Privacy Policy

ObservatoryOS is provided by Cardiff Giant Ventures Limited, a company registered in England and Wales with company number 12322092. Registered office: Unit 12 Green Park, Coed Cae Lane Industrial Estate, Pontyclun, CF72 9GP.

For the purposes of the UK GDPR and the Data Protection Act 2018, Cardiff Giant Ventures Limited is the data controller for personal data processed through this website and the ObservatoryOS service.

We process personal data for the following purposes:

• 1.Providing the service. Managing accounts, authentication and access. Lawful basis: performance of a contract.
• 2.Taking payment. Processing subscription payments and keeping tax and accounting records. Lawful basis: performance of a contract and legal obligation.
• 3.Operating and securing the system. Keeping records, preventing misuse and maintaining security. Lawful basis: legitimate interests in running a secure service.
• 4.Analytics. Understanding how the service is used through privacy-friendly analytics that set no cookies and do not record your name or email. Lawful basis: legitimate interests in improving the service.

We use a small number of trusted suppliers to operate the service, acting as processors under our instructions:

• Hosting and content delivery for the website and application
• Database and authentication services for account and product data
• Email delivery for transactional and account communications
• Payment processing (Stripe)
• Product analytics, run without cookies

Each processor is bound by contract to process personal data only as needed to provide its service. Where a processor changes, this policy will be updated. A current list of processors is available on request.

Some of our processors may store or process personal data outside the United Kingdom. Where that happens, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision for the destination country.

We keep personal data only as long as necessary for the purposes set out in this policy:

• Account data is kept while your account is active
• Billing and tax records are kept for six years, as required by UK law
• Usage and security logs are kept for a limited operational period

Exact retention periods are set out in our internal retention schedule. Some data may be kept longer where required by law.

Under the UK GDPR you have the right to:

• Be informed about how your data is used (this policy)
• Access a copy of your personal data
• Have inaccurate data corrected
• Have your data erased in certain circumstances
• Restrict or object to processing in certain circumstances
• Request data portability
• Withdraw consent where processing relies on consent
• Complain to the Information Commissioner's Office

To exercise any of these rights, contact us using the details below. We will respond within one month.

Please contact us first with any concern and we will try to resolve it directly. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone: 0303 123 1113. Website: ico.org.uk.