Privacy Policy

About this policy

This policy explains how EvoPoint Ltd, a company registered in England and Wales, processes personal data in connection with the EvoPoint platform. EvoPoint is a multi-tenant incident management service used by UK event venues, festivals, stadiums, and managed facilities.

This policy applies to visitors to our marketing website, customers who hold an EvoPoint subscription, members of their teams who use the platform, contractors who receive jobs through it, and members of the public who submit a report by scanning a venue's QR code. Where we act as a processor on behalf of a customer organisation, the customer's own privacy notice will also apply to the personal data they upload to the platform.

Information we collect

We collect information that you provide directly to us, that is generated through your use of the platform, and that is uploaded by your organisation in the course of operating its EvoPoint workspace.

• Account information - name, work email address, role, and the organisation you belong to. For account admins and EvoPoint super-admins, this includes a hashed password and an encrypted TOTP secret.
• Usage data - server logs, IP addresses, device and browser identifiers, pages viewed, and timestamps recorded when you interact with the platform.
• Tenant-uploaded content - incident reports, photographs, location data, status updates, comments, and audit log entries created within a customer's workspace.
• Public report details - where a member of the public reports an issue by scanning a QR code, whatever they choose to type into the report, including an optional name and contact detail so the venue can follow up.
• Billing information - name, billing address, and limited card metadata returned to us by Stripe. Full payment card numbers are handled by Stripe and never reach our systems.
• Support correspondence - the contents of any messages you send us when you contact customer support.

How we use your information

We use personal data to operate the platform safely and to meet our obligations to customers and to regulators. In particular, we use information to:

• provide, maintain, and improve the EvoPoint service;
• authenticate users and protect accounts, including through multi-factor authentication;
• invoice customers, process subscription payments, and recognise revenue;
• respond to support requests and communicate with you about changes to the service;
• detect, investigate, and prevent fraudulent, abusive, or unauthorised activity;
• monitor the performance and reliability of the platform and to improve our product;
• comply with legal obligations and to respond to lawful requests from regulators or law enforcement.

Legal basis for processing

Under the UK General Data Protection Regulation and the Data Protection Act 2018, we must rely on a lawful basis for each processing activity. The bases we rely on are summarised below.

• Performance of a contract (Article 6(1)(b)): where processing is necessary to provide the platform to a customer or to take steps requested before entering into a contract.
• Legitimate interests (Article 6(1)(f)): to secure our systems, prevent fraud, monitor performance, and improve our service, where these interests are not overridden by your rights.
• Legal obligation (Article 6(1)(c)): to retain records for tax, accounting, or regulatory purposes, and to respond to lawful requests.
• Consent (Article 6(1)(a)): where you ask us to send you marketing communications, which you may withdraw at any time.

Sharing your information

We do not sell personal data. We share it only with the sub-processors listed below, who help us run the platform, and only under written contracts that require them to protect your information.

• Amazon Web Services - application hosting, object storage for photographs and exports, email delivery, and push delivery, in the London region.
• Supabase - managed PostgreSQL database hosting, which holds the incident, user, and reporter records created in the platform.
• Vercel - hosting and content delivery for the web application, which processes request metadata including IP addresses.
• Stripe - subscription billing and payment processing, including its own hosted checkout pages.
• Amazon Simple Email Service - transactional email delivery, including magic-link authentication.
• Amazon Simple Notification Service - delivery of push notifications to the EvoPoint mobile app, which forwards them to Google Firebase Cloud Messaging on Android and to Apple Push Notification service or Firebase Cloud Messaging on iOS.
• Sentry - error tracking and performance monitoring for our backend services.

Customers who need a Data Processing Addendum can request one from privacy@evopoint.uk. We may disclose personal data where compelled by law, by a court order, or by a properly authorised request from law enforcement or a regulator.

International transfers

Application hosting and file storage run on Amazon Web Services in the London region (eu-west-2). Our managed PostgreSQL database is operated by Supabase.

Some of our sub-processors operate from outside the United Kingdom. Where personal data is transferred outside the UK, we rely on appropriate safeguards including the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or an adequacy decision recognised by the UK government.

How long we retain data

We retain personal data only for as long as is necessary for the purpose for which it was collected. Specific retention periods include:

• Active accounts - for as long as the customer organisation maintains an EvoPoint subscription, and then for a further thirty days after the workspace is closed, after which account, incident, and comment data is anonymised and photographs are deleted.
• Audit log entries - append-only for the life of the workspace, and kept after it closes. They are never edited or deleted, and the anonymisation sweep does not reach them, so the email address, IP address, and browser user agent recorded against an action are retained indefinitely as the record of who did what.
• Photographs - kept for the photo retention window on the customer's plan, then purged from object storage.
• Billing records - kept for six years, as required by UK tax and accounting law.

The retention window for a closed workspace is a platform setting, currently thirty days. The window that applies to a given workspace is fixed at the point that workspace is closed, so a later change to the setting does not shorten or extend it.

Your rights under UK GDPR

Subject to certain conditions, you have the following rights in relation to the personal data we hold about you:

• the right to be informed about how we use your data;
• the right of access to a copy of your data;
• the right to rectification of inaccurate data;
• the right to erasure, subject to our retention obligations;
• the right to restriction of processing;
• the right to data portability;
• the right to object to processing carried out on the basis of legitimate interests;
• the right to lodge a complaint with the Information Commissioner's Office.

To exercise any of these rights, please email us at privacy@evopoint.uk. Where you are a user within a customer's workspace, we may need to direct your request to that customer, who is the controller for the data they upload to the platform.

Cookies and similar technologies

We set only the cookies that are strictly necessary to sign you in and keep you signed in, and we store a small number of display preferences in your browser. We do not use cookies to measure how the platform is used and we do not use them for advertising. For the full list, see our Cookie Policy.

Security

We take the security of personal data seriously and design our systems with defence in depth. Files in object storage are encrypted at rest using AES-256, and traffic to the platform is encrypted in transit using TLS 1.2 or above. Workspaces are isolated at the application layer, with every database query and storage path scoped to a single organisation.

Privileged accounts must enrol in time-based one-time password (TOTP) multi-factor authentication, and TOTP secrets are encrypted using a platform-level key. We log all privileged actions to an append-only audit trail.

Children's privacy

EvoPoint is a business-to-business platform and is not directed at children. We do not knowingly collect personal data from individuals under the age of 16. If you believe that a child has provided personal data to us, please contact privacy@evopoint.uk so that we can take appropriate action.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our service, or applicable law. When we do, we will post the updated policy on this page and revise the “Last updated” date at the top. For material changes, we will give customers reasonable advance notice by email or in-product notification.

Contact us

For questions about this policy or to exercise your rights, please contact us at privacy@evopoint.uk or by post to EvoPoint Ltd, 1 Finsbury Avenue, London EC2M 2PF.

If you are not satisfied with how we have handled your personal data, you also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.