Privacy Policy

ZovaDesk ("we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share information about you when you use our IT helpdesk and ticketing platform (the "Service"). This policy is written in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We act as the data controller for personal data collected through the Service. If you have any questions about this policy or our data practices, please contact us at privacy@zovadesk.co.uk.

We collect the following categories of personal data: Account Information: Name, email address, job title, company name, and password (stored in hashed form) when you register for an account. Usage Data: Information about how you interact with the Service, including pages visited, features used, ticket activity, and session duration. Device and Technical Data: IP address, browser type and version, operating system, device identifiers, and time zone settings. Communications: Messages you send to us via contact forms, support tickets, or email, including any attachments. Customer Data: Any personal data you upload or input into the Service as part of your IT support operations (e.g., end-user details in tickets, asset records). Payment Information: Billing name, address, and payment card details. Card data is processed directly by our payment provider and is not stored on our servers.

We use your personal data for the following purposes: • To provide, operate, and maintain the Service. • To manage your account and authenticate your identity. • To process payments and manage subscriptions. • To send transactional emails such as account confirmations, password resets, and billing receipts. • To respond to your enquiries and provide customer support. • To monitor and analyse usage patterns to improve the Service. • To detect, prevent, and address technical issues and security threats. • To comply with legal obligations and enforce our Terms of Service. • To send product updates and marketing communications where you have given consent (you may opt out at any time).

We process your personal data on the following legal bases under UK GDPR: Contract Performance: Processing necessary to fulfil our contract with you, including providing the Service and managing your account. Legitimate Interests: Processing necessary for our legitimate business interests, such as improving the Service, preventing fraud, and ensuring security, where these interests are not overridden by your rights. Legal Obligation: Processing required to comply with applicable laws and regulations. Consent: Where you have given explicit consent, such as for marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

We do not sell your personal data. We may share your data with: Service Providers: Trusted third-party vendors who assist us in operating the Service, including cloud hosting providers, payment processors, email delivery services, and analytics platforms. These providers are contractually bound to process data only on our instructions. Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy. Legal Requirements: We may disclose your data if required to do so by law, court order, or government authority, or to protect the rights, property, or safety of ZovaDesk, our users, or the public. We require all third parties to respect the security of your personal data and to treat it in accordance with applicable data protection law.

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Account data is retained for the duration of your subscription and for up to 12 months following account closure, after which it is securely deleted or anonymised. Customer Data (data you input into the Service) is retained for 30 days following account termination, after which it is permanently deleted unless you request earlier deletion. We may retain certain data for longer periods where required by law or for legitimate business purposes such as fraud prevention.

Under UK GDPR, you have the following rights regarding your personal data: Right of Access: You may request a copy of the personal data we hold about you. Right to Rectification: You may request correction of inaccurate or incomplete data. Right to Erasure: You may request deletion of your personal data in certain circumstances. Right to Restrict Processing: You may request that we limit how we use your data in certain circumstances. Right to Data Portability: You may request a copy of your data in a structured, machine-readable format. Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time. To exercise any of these rights, please contact us at privacy@zovadesk.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We use cookies and similar tracking technologies to operate and improve the Service. Cookies are small text files stored on your device. Essential Cookies: Required for the Service to function correctly, including authentication and session management. These cannot be disabled. Analytics Cookies: Used to understand how users interact with the Service, helping us improve functionality and performance. These are only set with your consent. Preference Cookies: Used to remember your settings and preferences across sessions. You can control cookie settings through your browser preferences. Disabling certain cookies may affect the functionality of the Service.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include: • Encryption of data in transit using TLS/SSL. • Encryption of sensitive data at rest. • Access controls and role-based permissions. • Regular security assessments and penetration testing. • Employee training on data protection and security practices. While we take all reasonable steps to protect your data, no method of transmission over the internet is completely secure. We cannot guarantee absolute security and encourage you to use strong, unique passwords and to keep your account credentials confidential.

Your data may be transferred to and processed in countries outside the United Kingdom. Where we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office, to ensure your data receives an equivalent level of protection.

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@zovadesk.co.uk and we will take steps to delete such data promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by email or by posting a prominent notice on the Service. The date of the most recent revision is shown at the top of this page. We encourage you to review this policy periodically to stay informed about how we protect your data.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection team: ZovaDesk — Data Protection Email: privacy@zovadesk.co.uk Website: https://zovadesk.co.uk Postal address available on request. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (ico.org.uk).