Cella Software Privacy Policy

Cella Software (“we”, “us”, “our”) provides software-as-a-service tools for legacy system decommissioning and related services (“Services”) to business customers (“Customers”).

This Privacy Policy explains how we collect, use, share, and protect personal data. We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Important – two roles we play:

• As a data controller, we process personal data about our website visitors, prospects, customer contacts, and our own staff, for our own business purposes. This Privacy Policy covers that processing.
• As a data processor, we may process personal data contained within legacy systems, databases, or archives that our Customers ask us to decommission, migrate, or archive on their behalf. That processing is governed by the Data Processing Agreement (DPA) entered into with each Customer, not by this Privacy Policy. If you are an individual whose data appears in a system being decommissioned by one of our Customers, please contact that Customer directly, as they remain the data controller.

Company details:

Cella Software Limited

Registered in England and Wales, company number 17144666

Registered office: 65 Knowl Piece, Wilbury Way, Hitchin SG4 0TY

ICO registration number: 00015168916

Personal data is anything that can identify, either on its own or through combining it with other factors that could eventually identify an individual.

Depending on your relationship with us, we may collect:

1. a) Website visitors

• IP address, browser type, device information, pages visited, referral source (via analytics and cookies – see Section 9)
• Information submitted via contact forms, demo requests, or newsletter sign-ups (name, email, job title, company name, phone number)

1. b) Prospective and current Customers (and their staff)

• Business contact details: name, job title, work email, work phone number, company name
• Account and billing information: company address, VAT number, payment details (processed via our payment provider – see Section 6)
• Communications: emails, support tickets, call notes, meeting records (including electronic)
• Usage data: log-in activity, feature usage, configuration settings, and system logs generated through use of the Services (excluding the underlying legacy system content itself, which is covered by the DPA)

1. c) Job applicants

• CV/résumé, cover letter, references, interview notes, right-to-work documentation.

1. d) Suppliers and partners

• Business contact and payment details of individuals at supplier/partner organisations

We do not intentionally collect special category data (e.g. health, religious belief, ethnicity) through the categories above. If you submit such data to us unprompted (e.g. in a support ticket), we will handle it in line with our security obligations and delete it where it is not necessary for us to retain it.

Where we rely on legitimate interests, we have considered that this processing is proportionate and does not override your rights and freedoms. You can ask us for details of the relevant balancing test at any time.

Where our Services involve accessing, migrating, archiving, or securely destroying data held in a Customer’s legacy systems, we act strictly as a data processor on the Customer’s documented instructions. This includes situations where that legacy data happens to include personal data belonging to the Customer’s own employees, clients, or other third parties.

In that capacity:

• We only process such data as instructed by the Customer under our DPA and contract.
• We rely on our customers to have obtained the necessary notices, lawful basis for processing or any other legal requirements
• We apply technical and organisational measures appropriate to the sensitivity of legacy data (see Section 8)
• We do not use this data for our own purposes, including marketing or analytics
• We support Customers in responding to data subject requests relating to this data, but we do not respond to such requests directly unless authorised by the Customer
• Data is securely deleted or returned at the end of the engagement, in line with the DPA and any statutory retention requirements

If you are an individual with concerns about personal data processed in this context, please contact the relevant Customer (the data controller).

We may share personal data with:

• Sub-processors and service providers who support our operations, such as cloud hosting providers, customer support platforms, email/marketing platforms, payment processors, and analytics providers. All sub-processors are bound by written data protection terms. A current list of key sub-processors is available on request.
• Professional advisers, such as lawyers, auditors, and insurers, where necessary
• Regulators, law enforcement, or courts, where required by law
• A buyer or successor entity, in the event of a merger, acquisition, restructuring, or sale of assets, subject to appropriate safeguards
• Other parties, with your consent

We do not sell personal data.

Some of our sub-processors may be located outside the UK, including in the United States or European Economic Area. Where this is the case, we ensure appropriate safeguards are in place, such as:

• The UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses
• Adequacy regulations issued by the UK Government
• Other safeguards recognised under UK GDPR

Details of specific transfer mechanisms are available on request.

We retain personal data only for as long as necessary for the purposes set out in this policy, typically:

• Customer contact and account data: for the duration of the contract, plus up to 6 years afterwards for legal, accounting, and tax purposes
• Marketing data: until you unsubscribe or object, or up to 24 months of inactivity
• Recruitment data: up to 12 months after the recruitment process ends, unless you consent to longer retention
• Website analytics data: as set out in our cookie policy, typically 12–24 months
• Legacy system data processed under a DPA: as instructed by the relevant Customer, and in any case no longer than necessary to complete the engagement

We maintain technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, access controls and role-based permissions, network segmentation, logging and monitoring, staff confidentiality obligations and training, and regular security testing. Given the sensitive nature of legacy decommissioning work, we apply enhanced controls (such as secure erasure standards and audit trails) where relevant, as detailed in our DPA and security documentation available to Customers.

No system is completely secure, and we cannot guarantee absolute security, but we work to industry standards and review our measures regularly.

Our website uses cookies and similar technologies for essential site functionality, analytics, and (where applicable) marketing. You can manage your preferences via our cookie banner or your browser settings. See our Cookie Policy for full details of the specific cookies used.

We may contact business contacts by email about our products and services in reliance on the “soft opt-in” and legitimate interest provisions under PECR and UK GDPR, where you are an existing customer or have expressed interest in our Services. You can opt out at any time using the unsubscribe link in any email, or by contacting us at [email protected]. We will not send marketing emails to individuals in a personal capacity without appropriate consent.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data in certain circumstances
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests or direct marketing
• Data portability, where processing is based on consent or contract and carried out by automated means
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Information Commissioner’s Office (ICO)

To exercise these rights, contact us at [email protected]. We will respond within one month, as required by law.

Note: if your data relates to a legacy system we are decommissioning on behalf of one of our Customers, please direct your request to that Customer, as described in Section 4.

If you are not satisfied with our response or you are unhappy with how we have used your data, you can complain to the Information Commissioner’s Office (ICO).

ICO contact details:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: ico.org.uk

Our Services are intended for business use and are not directed at children. We do not knowingly collect personal data from anyone under 18.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified to Customers and, where appropriate, posted on our website with an updated “last updated” date.

If you have questions about this Privacy Policy or how we handle personal data, contact:

Cella Software Limited

Data Protection: [email protected]

Phone: +44 1908 888955