Trust
Data protection
We sell a product for running data protection obligations. It would be a poor look to be vague about our own.
Which role we are in
For the personal data you put into DutyHub — your staff, your contractors, the people who make requests to you — you are the controller and we are your processor. We act on your instructions, and the terms of that are set out in our data processing agreement.
For the personal data of the people who buy from us and use the site — account holders, enquirers, anybody who runs the free tier checker — we are the controller. That is covered by our privacy notice.
What we do as your processor
- Process personal data only on your documented instructions.
- Keep our sub-processor list published, so it can go straight into your Article 30 record.
- Assist you with subject access requests — the product is built to find and export a person's records.
- Notify you without undue delay if we become aware of a personal data breach affecting your data, so your own 72-hour clock is not started late by us.
- Delete or return your data at the end of the contract, on your instruction.
- Apply retention and disposal schedules you configure, rather than keeping everything for ever by default.
Helping you meet your own duties
Retention is a scheduled disposal that actually runs, not a column in a policy document. The audit trail records who saw what. Records can be exported in full for a subject access request. These are product features because they are things a processor is asked for, and answering "we would have to look into it" is not a good answer.
Our details
- Controller: ActiveManage Ltd, company number to be confirmed
- Registered office: to be confirmed
- ICO registration: to be confirmed
- Data protection contact: to be confirmed
You have the right to complain to the Information Commissioner's Office about how we handle your personal data. We would rather you told us first, but that right does not depend on it.