PRIVACY POLICY

Information you provide to us. When you contact us or request information about Partlake, we collect the name, work email address, and company name you give us, together with the content of your message.

Information we receive from your identity provider. Partlake accounts are created through single sign-on. When you sign in using your organisation's identity provider, e.g. Microsoft, we receive your name, work email address, and an account identifier. We do not create or store passwords and have no access to your credentials at your identity provider.

Information provided by your organisation. Where your employer subscribes to Partlake, it may provide us with the work email addresses of the people who should be given access, so that we can provision their accounts.

Billing information. Where your organisation gives us a named billing contact, we process that person's name, work email address, and job title for invoicing and account administration.

Information collected automatically. When you use Partlake we log technical data including IP address, browser and device type, pages and API endpoints accessed, and timestamps. We use this for security, abuse prevention, diagnostics, and to understand how the platform is used.

We use only cookies that are strictly necessary to operate partlake.com and the Partlake platform, such as keeping you signed in after authentication.

We do not use analytics, advertising, or tracking cookies, and we do not permit third parties to set cookies through on our site. Where we analyse how the platform is used, we do so from our own server-side logs rather than by tracking you across sites or devices.

We process personal data for the following purposes:

• To provide the platform. Creating and administering accounts, authenticating users through your organisation's identity provider, and making Partlake's data and API available to authorised users.
• To administer the customer relationship. Negotiating and performing subscription agreements, invoicing, and handling support requests.
• To communicate with you. Responding to enquiries and sending service and administrative messages about your account, the platform, or changes to our terms.
• To keep the platform secure. Monitoring for unauthorised access, abuse of the API, and misuse of licensed data, and investigating incidents.
• To maintain and improve the platform. Diagnosing faults and understanding which features and data are used, so we can develop the service.
• To comply with legal obligations. Meeting accounting, tax, and record-keeping requirements, and responding to lawful requests from authorities.
• To establish or defend legal claims. Where necessary to enforce our terms or protect our rights.

Under the GDPR we must have a valid legal basis for processing personal data. We rely on the following:

• Performance of a contract, or steps taken before entering one (Art. 6(1)(b)). Negotiating and performing a subscription agreement where you are contracting with us in your own name, and invoicing under that agreement.
• Legitimate interests (Art. 6(1)(f)). Where your employer or another organisation is our contracting customer, we rely on our legitimate interest in performing that agreement to provision and administer your account, authenticate you through your organisation's identity provider, and provide support. We also rely on legitimate interests to keep the platform secure and available, detect unauthorised access, API abuse, and misuse of licensed data, diagnose faults, understand how the platform is used, communicate with business contacts about the service, enforce our terms, protect our intellectual property in the licensed dataset, and establish, exercise, or defend legal claims. We consider in each case whether our interests are outweighed by your interests, rights, and freedoms.
• Compliance with a legal obligation (Art. 6(1)(c)). Meeting accounting, tax, and record-keeping requirements under Estonian and EU law, and responding to lawful requests from public authorities.

We do not sell personal data or share it for advertising.

We use a small number of service providers to operate Partlake, e.g. cloud hosting, business email, and application monitoring. Where they process personal data on our behalf, they do so under data processing terms imposing confidentiality and security obligations. Business customers can request a current list of these providers.

We use a small number of service providers to operate Partlake, e.g. cloud hosting, business email, and application monitoring. They process personal data only on our instructions, under written contracts imposing confidentiality and security obligations. Business customers can request a current list of providers, which is also set out in the data processing agreement where one is in place.

Your organisation's identity provider, e.g. Microsoft, acts independently under its own privacy policy when it authenticates you.

We may also disclose personal data to our professional advisers, where required by law, where necessary to establish or defend legal claims, or in connection with a merger, acquisition, or sale of assets.

Under the GDPR you have the right to request access to your personal data, to have inaccurate data corrected, to have your data erased, to restrict or object to our processing, and to receive your data in a portable form. These rights are subject to conditions and exceptions under applicable law.

To exercise any of these rights, contact us at . If you are unhappy with how we have handled your personal data, you also have the right to complain to a supervisory authority.