Privacy Policy
This policy explains how Supap Limited collects, uses, and protects your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data Controller
The data controller responsible for your personal data is:
Retentifi is a product of Supap Limited. References to “we”, “us”, or “our” in this policy refer to Supap Limited.
2. Data We Collect
We collect personal data in the following categories, depending on how you interact with Retentifi:
Processor role: When your business uses Retentifi to analyse customer conversations, Supap Limited acts as a data processor on your behalf. Your customers' personal data within those conversations is processed strictly under your instructions and a Data Processing Agreement (DPA) governs that relationship separately.
We do not collect any special category data (e.g. health, race, religion, biometrics) and do not knowingly process such data through the platform.
3. Lawful Basis for Processing
Under UK GDPR Article 6, we rely on the following lawful bases:
Contract (Art. 6(1)(b))
Providing the Retentifi service, managing your account, processing payments, and responding to support requests.
Legitimate interests (Art. 6(1)(f))
Improving our product, detecting fraud and abuse, securing our systems, conducting analytics to understand usage patterns, and direct marketing to existing customers. We have conducted a Legitimate Interests Assessment (LIA) for each of these purposes and concluded our interests are not overridden by your rights.
Legal obligation (Art. 6(1)(c))
Complying with applicable law, including tax, accounting, and regulatory requirements.
Consent (Art. 6(1)(a))
Non-essential cookies and marketing communications where you are not an existing customer. You may withdraw consent at any time.
4. How We Use Your Data
We use your personal data to:
- Create and maintain your Retentifi account
- Deliver, operate, and improve the Retentifi platform
- Process subscription payments and manage billing
- Provide customer support and respond to enquiries
- Send transactional communications (e.g. receipts, security alerts)
- Send product updates and marketing communications where permitted
- Monitor platform performance, detect bugs, and prevent abuse
- Conduct product analytics to improve features and user experience
- Meet our legal and regulatory obligations
- Enforce our Terms of Service
We will never sell your personal data to third parties.
6. Retention Periods
We retain personal data only for as long as necessary for the purposes set out in this policy, or as required by law.
When retention periods expire, data is securely deleted or anonymised so it can no longer be linked back to you.
7. International Data Transfers
Supap Limited is incorporated in the UK and our primary data processing occurs within the UK and the European Economic Area (EEA).
Where we use sub-processors outside the UK or EEA (for example, cloud infrastructure providers), we ensure adequate safeguards are in place in accordance with UK GDPR Chapter V. These safeguards include:
- UK International Data Transfer Agreements (IDTAs) or Addenda to EU Standard Contractual Clauses
- Adequacy decisions issued by the UK Secretary of State
- Binding Corporate Rules where applicable
You may request details of the specific safeguards applicable to any transfer by contacting us at hello@supap.co.uk.
9. Your Rights Under UK GDPR
Under UK GDPR, you have the following rights in relation to your personal data. We will respond to all verified requests within one calendar month (extendable by two further months for complex requests, with notice).
Right of access (Art. 15)
Request a copy of the personal data we hold about you and information about how we process it.
Right to rectification (Art. 16)
Ask us to correct inaccurate data or complete incomplete data without undue delay.
Right to erasure (Art. 17)
Request deletion of your personal data where there is no compelling reason for continued processing.
Right to restriction (Art. 18)
Ask us to suspend processing of your data while accuracy or legitimate grounds are contested.
Right to data portability (Art. 20)
Receive your data in a structured, machine-readable format and transfer it to another controller.
Right to object (Art. 21)
Object to processing based on legitimate interests or direct marketing at any time.
Automated decision-making (Art. 22)
Not be subject to decisions based solely on automated processing that produce legal or significant effects.
Right to withdraw consent
Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email hello@supap.co.uk with your full name, the email address associated with your account, and a description of your request. We may need to verify your identity before processing the request.
10. Children
Retentifi is a business-to-business (B2B) platform and is not directed at, or intended for use by, individuals under the age of 18. We do not knowingly collect personal data from children.
If you believe a child has provided us with personal data, please contact us immediately at hello@supap.co.uk and we will take steps to delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Notify registered users by email at least 14 days before the change takes effect
- Where required by law, seek fresh consent
Continued use of Retentifi after the effective date of an updated policy constitutes acceptance of the changes.
12. Contact Us & Right to Complain
For any questions, concerns, or to exercise your data protection rights, please contact us: