Privacy Policy: How We Handle Your Data

Expert Insights Tech Ltd is the controller responsible for the personal information we process for the purposes described in this policy.

Expert Insights Tech Ltd
Higher Mill, Buckfast Abbey
Buckfastleigh, Devon, TQ11 0EE
United Kingdom
Company number: 11425031
ICO registration number: ZB060024
Email: [email protected]

Information you provide

We collect information you choose to provide when you create or use an account, submit a form, request communications, or contact us. Depending on your interaction, this can include your name, work email address, company name, account details, and the contents of your message.

We also process information needed to verify your sign-in and maintain your account session. If you do not provide information required for an account or a request, we may be unable to provide that feature or respond.

Technical and security information

Our website and security providers process technical information such as IP addresses, browser and device details, request times, pages requested, and security signals. We use this to deliver the website, investigate errors, and prevent fraud, unauthorized access, and automated abuse.

Optional analytics and session replay

If you allow Analytics and session replay, we collect additional information about how you use the website. This can include referral sources, page views, clicks, scrolling, navigation, device information, identifiers, and errors.

Session replay reconstructs interactions with our pages from page content and recorded events. Heatmaps show patterns such as where visitors click and how far they scroll. These features help us understand which content is useful and where people encounter problems.

If you sign in and allow analytics, we may link your website activity to your BackupVerdict account. Identifiable or pseudonymous usage information is personal information even if it does not display your name.

Optional company identification and business insights

If you allow Marketing and business insights, we use technical identifiers and browsing activity to help identify companies visiting the website and understand their engagement with our content.

We receive company-level insights from Bombora Visitor Insights, which can combine information from our website with business-identity information it holds. We use these insights to understand our business audience and inform relevant marketing. Company-level reports do not mean the underlying technical information is anonymous.

Where the UK GDPR or EU GDPR applies, we rely on the following lawful bases for our processing:

We consider the effect on your rights when relying on legitimate interests. We do not use that basis to bypass your choices about optional tracking. Creating an account or submitting a form does not automatically consent to optional analytics, business insights, or marketing messages.

Essential technologies support security, authentication, and remembering your cookie choices. Optional analytics, session replay, and business-insight technologies remain off until you enable the relevant category.

Our Cookie Policy provides the detailed information about these technologies, the providers involved, what they do, and how long information remains on your device. It forms part of the privacy information we provide about website tracking.

You can accept both optional categories, reject both, or select categories individually. You can change or withdraw these permissions at any time through Cookie settings in the footer. Withdrawal does not affect the lawfulness of processing that took place before you withdrew permission.

We disclose information to providers and other recipients as needed for the purposes explained in this policy.

Website, security, and account providers

Our hosting and IT suppliers help deliver and maintain the website. Cloudflare supports website delivery, security, bot protection through Turnstile, and cookie consent through Zaraz. Stytch provides account authentication and session management. We use Google Tag Manager to manage certain website tags.

Form processing

HubSpot receives and processes information submitted through our embedded forms so we can manage and respond to your request. These forms do not set cookies on our website. Their processing of submitted information is separate from optional tracking permission. See HubSpot’s Privacy Policy for further information.

Analytics, session replay, and business insights

When you enable the relevant category, information is provided to Google Analytics, PostHog, Microsoft Clarity, or Bombora Visitor Insights. The service-by-service descriptions, browser-storage durations, and links to provider privacy information are in our Cookie Policy.

These disclosures can include device identifiers, IP addresses, page and referral information, and interaction data. Microsoft Clarity receives information used for behavioral metrics, heatmaps, and session replay. PostHog can receive account-linked usage data. Bombora receives information used to associate visits with businesses.

Providers may act on our instructions or determine certain purposes of processing themselves, depending on the service and applicable terms. Their own processing can include operating and improving their services and, where enabled and permitted by your choices, advertising-related purposes. Our Cookie Policy links to their privacy information so you can understand those practices before enabling a category.

Other disclosures

Authorized personnel and professional advisers may access information needed to operate the business, provide advice, or handle legal matters. We may disclose information to public authorities where legally required, or where necessary to protect rights, investigate abuse, or establish, exercise, or defend legal claims.

Information may also be disclosed as part of a proposed or completed business reorganization, merger, or sale, subject to appropriate confidentiality and data protection safeguards.

We are based in the United Kingdom. Our providers may process information in the United Kingdom, the European Economic Area, the United States, and other countries where they operate.

Where a transfer is restricted under applicable UK or EU data protection law, we use an applicable adequacy decision or appropriate contractual safeguards. These can include the European Commission’s Standard Contractual Clauses and, for UK transfers, the UK International Data Transfer Agreement or UK Addendum, as appropriate.

You can contact [email protected] for information about the safeguards applicable to a transfer and how to obtain a copy, subject to necessary redactions.

We determine retention according to the purpose of the information, whether it is still needed, legal requirements, and any relevant disputes or security incidents. The criteria differ by category:

• Account information: while needed to maintain your account and provide access. After account closure, we remove or anonymize information that is no longer needed, subject to legal, security, and dispute requirements.
• Form submissions and correspondence: while needed to answer your request, complete the related follow-up, and retain an appropriate record of the interaction or any resulting dispute.
• Security and technical records: while needed to detect, investigate, and resolve operational problems or abuse. Records relevant to an incident may be kept until the investigation and related claims are resolved.
• Analytics, recordings, and business insights: for the periods configured in the relevant services, based on the time needed to investigate usability problems, compare content performance, and evaluate audience engagement. We review whether identifiable records are still needed and delete or anonymize them when those purposes no longer require them.
• Marketing preferences: while needed to provide requested communications and maintain a record of consent or an objection. We may keep a limited suppression record so that an unsubscribe request continues to be respected.

Cookie expiration periods in our Cookie Policy concern storage on your device. They do not establish how long collected information remains in our systems or a provider’s systems. A provider acting for its own purposes explains its retention in its privacy notice.

Information may remain in restricted backup copies until those copies are replaced through the backup cycle. It is not used for unrelated purposes while awaiting removal.

Depending on applicable law and the circumstances, you may have rights to:

• Access personal information and receive a copy.
• Correct inaccurate or incomplete information.
• Request deletion or restriction of processing.
• Receive certain information in a portable format.
• Withdraw consent for processing based on consent.
• Challenge certain automated decisions.

Right to object: where we rely on legitimate interests, you can object to processing on grounds relating to your situation. You can object to direct marketing at any time.

To exercise a right, email [email protected]. You can also withdraw optional tracking consent through Cookie settings in the footer, and unsubscribe from marketing emails through the link in the message.

We may request information reasonably needed to verify your identity or understand your request. We respond within the period required by applicable law. Under the UK GDPR, this is normally one month, subject to permitted extensions or other rules that apply to the request.

US privacy rights

Where applicable state privacy laws cover our processing, residents may have additional rights to know about, access, correct, delete, or obtain a copy of personal information; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive information; and appeal a decision on a request.

You can submit a request using the email address above. Cookie settings can be used to withdraw optional tracking permission. We act on legally required opt-out preference signals where applicable. We do not discriminate against people for exercising rights protected by applicable privacy law.

Complaints

You can raise a concern with us using the contact details above. You also have the right to complain to the UK Information Commissioner’s Office. If you are in the EEA, you may complain to the data protection authority where you live, work, or believe an infringement occurred.

We use automated tools to analyze website activity, support security, and infer company-level audience information. We do not use audience analytics to make decisions about individuals that have legal or similarly significant effects, such as decisions about employment, credit, or insurance.

We use technical and organizational measures intended to protect information against unauthorized access, loss, alteration, and misuse. Access is limited according to operational needs. No website or transmission method can be guaranteed completely secure.

BackupVerdict is intended for IT and security professionals and is not directed at people under 18. We do not knowingly collect personal information from people under 18. Contact us if you believe a child has provided information so we can investigate and take appropriate action.

When you follow a link to a product vendor or another external website, that organization is responsible for its own collection and use of information. Review its privacy notice before providing information.

Other Expert Insights websites publish their own privacy notices. This policy covers BackupVerdict; it does not automatically extend to every website operated by Expert Insights Tech Ltd.

We may update this policy to reflect changes in our services, processing, or legal requirements. We will update the date above and provide additional notice where required. If a new activity requires consent, we will obtain it before starting that activity.

For questions about this policy or your personal information, contact [email protected] or write to Expert Insights Tech Ltd at the address in section 1.