Interim privacy notice. This notice reflects our current understanding and may be updated when production hosting and data-deletion arrangements are finalised.

Prospexe is operated by Robert Christopher Link, trading as Prospexe (“we”, “us” or “our”). This notice explains our handling of personal data and how to contact us about privacy.

This notice covers personal data we process for our own purposes, such as service administration, authentication, enquiries and security. It does not replace the privacy notices customer organisations provide for data they control.

Customer Data can include contact and prospect records; email, SMS and other message content; call records, notes and transcripts; customer-created support tickets and attachments; and agency staff and HR records, including health-related HR information where the customer instructs us to process it. We process Customer Data on customer instructions to provide the Service, not for our own marketing. The applicable customer agreement and data processing agreement (DPA) govern that processing. If your request concerns Customer Data, contact the responsible customer organisation.

1. Who we are

The current operator and controller for the personal data described in this notice is Robert Christopher Link, trading as Prospexe. Prospexe is not currently operated by an incorporated “Prospexe Limited”. This notice will be updated if the legal operator changes.

For privacy enquiries, email info@prospexe.co.uk. No Data Protection Officer is currently appointed.

2. Personal data we collect

Website visitors: technical information needed to deliver and protect the website, which may include IP address, browser and device details, and request, error or security information. If Replit-hosted analytics is enabled in Publishing, Replit injects the Umami tracker into the published Service. It records page views and selected custom events, with visit context such as the page, referrer and browser or device details. Our custom events use fixed event names and do not include contact details, account or record identifiers, or free-form user content. Umami describes its tracker as not using cookies or cross-site tracking; see its documentation.
Enquiries: information you provide when contacting us, such as your name, email address, organisation and enquiry.
Account administration and authentication: name, work email, account identifiers, access roles and permissions, and information needed to administer access or investigate service and security issues. Clerk handles authentication, including sign-in credentials.
Service enquiries and support: contact information and correspondence addressed to Prospexe about the Service. Customer records included in support material remain subject to the applicable customer instructions; they are not automatically treated as our own business data.
Customer Data: the categories described above, including the records customer organisations place in the Service. Customer organisations decide what information to enter and are responsible for their own collection and privacy notices.

Account information may be necessary to provide access or respond to an enquiry. Without it, we may be unable to create or maintain access or respond to you. Customer organisations are responsible for explaining what information they require from their own staff and contacts.

3. How and why we use personal data

Provide and administer the Service: to operate customer accounts and authorised access, generally relying on our legitimate interests in operating the Service and, where a direct contract applies, the steps needed to perform that contract.
Respond to enquiries: to answer questions and operate our business, generally relying on legitimate interests or, where applicable, steps requested before entering a contract.
Security and troubleshooting: to protect accounts and the Service, investigate technical issues and prevent abuse, relying on our legitimate interests.
Legal and accounting obligations: where processing is needed to comply with applicable law.
Optional sidebar preference: if you choose to allow it, remember whether your workspace sidebar is open or closed. This uses your consent, which you can withdraw at any time at Cookie preferences.
Website and product analytics, if enabled: understand visits and selected feature use so we can maintain and improve the Service. Before enabling analytics, we will review and document an appropriate lawful basis and whether consent is required.

We do not send product-marketing communications or use advertising tracking. Analytics is enabled separately through Replit Publishing settings; the cookie banner does not enable or disable it.

The customer controller determines the purposes, lawful bases and, where applicable, special-category conditions for Customer Data, including health-related HR information. We process it only on documented customer instructions and under the applicable DPA.

4. Who receives personal data

Authentication: Clerk supports sign-in and account security. See the international-processing section below.
Website enquiries: Resend processes the name, email address and message submitted through the contact form and delivers them to Prospexe. The enquiry is not stored in the Prospexe application database.
Hosting and storage: UK hosting is the intended approach, with IONOS planned for production hosting and storage. The exact production services and backup arrangements are not yet finalised; this notice will be updated when they are confirmed.
Publishing and analytics: Replit provides the publishing platform and, if its analytics setting is enabled, injects the Umami tracker into the published Service. See Replit’s privacy policy for information about Replit’s own processing.
Customer-selected integrations: customer organisations choose and manage their own email, voice and messaging services. When instructed to use one, relevant information is exchanged with that provider for the requested function. Customers should review those providers’ terms and privacy information.
Professional advisers: where needed for legal or accounting advice, subject to appropriate confidentiality.
Legal disclosures: where required by law or necessary to establish, exercise or defend legal claims.
Business changes: if the Service or business is transferred, relevant information may be shared where necessary and subject to applicable law.

We do not sell personal data. No online payment provider has been selected for Prospexe subscriptions; subscriptions and payment processing are planned for the future. If that changes, we will update this notice before those payments are introduced.

5. Cookies and similar technologies

Essential cookies and related authentication technologies support sign-in and account security. They are separate from the optional sidebar preference.

If you choose to allow it, one optional cookie remembers whether your workspace sidebar is open or closed. Selecting “Essential only” withdraws that choice and clears the existing sidebar cookie.

The cookie-preference tool stores your choice in this browser for up to 90 days. You can change it at any time at Cookie preferences or through the Service’s cookie controls. Disabling essential authentication cookies can prevent sign-in.

The cookie-preference tool does not control analytics. If enabled through Replit Publishing, the Umami tracker records page views and selected events without analytics cookies or cross-site tracking, according to Umami’s documentation. We do not use advertising cookies. This preference does not manage cookies on services independently operated by customer-selected providers.

6. International processing

The intended hosting approach is UK-based hosting; this does not mean every provider processes information only in the UK. Clerk’s published security information describes US-hosted authentication without regional data residency.

We are confirming which international transfer safeguards apply to the Replit-managed authentication service used by Prospexe. We will update this notice when the applicable arrangements are confirmed. Customer-selected communications providers may also process information internationally; customers should review the arrangements for the providers they choose.

7. How long we keep personal data

We keep personal data only as long as reasonably needed for its purpose, subject to legal requirements. These are our current intended periods; Customer Data return and deletion are also governed by customer instructions and the applicable DPA.

Account administration: intended for the active service relationship, with a target of deleting remaining account data within 30 days after termination, subject to contractual instructions and legal exceptions.
Customer Data: return and deletion follow customer instructions and the DPA. The DPA currently provides for deletion after termination; its interaction with an export period, backups, provider copies and legal exceptions is being reviewed. Our intended target is to delete remaining Customer Data within 30 days after termination, subject to those instructions and exceptions. Automatic account-wide deletion is not yet enabled, and deletion from the active Service may not immediately remove provider or backup copies.
Enquiries: intended to be kept for no longer than 24 months after the last relevant activity, unless an ongoing matter or legal requirement justifies retaining them longer.
Financial records: if created, kept for the applicable tax and accounting retention period. The period depends on the operator’s legal status, the relevant record and any applicable exception; it is not a single universal period.
Security and operational records: kept only as long as reasonably needed for security, troubleshooting, incident handling and legal obligations.

These periods are not a promise of immediate removal from every backup or third-party system. We are finalising the detailed deletion and backup process; we will update this notice as that process is confirmed.

8. Your rights

Depending on the circumstances and lawful basis, you may request access to or correction, erasure, restriction or a portable copy of your personal data. You may also object to processing based on legitimate interests and withdraw consent where processing relies on consent. These rights are subject to applicable legal conditions and exceptions.

For information we process as a controller, contact info@prospexe.co.uk. We may request reasonable information to verify your identity or clarify your request.

For Customer Data, contact the responsible customer organisation. If we receive a request about Customer Data, we will direct it to that organisation and assist under the DPA and applicable law.

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. You may contact the ICO directly; contacting us first is not required.

9. Security

We use technical and organisational measures intended to reduce unauthorised access, loss and misuse. These include access controls and tenant separation, transport-security measures, and encryption for protected stored fields and attachments. Our maintenance approach includes dependency checks and scheduled security reviews.

No system is guaranteed to be completely secure. We do not claim an independent security certification or guarantee that every planned backup, incident-response or administrative measure has been independently verified.

Customers and authorised users should protect their credentials and manage access appropriately. Safeguards for sensitive customer HR data are governed by the customer instructions, the DPA and the measures actually in place.

10. Children

The Service is intended for business users aged 18 or over. This does not guarantee that Customer Data entered by a customer can never concern a person under 18. Customer organisations are responsible for the lawful collection and processing of the information they put into the Service.

11. Changes to this notice

We may update this notice when our legal operator, providers or processing practices change. We will update the date at the top. Where required, we will communicate material changes through an appropriate channel.

12. Contact us

For privacy enquiries, contact Robert Christopher Link, trading as Prospexe, at info@prospexe.co.uk.

Privacy Policy