Privacy Policy

1. Who we are

Cloud Layer Ltd (“we”, “our”, “us”) is a company registered in England and Wales. We are the data controller responsible for your personal data.

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

2.1 Data You Provide Directly

This includes your name, email address, telephone number, job title, and company name when you contact us, complete a form on our website, or engage with us commercially.

2.2 Data We Obtain from Third-Party Sources

We may obtain professional contact information from publicly available sources, including LinkedIn and business intelligence platforms such as ZoomInfo. This may include your name, job title, company name, business email address, and professional telephone number.

2.3 Inferred Data

In some cases, we may infer contact details (such as an email address) based on publicly available professional information and common corporate email naming conventions. We treat inferred data as personal data subject to the same protections as directly collected data.

2.4 Website Usage Data

When you visit our website, we may collect technical data such as your IP address, browser type, pages visited, and time spent on our site through cookies and similar technologies. Please refer to our Cookie Policy for further details.

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• To provide and deliver our services to you under a contract or pre-contractual arrangement.
• To send you information about our services that we believe may be relevant to your professional role (direct marketing).
• To respond to your enquiries and provide customer support.
• To comply with our legal and regulatory obligations.
• To improve our website, products, and services.

4. Lawful Basis for Processing

We rely on the following lawful bases under Article 6 UK GDPR:

Contract (Article 6(1)(b)): Where processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract.

Legitimate Interests (Article 6(1)(f)): Where we process your data for business development and direct marketing purposes. Our legitimate interest is in promoting our software licensing optimisation services to professionals who may benefit from them. We have conducted a Legitimate Interests Assessment to ensure that our interests do not override your rights and freedoms. A copy of this assessment is available on request.

Consent (Article 6(1)(a)): Where you have given clear consent for us to process your data for a specific purpose. You may withdraw consent at any time.

Legal obligation (Article 6(1)(c)): Where processing is necessary to comply with a legal obligation.

5. Direct Marketing

We may send you marketing communications about our services where we have a lawful basis to do so. For business-to-business marketing emails, we rely on the corporate subscriber exemption under Regulation 22(3) of the Privacy and Electronic Communications Regulations 2003 (PECR), provided the communication is sent to a business email address and you have not previously opted out.

You have the right to opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email, emailing us at [email address], or writing to us at the address above. We maintain a suppression list to ensure that individuals who have opted out are excluded from future marketing.

6. Who We Share Your Data With

We may share your personal data with the following categories of recipients:

• Our group companies, including 2Data, for the purposes described in this policy.
• Service providers who perform functions on our behalf (e.g., email hosting, CRM platforms), subject to appropriate contractual safeguards.
• Professional advisors (e.g., legal, accounting) where necessary.
• Regulatory authorities or law enforcement where required by law.

We do not sell your personal data to third parties.

7. International Transfers

Where your personal data is transferred outside the United Kingdom, we ensure that appropriate safeguards are in place in accordance with UK GDPR, such as Standard Contractual Clauses or an adequacy decision.

8. How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Specifically:

• Prospect data obtained for marketing purposes: retained for a maximum of [12/24] months from the date of collection, unless you engage with us or object to processing.
• Client data: retained for the duration of our commercial relationship and for [6] years thereafter to comply with legal and regulatory requirements.
• Suppression list data: retained indefinitely in anonymised or hashed form to ensure we respect your opt-out preferences.

9. Your Rights

Under UK GDPR, you have the following rights:

Right of access: You may request a copy of the personal data we hold about you.

Right to rectification: You may request that we correct inaccurate or incomplete data.

Right to erasure: You may request that we delete your personal data where there is no compelling reason for continued processing.

Right to restrict processing: You may request that we restrict the processing of your data in certain circumstances.

Right to data portability: You may request a copy of your data in a structured, machine-readable format.

Right to object: You may object to processing based on legitimate interests or for direct marketing purposes. The right to object to direct marketing is absolute.

To exercise any of these rights, please contact us at [email address]. We will respond within one calendar month.

10. Complaints

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Website: ico.org.uk

Telephone: 0303 123 1113

11. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on our website with an updated effective date. We encourage you to review this policy periodically.