Privacy Policy
Version 1.0 · In force from 2026-08-22
1. INTRODUCTION
This Privacy Policy is provided by ITSM Ltd, a company registered in England and Wales under company number 17339600, with registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF ('we', 'our' or 'us'). We trade under the names ImproveDesk and Fulfilra, and this one policy covers our products and services under both — each product's website and software application together (Services). Where something is true of one Service and not the other, it is set out in Annex A (ImproveDesk) or Annex B (Fulfilra) at the end.
We take your privacy very seriously. Please read this policy carefully, as it contains important information on how and why we collect, store, use and share any information relating to you (your personal data), your rights in relation to it, and how to contact us or the regulator if you have a complaint. Our handling of your personal data is regulated by law, including the UK General Data Protection Regulation (UK GDPR).
WHICH OF US IS RESPONSIBLE FOR WHAT
There are two kinds of personal data here, and different people are responsible for each. Getting this right matters, because it decides whose privacy notice governs and who you should ask when you want something done.
We are the controller — the organisation that decides how and why the data is used — for the data we hold about you as a user of the Services: your account and the email address it uses, your sign-in and security data, billing, the record of which of our documents you accepted, how the Services are used, and the messages we send you. This policy governs that data, and requests about it come to us.
We are a processor, and your organisation is the controller, for everything your organisation records in the Service — for ImproveDesk, the register (improvement items, nonconformities, corrective actions, review decisions, comments, anything sent in by email, and the evidence packs built from them); for Fulfilra, service requests (their field values, approvals, status history and comments, including internal notes). Your organisation decides what goes in, why, and how long it stays. We process it on its documented instructions under clause 11 of our SaaS Terms and Conditions and the Data Processing Particulars in the relevant Service Schedule, and for no purpose of our own. Your organisation's privacy notice governs that content, not this one.
If you want something removed from an organisation's Records, or want to know why you appear in them, ask that organisation. We will help it answer, but we cannot decide on its behalf what belongs in its records. Section 12 explains this further.
2. WHAT THIS POLICY APPLIES TO
This policy relates to your use of the Services only. The Services may link to or rely on other apps, websites, APIs or services owned and operated by us or by trusted third parties. Those other services may gather information about you under their own separate privacy policies, which you should consult. For more information, see section 8.
3. PERSONAL DATA WE COLLECT ABOUT YOU
The personal data we collect depends on the activities carried out through the Services. Across both Services we collect and use the following personal data about you; the categories specific to each Service are in its Annex.
| Category of data | In more detail |
|---|---|
| Identity and account data you input into the Services (registration is mandatory in order to use the Services) | Your account details, such as business email address (username) and password or other sign-in credentials |
| Data collected when you use specific functions in the Services | Data you store online with us using the Services, including your usage history or preferences (while such data may not always be personal data as defined at law, in all cases we will assume it is and treat it in accordance with this policy as if it were) |
| Other data the Services collect automatically when you use them | Your activities on, and use of, the Services, which reveal your preferences, interests or manner of use of the Services and the times of use |
| Data collected when you make an enquiry with us | Your name (if you give one) and email address, and the content of your enquiry |
| Content your organisation records in the Service | The Records described in section 1. These are free text and may name or describe any person. Where this content contains personal data, your organisation is the controller and we are its processor |
| Security and sign-in data | Your sign-in credentials and session, any multi-factor authentication factors your Service uses, and the record of which legal documents you accepted and at which version |
| Business use declaration | The confirmation you give when you create your account that you are using the Services for business purposes rather than as a consumer, and — if you choose to give it — your company registration or VAT number. The number is optional and we do not require it |
| Waitlist | If you ask to be told when a Service launches, your email address — handled as the Annex for that Service describes |
If you do not provide personal data we ask for where it is required, it may prevent us from providing the Services to you.
4. SENSITIVE DATA
Sensitive personal data (also known as special category data) means information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used for identification, and data concerning health, sex life or sexual orientation.
We do not ask for sensitive personal data, or information about criminal offences, in order to give you an account, and we do not seek it for our own purposes.
Sensitive personal data can nevertheless reach the Services in one situation, and it is better to be plain about it. The things organisations record in these Services describe real events, and some of those events involve health, safety or conduct. Where an organisation records that kind of information, the organisation is the controller of it and we process it on that organisation's instructions — the organisation is responsible for having any condition required under Article 9 or Article 10 of the UK GDPR, and its own privacy notice governs it, not this one. Our Acceptable Use Policy asks the people using a Service not to record special category data unless their organisation has told them the Service is used for that purpose.
We do not treat information recorded in a private, access-controlled Record as having been made public by the person it concerns.
5. CHILDREN
The Services are not intended for children. They are not intended for unsupervised use by anyone under 18, and we do not knowingly collect personal data from anyone under 18 for our own purposes. If you believe someone under 18 holds an account, tell us and we will remove it.
That is separate from what an organisation records in the Service. A school, a healthcare provider or a local authority may record an entry that describes a child. Where that happens, the organisation is the controller of that content, is responsible for having a lawful basis for it and for the additional care that children's data requires, and its own privacy notice governs it. See section 1.
6. HOW YOUR PERSONAL DATA IS COLLECTED
We collect personal data from you directly when you sign up to the Services, contact us directly or reach out to us via social media, and indirectly, such as through your activity while using the Services.
As part of delivering the Services we use essential cookies — to keep you signed in, to complete sign-up (and, for Fulfilra, sign-in by email link) safely, and, for ImproveDesk, to remember your appearance preference. For more information, see our Cookie Policy.
We also measure how the Services are used — how many pages are viewed and which parts of the product people reach. That measurement does not use cookies, and the way it works differs by Service; each Annex describes it plainly. In every case: we do not build a profile of you, nothing follows you to another website, and — as with any request your browser makes — the request carrying the measurement reaches our hosting provider with your IP address attached.
7. HOW AND WHY WE USE YOUR PERSONAL DATA
Under data protection law, we can only use your personal data if we have a proper reason:
(a) where you have given consent; (b) to comply with our legal and regulatory obligations; (c) for the performance of a contract with you, or to take steps at your request before entering into a contract; or (d) for our legitimate interests or those of a third party.
A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We carry out an assessment when relying on legitimate interests, to balance our interests against yours; you can obtain details of that assessment by contacting us (see section 16).
| What we use your personal data for | Our reasons |
|---|---|
| Create and manage your account with us | To perform our contract with you, or to take steps at your request before entering into a contract |
| Recording that you told us you are using the Services for business purposes | For our legitimate interests, i.e. knowing which legal regime a contract falls under and being able to show what was represented and when. Your declaration is evidence, not a decision: whether someone is in fact a consumer is settled by law, not by a tick box, and if it turns out you dealt as a consumer your statutory rights are unaffected |
| Providing the Services and their functionalities to you | To perform our contract with you, or to take steps at your request before entering into a contract (the contract being our SaaS Terms and Conditions and the relevant Service Schedule, or — for website use — our Website Terms of Use) |
| To enforce legal rights, or defend or undertake legal proceedings | Depending on the circumstances: to comply with our legal and regulatory obligations; otherwise, for our legitimate interests or those of a third party, i.e. to protect our business, interests and rights or those of others |
| Communications with you not related to marketing — including about changes to our terms or policies, changes to the Services, or other important notices | Depending on the circumstances: to comply with our legal and regulatory obligations; otherwise, for our legitimate interests, i.e. to provide the best service to you |
| Protecting the security of systems and data | Depending on the circumstances: to comply with our legal and regulatory obligations; and, where we go beyond them, for our legitimate interests, i.e. to protect systems and data and to prevent and detect criminal activity that could be damaging for you and/or us |
| Operational reasons, such as improving efficiency, training and quality control, and providing support to you | For our legitimate interests, i.e. to be as efficient as we can so we can deliver the best service to you |
| Statistical analysis to help us manage our business, e.g. in relation to our performance, customer base and Service functionalities | For our legitimate interests, i.e. to be as efficient as we can, and to improve and develop the Services |
| Updating and enhancing user records | Depending on the circumstances: to perform our contract with you; to comply with our legal and regulatory obligations; otherwise, for our legitimate interests, e.g. making sure we can keep in touch with our customers about their accounts |
| Understanding how the Services are used, so that we can improve them | For our legitimate interests, i.e. to see which parts of the product people reach and where they get stuck — measured as each Annex describes |
| Handling support enquiries, and creating and maintaining support accounts for your organisation's administrators (and, for Fulfilra, agents) | To perform our contract with you |
| Deleting Free-tier organisations that have been unused for 12 months | For our legitimate interests, i.e. not holding data nobody is using. We give notice first — see section 9 |
| Preventing automated abuse of our public forms | For our legitimate interests, i.e. keeping the Services available and free of automated abuse |
| Telling you when a Service launches, if you asked us to | Where you have given consent, which you can withdraw at any time |
| Sending you occasional product news and improvement tips | Only where you have consented. We ask with an unticked box when you create your account or set your password, and we record what you chose and when. You can change your mind at any time and at no cost, from Settings → Email preferences or from the link in any message. We do not pass your details to anyone else for their own marketing |
| Sharing your personal data with members of our group and third parties in connection with a significant corporate transaction or restructuring — including a merger, acquisition, asset sale, initial public offering, or in the event of our insolvency. In such cases information will be anonymised where possible and only shared where necessary | Depending on the circumstances: to comply with our legal and regulatory obligations; otherwise, for our legitimate interests, i.e. to protect, realise or grow the value in our business and assets |
8. WHO WE SHARE YOUR PERSONAL DATA WITH
We routinely share personal data with service providers we use to help us run our business or provide the Services. We only allow service providers to handle your personal data if we are satisfied they take appropriate measures to protect it, and we impose contractual obligations on them so they can only use it to provide services to us and to you.
The complete list of processors for each Service — what we use each for, what personal data each receives, where it processes it, and the transfer mechanism we rely on — is in that Service's Annex. Each Annex table is the sub-processor list for the purposes of clause 11.5 of our SaaS Terms and Conditions. If we add or replace a processor we will update the table and give existing customers at least 30 days' notice by email before the change takes effect; customers may object on reasonable data protection grounds within that period. We keep an internal record of the date each processor's data protection terms took effect, and will provide it on request.
We, or the processors listed in the Annexes, may occasionally also need to share your personal data with:
(a) external auditors, e.g. in relation to the audit of our accounts — the recipient will be bound by confidentiality obligations;
(b) professional advisers (such as lawyers and other advisers) — the recipient will be bound by confidentiality obligations;
(c) law enforcement agencies, courts or tribunals, and regulatory bodies, to comply with legal and regulatory obligations; and
(d) other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency — usually information will be anonymised, but this may not always be possible; the recipient will be bound by confidentiality obligations.
We will not share your personal data with any third party other than as described in this section and the Annexes.
9. HOW LONG YOUR PERSONAL DATA WILL BE KEPT
How long we keep something depends on what it is. These rules apply to both Services; the rows that differ by Service are in the Annexes.
| What | How long we keep it |
|---|---|
| Your account and the personal data in it | For as long as your organisation holds an account, and for up to 6 years afterwards where we need it to meet accounting or legal obligations or to bring or defend a legal claim, except where a row below or in the Annex states otherwise |
| An organisation on the Free tier that nobody uses | We delete the organisation and everything in it after 12 months without any activity. We email the owner 30 days beforehand and again 7 days beforehand, and any activity in the account resets the clock. Organisations on a paid tier are never deleted this way |
| An organisation deleted at its own request | Deleted in full, in the way that Service's Annex describes. Deletion is not reversible |
| Content in your organisation's Records | For as long as the organisation keeps it. The organisation decides — it is the controller of that content |
| The record of which legal documents you accepted | Kept indefinitely. It is the evidence of what you agreed to and at which version, and it holds no more than your user identifier, the document, the version, and the date and time |
| Your business use declaration | Kept indefinitely, for the same reason: it is the evidence of what you told us and when, and it holds no more than your user identifier, the declaration, and any registration number you chose to give |
| Support tickets in our support systems | A minimum of 6 years after the customer organisation closes. Support accounts are removed only when an owner or administrator of the organisation asks us to remove them |
| Billing records | 6 years, to meet accounting and tax obligations |
| Your marketing preference | For as long as you hold an account, and for up to 6 years afterwards. The record of a withdrawal is kept for the same reason as the record of a consent: it is the evidence that we stopped when you asked |
At the end of the relevant period we delete or anonymise the personal data.
10. DE-IDENTIFIED INFORMATION
We may produce aggregated statistics from the information we hold — for example, how many items a typical organisation closes in a quarter — and use them to operate and improve the Services and to publish benchmarks. We only do this where the result cannot identify you, any other individual, or any customer organisation. We do not sell your personal data.
11. TRANSFERRING YOUR PERSONAL DATA OUT OF THE UK
The database that holds everything your organisation records is in the United Kingdom — in our database provider's London (eu-west-2) region — for both Services, and Client Data is stored in the UK unless a Service Schedule states otherwise. Some of the other services we rely on process personal data elsewhere, and those transfers happen now rather than hypothetically; the Annexes say which.
Under UK data protection law a transfer out of the UK normally needs one of two things, and they are alternatives rather than the same route: either the UK government has decided that the destination provides an adequate level of protection (an adequacy regulation under Article 45 of the UK GDPR), or appropriate safeguards are in place together with enforceable rights and effective remedies for you (Article 46). A limited set of specific exceptions can also apply.
(a) The EEA. The UK currently treats the EEA as adequate under transitional provisions made by section 17A of the Data Protection Act 2018 and the DPPEC Regulations 2019.
(b) Anywhere else. We rely on appropriate safeguards under Article 46 — in practice the International Data Transfer Agreement, or the EU Standard Contractual Clauses as amended by the UK Addendum — with each recipient.
We keep a record of which mechanism applies to which recipient, and will tell you which one covers a particular service if you ask.
12. YOUR RIGHTS
You generally have the following rights, which you can usually exercise free of charge. For more information, see the ICO's guide to individual rights.
| Right | What it means |
|---|---|
| Access to a copy of your personal data | The right to be provided with a copy of your personal data. |
| Correction (rectification) | The right to require us to correct any mistakes in your personal data. |
| Erasure (the right to be forgotten) | The right to require us to delete your personal data, in certain situations. |
| Restriction of use | The right to require us to restrict use of your personal data in certain circumstances, e.g. if you contest its accuracy. |
| Data portability | The right to receive the personal data you provided to us in a structured, commonly used and machine-readable format, and/or to transmit it to a third party — in certain situations. |
| To object to use | The right to object: at any time, to your personal data being used for direct marketing (including profiling); and, in certain other situations, to our continued use of your personal data, e.g. where we rely on legitimate interests. |
| Not to be subject to decisions without human involvement | The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you. We do not make any such decisions. Two automated things in the Services are not decisions about you: ImproveDesk records carry a priority score the product calculates, which ranks work rather than people; and Free-tier organisations unused for 12 months are deleted automatically after notice, which is a decision about an account rather than an individual. We do not use artificial intelligence to process the contents of your organisation's Records. |
You have an absolute right to object to direct marketing at any time, and if you do we will stop. Because we send marketing only on consent, the simplest route is to withdraw it in Settings → Email preferences, which takes effect immediately. You also have the right to withdraw your consent at any time wherever we rely on consent — for example, if you asked to be told when a Service launches. Withdrawing consent does not affect anything we did before you withdrew it.
We will respond to a request within one month. If a request is complex, or you have made several, we may extend that by up to two further months, and we will tell you if we do.
WHERE YOU SHOULD SEND A REQUEST
If your request is about content inside an organisation's Records — an improvement item, a nonconformity, a service request, an approval — the organisation is the controller of that content and you should ask it. We will help it respond, but we cannot decide on its behalf what stays in its records. If your request is about the data we hold about you as a user of the Services — your account, your sign-in, your email address — ask us.
THINGS WE CANNOT UNDO, AND WHY
Some records in each Service cannot be removed individually, by design — because they are the evidence the product exists to produce, or the proof of your own agreement. Each Annex lists exactly which records these are for that Service, and why. Where we cannot delete something, we rely on Article 17(3) of the UK GDPR, which allows personal data to be kept where it is needed to comply with a legal obligation or for the establishment, exercise or defence of legal claims. We can still restrict how the data is used, and we will always tell you what we have done and why.
If you would like to exercise any of your rights, please email us — see section 16. When you do, please provide enough information to identify yourself (e.g. your full name and username) and any additional identity information we may reasonably request, and tell us which right(s) you want to exercise and what your request relates to.
13. KEEPING YOUR PERSONAL DATA SECURE
We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need for it, and we have procedures to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Across both Services, in practice that means:
- Separation between organisations. Every table that holds customer data is protected at the database level by policies that deny access by default, so one organisation cannot read another's data even if the application asked it to.
- Encryption in transit, with HTTPS enforced for every request.
- A restrictive content security policy, which permits the browser to contact only the servers each Service needs.
- Tightly restricted staff access. Our people have no everyday access to the contents of your organisation. The precise control differs by Service and is described in its Annex — and in each case the access is limited, time-boxed and recorded.
- Multi-factor authentication, applied as each Service's Annex describes.
If you would like general advice on protecting your own devices, the National Cyber Security Centre publishes guidance at www.ncsc.gov.uk.
14. HOW TO COMPLAIN
Please contact us if you have any queries or concerns about our use of your information (see section 16). We hope we will be able to resolve any issues you may have.
You also have the right to lodge a complaint with the Information Commissioner, who can be contacted at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.
15. CHANGES TO THIS PRIVACY POLICY
We may change this Privacy Policy from time to time by posting the updated version on our websites and giving you at least 30 days' prior notice by email to the address held for your account, in the same way as clause 19 of our SaaS Terms and Conditions.
16. HOW TO CONTACT US
Postal address: ITSM Ltd, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF
Email: support@itsm-ltd.com
We are not required to appoint a data protection officer and have not appointed one. Questions about this policy, and requests about your personal data, go to the address above and are handled by ITSM Ltd's directors. We are registered with the Information Commissioner's Office and pay the data protection fee.
ANNEX A — IMPROVEDESK
This Annex applies to the ImproveDesk Service at https://improve-desk.com/.
A1. What ImproveDesk collects, in addition to section 3
| Category | Detail |
|---|---|
| Content your organisation records in its register | Improvement records, nonconformities, corrective actions, review decisions and comments |
| Email sent in to a workspace | Where a workspace accepts improvements by email: the sender's address, the subject and the full message body, recorded in the register |
| Evidence packs | PDF and CSV exports assembled from the register, including an actor register identifying the people who took the recorded actions |
| Audit trail | An append-only record of actions taken in the Service, with the date and time and an identifier for the account that acted. It records an account identifier rather than a name or email address |
| Public submissions | Where someone submits an improvement through a public capture link: whatever they type, and a coarse description of their browser type. We do not keep the IP address of a public submission |
| Abuse prevention | Your IP address is sent to Cloudflare when you sign up, reset your password, join the waitlist or submit through a public link, so that it can tell a person from an automated script. We do not store it |
| Waitlist | If you ask to be told when ImproveDesk launches: your email address and the fact that you asked, kept until we launch or until you ask us to remove you |
A2. How ImproveDesk measures use
Before a page view leaves your browser, the address is rewritten so that anything identifying is removed: record references, workspace names and identifiers are replaced with placeholders, and the query string is dropped. We do not receive a profile of you.
A3. ImproveDesk processors
| Processor | What we use them for | Personal data they receive | Where they process it | Transfer mechanism we rely on |
|---|---|---|---|---|
| Supabase | Database hosting for the Service | All personal data stored within the application | United Kingdom — London (eu-west-2) | None needed; the data does not leave the UK |
| Vercel | Hosting platform and usage measurement | All requests to the Service, including IP address and browser information, and page-view events with identifying parts of the address removed before they are sent | European Economic Area (EU edge) | UK adequacy for the EEA; the UK International Data Transfer Agreement is deemed entered into for any transfer beyond it |
| Resend | Sending and receiving service email | Recipient and sender email addresses and the contents of those messages, which may include names, item titles, due dates and any text a sender includes | European Economic Area | UK adequacy for the EEA; EU Standard Contractual Clauses with the UK Addendum where the data goes further |
| Stripe | Merchant of record: sells the subscription, collects payment, issues the tax invoice and handles refunds and chargebacks — as an independent controller, not our processor; listed here for completeness | From us, an organisation identifier, the billing administrator's email address and the tier and price, to raise the purchase; any billing name, address or card details you enter are provided by you directly to Stripe on its checkout pages and are not received by us | United Kingdom, European Economic Area and United States (its merchant-of-record affiliate) | Stripe is responsible for its own compliance as an independent controller; for the details we send it, Stripe's Data Transfers Addendum (UK IDTA / UK Addendum) where a mechanism is required |
| Cloudflare | Bot and abuse prevention on public forms (Turnstile) | IP address and browser characteristics only | Global — the check runs at whichever location is nearest to you | EU Standard Contractual Clauses as amended by the UK Addendum |
| ITSM Ltd support portal | Support ticketing at support.itsm-ltd.com for your organisation's administrators | The user's email address | United Kingdom | None needed; the portal is operated by ITSM Ltd itself |
A4. ImproveDesk retention specifics
| What | How long |
|---|---|
| The audit trail | For the life of the organisation. Entries are append-only and cannot be edited or removed individually, including by us |
| Evidence packs already issued | For the life of the organisation. A pack that has already been downloaded is outside our control altogether |
| An organisation deleted at its own request | Ask us and we will delete it in full, after a short cooling-off period during which the request can be withdrawn |
A5. Things ImproveDesk cannot undo
| What cannot be removed | Why |
|---|---|
| Entries in the audit trail | The trail is append-only. Nothing can edit or delete an entry, including us. It is what makes an organisation's improvement work usable as audit evidence, and it records an account identifier rather than a name |
| Your name inside an evidence pack that has already been issued | A pack is fixed at the moment it is produced and carries a checksum proving it has not been altered. Re-making it without the names would break the proof and destroy the thing the pack is for |
| A person named in a nonconformity that has been closed | Closed records are sealed so that the finding cannot be rewritten after the fact |
| A pack somebody has already downloaded | Once a copy has left the Service — for example, sent to a certification body — it is outside our control entirely |
| The record of which legal documents you accepted | It is the evidence of what you agreed to and at which version. Removing it would remove the proof of your own agreement |
Deleting an entire organisation is not something an account holder can do from within the product. Ask us and we will carry it out.
A6. ImproveDesk security specifics
- An append-only audit trail, chained with checksums so that a missing or altered entry is detectable.
- Multi-factor authentication, which we require for every customer role that can manage the members of an organisation.
- No standing access for our staff. Our people cannot read the contents of your organisation's workspace. Access is possible only where someone in your organisation grants it, for a stated number of hours (no more than 72), and the grant is recorded and visible to your organisation.
- Private storage for evidence packs, which are never publicly addressable.
ANNEX B — FULFILRA
This Annex applies to the Fulfilra Service at https://fulfilra.com/.
B1. What Fulfilra collects, in addition to section 3
| Category | Detail |
|---|---|
| Content your organisation records in its catalogue | Service requests, the answers submitted in request form fields, approval decisions and comments, including internal notes |
| Status history | A record of each status change on a service request, with the date and time and an identifier for the account that made it. It records an account identifier rather than a name or email address |
| Support enquiries submitted at /support or by email | Your email address, your name if you give one, the subject and the full text of your messages, your browser's user-agent string, and a salted one-way hash of your IP address used to enforce our submission limits |
| A support portal account, where you are an administrator or agent of a customer organisation | Your name, your email address and your organisation's name, sent to our support portal at support.itsm-ltd.com so that you can raise and track enquiries there |
| Usage milestones | Four milestone events recorded by our own servers — an organisation being created, Jira being connected, a template pack being installed, and a service request being submitted — each carrying the identifier of the account that triggered it and the organisation's identifier |
| Waitlist | If you ask to be told when Fulfilra launches, your email address reaches us only as the notification email your request triggers, which we keep in our mailbox until we launch. We store no waitlist record in the Service |
B2. How Fulfilra measures use
Your browser sends the address of each page you open to our hosting provider's analytics, as that address appears; no identifier for you is attached to it. Separately, our own servers record the four milestone events described in B1. We do not send the contents of your service requests to any analytics provider.
B3. Fulfilra processors
| Processor | What we use them for | Personal data they receive | Where they process it | Transfer mechanism we rely on |
|---|---|---|---|---|
| Supabase | Database hosting for the Service | All personal data stored within the application | United Kingdom — London (eu-west-2) | None needed; the data does not leave the UK |
| Vercel | Hosting platform and usage measurement | All requests to the Service, including IP address and browser information, and page-view events carrying the address of the page opened | United Kingdom — London (lhr1) | None needed for processing in the UK; the UK International Data Transfer Agreement is deemed entered into for any transfer beyond it |
| Atlassian | Jira Service Management integration, where your organisation has connected its own Jira site | The reference, summary and submitted field values of each service request, at the moment an issue is created and linked | Determined by your organisation's own Atlassian site | Your organisation's own agreement with Atlassian governs it; we transmit to the site it nominates |
| Resend | Sending service email | Recipient and sender email addresses and the contents of those messages, which may include names, request references, request summaries and any text a sender includes | European Economic Area | UK adequacy for the EEA; EU Standard Contractual Clauses with the UK Addendum where the data goes further |
| Stripe | Merchant of record: sells the subscription, collects payment, issues the tax invoice and handles refunds and chargebacks — as an independent controller, not our processor; listed here for completeness | From us, an organisation identifier, the billing administrator's email address and the tier and price, to raise the purchase; any billing name, address or card details you enter are provided by you directly to Stripe on its checkout pages and are not received by us | United Kingdom, European Economic Area and United States (its merchant-of-record affiliate) | Stripe is responsible for its own compliance as an independent controller; for the details we send it, Stripe's Data Transfers Addendum (UK IDTA / UK Addendum) where a mechanism is required |
| ITSM Ltd support portal | The support account and ticketing portal at support.itsm-ltd.com used by your organisation's administrators and agents | The user's name and email address, and your organisation's name | United Kingdom | None needed; the portal is operated by ITSM Ltd itself |
B4. Fulfilra retention specifics
| What | How long |
|---|---|
| Status history | For the life of the organisation, alongside the service request it belongs to |
| The record of emails we sent you | 90 days, after which it is deleted automatically |
| An organisation deleted at its own request | Deleted immediately and in full when an administrator confirms it in the product. Deletion is not reversible |
B5. Things Fulfilra cannot undo
| What cannot be removed | Why |
|---|---|
| An entry in a service request's status history | The history is the organisation's record of how a request was handled, and nothing in the product lets an entry be removed from it individually |
| The record of which legal documents you accepted | It is the evidence of what you agreed to and at which version. Removing it would remove the proof of your own agreement |
| An issue already created in your organisation's own Jira site | Once we have created and linked it, that issue belongs to your organisation's Atlassian site and is outside our control |
| An email we have already sent | Once a message has left our sending provider and reached a mailbox, it is outside our control entirely |
An administrator of your organisation can delete the entire organisation and everything in it from within the product. It takes effect immediately and is not reversible.
B6. Fulfilra security specifics
- Step-up authentication for our staff. Access to our internal support portal is limited to named ITSM Ltd staff, is gated by a second authentication factor pinned to that person, and expires after 8 hours. Access is permitted only for providing support or investigating a security or availability incident, and is recorded.
- Multi-factor authentication for our own staff, required before anyone at ITSM Ltd can unlock the internal support portal.