, and metadata of bookmarked content; sharing and collaboration activity; and records of your interactions with other users within your workspace.

Technical and device data

IP address, browser type and version, operating system, device identifiers, time zone, language preferences, referring URLs, and log data relating to your use of the Service.

Communications data

The content of your communications with us (for example, support tickets, emails, and chat messages), and information you provide when responding to surveys or feedback requests.

Marketing data

Information about your engagement with our marketing emails and website (for example, opens, clicks, and pages visited), and your preferences in relation to marketing communications.

We do not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data). Please do not submit such data to the Service.

6. How we collect personal data

We collect personal data:

• Directly from you, when you create an account, contact us, subscribe to communications, or use the Service
• Automatically, through cookies, server logs, and similar technologies when you interact with the Service or our website (see section 11)
• From your organisation, when an administrator provisions an account for you or invites you to a workspace
• From third parties, including identity providers (where you sign in using single sign-on), payment processors, analytics providers, and publicly available sources used for prospecting

7. Why we process personal data and our legal bases

Under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Irish Data Protection Act 2018, we must have a lawful basis for processing personal data. We rely on the following bases:

Where we rely on legitimate interests, we have carried out a balancing test to ensure our interests are not overridden by your rights and freedoms. You can request more information about that assessment by contacting us.

8. Sharing personal data

We share personal data only where necessary and with appropriate safeguards. Recipients may include:

• Other users of your workspace, in line with the sharing and collaboration features of the Service
• Service providers (sub-processors) acting on our instructions, including cloud hosting, database, email, customer support, analytics, and payment processing providers
• Professional advisers such as auditors, lawyers, and accountants, where reasonably necessary
• Authorities and third parties where required by law, regulation, legal process, or to protect our rights, property, or safety, or those of our users
• Successors in interest in the event of a merger, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality and data protection commitments

We do not sell personal data.

9. International transfers

We are based in Ireland and primarily process personal data within the European Economic Area ("EEA"). Some of our sub-processors are located outside the EEA, including in the United Kingdom and the United States.

Where we transfer personal data outside the EEA, we rely on a valid transfer mechanism, such as:

• An adequacy decision adopted by the European Commission
• The European Commission's Standard Contractual Clauses (and, where the data originates in the UK, the UK International Data Transfer Addendum)
• The EU-US Data Privacy Framework, where the recipient is certified

You may request a copy of the safeguards in place by contacting us using the details in section 14.

10. Data retention

We retain personal data only for as long as necessary for the purposes set out in this Policy, including to satisfy legal, accounting, tax, or reporting requirements.

In general:

• Account and Service usage data is retained for the duration of your account and, after termination, for a limited period to allow for reactivation, dispute resolution, and our legitimate business needs, before being deleted or anonymised
• Billing records are retained for the period required by applicable tax and accounting law (typically up to seven years in Ireland)
• Marketing data is retained until you opt out or for a reasonable period thereafter
• Support communications are retained for a reasonable period to enable service improvement and dispute resolution

Where we act as a processor on behalf of a Customer, retention of Customer Data is governed by our agreement with that Customer.

11. Cookies and similar technologies

We use cookies and similar technologies on our website and in the Service to keep you signed in, remember preferences, secure the Service, and understand how it is used. Some cookies are strictly necessary, while others (analytics and marketing) are used only with your consent, where required.

You can manage your cookie preferences through our cookie banner and through your browser settings. Refusing non-essential cookies will not prevent you from using core features of the Service.

12. Your rights

Subject to the conditions and exceptions set out in the GDPR and the Irish Data Protection Act 2018, you have the following rights:

• Access — to obtain confirmation of whether we process your personal data and a copy of that data
• Rectification — to have inaccurate personal data corrected and incomplete data completed
• Erasure — to have personal data deleted in certain circumstances ("right to be forgotten")
• Restriction — to have processing restricted in certain circumstances
• Portability — to receive certain personal data in a structured, commonly used, machine-readable format and to have it transmitted to another controller
• Objection — to object to processing based on our legitimate interests, including profiling, and to object at any time to processing for direct marketing
• Withdraw consent — where we rely on your consent, to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal
• Not to be subject to automated decision-making — that produces legal or similarly significant effects (we do not currently carry out such decision-making)

To exercise your rights, please contact us using the details in section 14. We may need to verify your identity before responding. We will respond within one month, which may be extended by a further two months for complex requests.

If you are an authorised user of a Customer's workspace and your request concerns Customer Data, we will generally direct you to the Customer or assist them in responding.

13. Complaints

If you believe we have not handled your personal data in line with this Policy or applicable law, please contact us first so we can try to resolve the issue.

You also have the right to lodge a complaint with the Irish Data Protection Commission, which is our lead supervisory authority:

You may also contact the supervisory authority in the EU/EEA Member State of your residence, place of work, or place of the alleged infringement.

14. Contact us

For any questions about this Policy or to exercise your rights, please contact:

15. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated Policy on our website and update the "Last updated" date above. Where changes are material, we will provide additional notice, for example by email or through the Service.