GDPR & Data Protection

Who this page is for

This page is written for the person who has to sign off ActiveManage — a DPO, an information governance lead, a procurement team working through a security questionnaire. If you are an individual wanting to exercise your rights, the Privacy Policy is the page you want.

Controller and processor

For data inside the applications you run on ActiveManage, you are the controller and we are your processor. You decide what is collected and why; we act only on your documented instructions. We do not use your data for our own purposes, we do not mine it, and we do not use it to train models.

We are the controller only for our own business data — your staff's contact details, our contract with you, and the operational logs we need to run the service securely.

Data Processing Agreement

We enter into a written DPA with every customer, meeting the Article 28 requirements. It covers subject matter and duration, the nature and purpose of processing, the types of data and categories of data subject, and our obligations as processor. Ask info@activemanage.co.uk for a copy, or send us yours — we are used to signing customer paper.

Our DPA commits us to: process only on your instructions; impose confidentiality on everyone with access; apply the Article 32 security measures; engage sub-processors only with your authorisation and on equivalent terms; assist you with data subject requests, DPIAs and breach notification; and delete or return the data at the end of the contract.

Sub-processors

We give notice before adding a sub-processor, and you may object. Nothing is added to this list without a DPA and a security review.

Data residency and transfers

UK hosting is the default. Your data sits in the AWS London region, and stays there unless you ask otherwise — EU and US hosting are available where you need them. Where any transfer outside the UK is involved, we rely on the UK extension to the EU–US Data Privacy Framework or on the IDTA / SCC Addendum, supported by a transfer risk assessment.

What the platform gives you

Meeting UK GDPR is easier when the tooling is built in rather than bolted on. Every tenant has:

• A consent ledger recording what each person agreed to and when
• Configurable retention policies per datastore, so data expires instead of accumulating
• Right-to-erasure tooling that removes or anonymises a subject across related records
• Portability exports in machine-readable form, to answer a subject access request
• A tamper-evident audit trail on every datastore — who changed what, when, and the before and after
• Field-level, default-deny permissions so staff see only what their role requires
• A live security report flagging weak configuration before it becomes an incident

Article 32 security measures

Breach notification

If we become aware of a personal data breach affecting your data we will tell you without undue delay, with what we know about what happened, who is affected, the likely consequences and what we are doing about it — so that you can meet your own 72-hour duty to the ICO. We maintain incident response runbooks and an on-call rotation.

Helping you answer data subject requests

Requests from your data subjects should come to you, as controller. If one reaches us directly we will not action it — we will forward it to you promptly and wait for your instruction. Where you need help locating or extracting data, the portability and search tooling in the platform is usually enough, and our support team will assist where it is not.

What we can evidence

We are happy to complete your security questionnaire, support a DPIA, or talk to your information governance team. Email info@activemanage.co.uk.