Privacy policy
CAPEXdesk is a beta version. The business details of the company that operates CAPEXdesk will be published on this page before paid plans begin. Until then, you can reach us at privacy@capexdesk.com.
This policy explains what personal information CAPEXdesk collects, why we collect it, who we share it with and what rights you have. It covers our website at www.capexdesk.com and the CAPEXdesk platform at app.capexdesk.com. We write it to follow UK data protection law (the UK GDPR and the Data Protection Act 2018).
- Our two roles
- What we collect
- How we use it
- Cookies
- Who we share it with
- Our staff and your data
- Transfers outside the UK
- How long we keep it
- Security
- Your rights
- Children
- Changes
- Contact and complaints
1. Our two roles
We act in two different roles, and the rules differ for each.
- As a controller, we decide how and why we use information about people who visit our website, create an account, contact us or use the platform. This policy is mainly about that information.
- As a processor, we hold the information that a company puts into CAPEXdesk, such as its budgets, commitments, spend, documents and comments. The company is the controller of that information and we handle it only on its instructions. The terms for this are in the data protection section of our Terms of use. If you are an employee or contractor of a company that uses CAPEXdesk, please contact that company first about its data.
2. What we collect
| Information | What it includes | Where it comes from |
|---|---|---|
| Website visits | The page visited and the website that referred you. We do not store your IP address with these counts, and we do not use cookies or third-party analytics on our website. Our hosting provider keeps standard server logs, which include IP addresses, for security and troubleshooting. | Your browser |
| Account details | Your name, work email address, your password (stored only as a one-way hash, never in readable form) and, if you set it up, your two-step sign-in secret (stored encrypted). | You |
| Roles and access | Which companies you belong to and what you are allowed to see and do in each. | You and your company administrator |
| Sign-in and security records | The IP address and browser or device details of each sign-in session, and failed sign-in attempts. | Your browser |
| Company data | Everything a company uploads or enters: structure, budgets, commitments, actual spend, forecasts, comments and supporting documents. This may include the names and work details of staff and suppliers. | The company and its users |
| Change history | A record of who changed or approved what, and when, against every figure. | Created by the platform as you use it |
| Messages | Emails and WhatsApp messages you send us, including demo requests and support questions, and the system emails we send you, such as invitations and approval notices. | You and us |
We do not ask for sensitive categories of personal information, such as health or political opinions, and CAPEXdesk has no field for them. Please do not put them in comments or documents.
3. How we use it
UK law requires us to have a lawful basis for each use. These are ours.
| Why we use it | Lawful basis |
|---|---|
| To create your account, sign you in and provide the platform | Contract: it is needed to provide the service you asked for |
| To keep a change history of approvals and edits | Contract and our legitimate interest in giving our customers a reliable record |
| To protect accounts and the platform, for example by spotting repeated failed sign-ins | Legitimate interests: keeping the service secure |
| To answer enquiries and give support | Legitimate interests, or contract if you are a customer |
| To send service emails such as invitations, verification and approval notices | Contract |
| To understand how many people visit the website, without identifying them | Legitimate interests: improving the website |
| To meet legal obligations and to establish or defend legal claims | Legal obligation and legitimate interests |
We do not sell personal information. We do not use it for advertising, and we do not use company data to train artificial intelligence models. We do not currently send marketing emails. If that changes, we will ask for your consent or offer a simple way to opt out first.
4. Cookies
We use only the cookies the platform needs to work. These do not need consent under UK rules, so we do not show a cookie banner. We use no advertising, tracking or analytics cookies.
| Cookie | Purpose |
|---|---|
capex_session | Keeps you signed in to the platform. |
capex_mfa_challenge | Holds a sign-in in progress between your password and your second step. |
Our staff-only site uses separate cookies of the same kind. They are set only for the small number of people who work for us.
5. Who we share it with
We share personal information only with the providers that help us run CAPEXdesk, and only for that purpose. They are our processors, and we have contracts requiring them to protect it.
- Render: hosts the platform and its databases, in Frankfurt, Germany.
- Amazon Web Services (AWS): holds uploaded files and database backups, in London, United Kingdom.
- Resend: delivers the system emails we send.
- WhatsApp (Meta): only if you choose to message us there. WhatsApp handles the message under its own terms.
- Professional advisers and authorities: such as our lawyers, accountants and insurers, or a regulator or court where the law requires it.
If our business is sold or merged, personal information may pass to the new owner, who must honour this policy. A current list of the providers we use is available on request at privacy@capexdesk.com.
6. Our staff and your data
Our staff do not browse customer data. To investigate a problem, a platform administrator can open a company and view the platform as one named user sees it. This access is read-only, lasts 30 minutes, requires a written reason, and is recorded in both our audit log and the company's own change history.
7. Transfers outside the UK
Our main database is in Frankfurt, in the European Economic Area, and the UK treats that area as providing adequate protection, so no extra safeguard is needed for it. Uploaded files and database backups are stored in London. Some of our providers are based outside the UK and the EEA, or may handle data there. Where that happens, we rely on a UK adequacy decision, or on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with any further safeguards the law requires.
8. How long we keep it
- Account and company data: for as long as the account is active.
- After an account ends: you can export your data for 30 days. We then delete it within 90 days of the account ending. Backups are deleted as they expire, and are not used for anything else in the meantime.
- Change history: it is part of the company's data, is protected from alteration by design, and is deleted together with the rest of that company's data.
- Enquiries and support emails: for as long as we need to answer them and keep a record of our relationship with you.
- Website visit records: they are not linked to any person and are kept for statistics.
- We may keep information longer where the law requires it or to deal with a legal claim.
9. Security
- Each company has its own database. One company’s data is not stored in the same database as another’s.
- Users with higher access must use a second step to sign in.
- Data is encrypted in transit using TLS, and our hosting and storage providers encrypt stored data.
- The change history cannot be edited or deleted through the platform.
No system is perfectly secure. If a breach affects your personal information in a way the law says we must report, we will notify the people and the regulator as the law requires, and we will tell our customers without undue delay.
10. Your rights
You have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong;
- ask us to delete it, in some circumstances;
- ask us to restrict how we use it, in some circumstances;
- object to uses based on our legitimate interests;
- receive information you gave us in a portable format; and
- withdraw consent, where we rely on it.
To use any of these rights, email privacy@capexdesk.com. We reply within one month. We may need to confirm who you are first. If your request is about company data, we may pass it to the company that controls that data and tell you we have done so.
11. Children
CAPEXdesk is a business product for people aged 18 or over. We do not knowingly collect information from children.
12. Changes
We will update this page when our practices change and will show the new date at the top. For a material change, we will email account holders at least 30 days before it takes effect.
13. Contact and complaints
Questions about this policy or your information: privacy@capexdesk.com.
If you are unhappy with how we have handled your information, you can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would be grateful for the chance to put things right first.