Website privacy notice

This notice covers concessa.itsm-ltd.com, the site you are reading. Concessa itself is covered separately, by its Privacy Policy.

1. Who we are

ITSM Ltd, registered in England and Wales under company number 17339600, registered office 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. We are the controller for the personal data described in this notice. Write to support@itsm-ltd.com about any of it.

2. What this site collects

Nothing, through the site itself. There are no cookies, no local storage used to track you, no analytics, no tag manager, no advertising pixels, no video embedded from anybody else and no web fonts loaded from anybody else. Every file the site serves comes from this site. The pages are static, and no script on them sends anything anywhere.

There is also no contact form, which is deliberate: a form on a static site has to post somewhere, and that somewhere is a third party with a copy of your message.

That is what the site collects. Serving you a page still produces a server request, and section 3 says what our host does with those.

3. What our host processes

The site is served by Vercel Inc., which processes standard server request data (your IP address, the page requested, the time, your user agent and referrer) in order to serve the page and to protect the service from abuse. That is a legitimate interest under Article 6(1)(f) UK GDPR. We do not receive an analytics report built from it, and we do not use it to identify anybody.

4. When you contact us

If you email us, we hold your message and address for as long as it takes to answer you and to keep a record of what was said, and no longer than 24 months from the closure of the enquiry. That is the same period as Concessa’s Privacy Policy sets, because it is the same inbox. Our email is provided by Google Ireland Limited. We may also copy an enquiry into our support tool, Atlassian’s Jira Service Management. Those are the only places an enquiry is kept. The lawful basis is our legitimate interest in responding to someone who has written to us; for an enquiry made before a contract, it is Article 6(1)(b).

5. Booking a walkthrough

The “Book a walkthrough” links lead to Calendly LLC, a scheduling service in the United States. Nothing on this site is loaded from Calendly, and nothing about you reaches them unless you follow the link. The booking page is our Calendly account, though, so when you do, the name, email address and meeting details you enter are processed by Calendly on our behalf, under a data processing agreement, and they reach us. Calendly also sets its own cookies on its own site, under its privacy policy rather than this one.

6. Who else receives your data

Four processors, each under a data processing agreement: Vercel Inc. (serving this site), Google Ireland (our email), Atlassian (our support tool) and Calendly (bookings you make). Some of them also appear in Concessa’s Data Processing Agreement, listed there for the app’s support correspondence. This website is outside that agreement’s scope, so their appearance in it is context rather than authority. We do not sell personal data, we do not share it for advertising, and we do not profile you.

7. International transfers

Vercel Inc., Calendly LLC and Atlassian Corporation are United States companies, and Atlassian Pty Ltd is Australian. Transfers to them rely on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.

8. Your rights

You may ask us for a copy of the personal data we hold about you, ask us to correct or erase it, object to our processing of it, or ask us to restrict it. Write to support@itsm-ltd.com. If you are not satisfied with our answer, you may complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first.

9. Changes

If we change this notice, we will change the effective date above. There is no mailing list to notify, because we do not run one.