Privacy Policy
How we collect, use and protect your personal data.
Last updated: 29 September 2026 · Effective from: 29 September 2026
1. Introduction
Cholcom Limited, trading as Cholcom ("we", "us", "our" or the "Company"), respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you:
- visit or use our websites;
- use our mobile applications, software, portals or online services;
- register for an account;
- purchase, subscribe to or use our products or services;
- communicate with us;
- request information, quotations, demonstrations or technical support;
- receive communications from us;
- work for, represent or interact with one of our customers, suppliers or business partners;
- apply for employment or other opportunities with us; or
- otherwise interact with our business.
It also explains your rights in relation to your personal data and how you may exercise them.
We process personal data in accordance with applicable UK data protection and privacy legislation, including:
- the UK General Data Protection Regulation ("UK GDPR");
- the Data Protection Act 2018;
- the Privacy and Electronic Communications Regulations 2003 ("PECR"); and
- other applicable UK privacy and data protection legislation, as amended from time to time.
This Privacy Policy should be read together with any additional privacy information that we provide when collecting personal data for a particular service or purpose.
Our mobile apps. Each Cholcom mobile app (for example Cholcom PDF) has its own app-specific privacy information, which explains exactly what that app does with data. It is published at cholcom.com/app-privacy and supplements this Policy.
2. Who We Are
For personal data where we determine the purposes and means of processing, the data controller is:
Legal name: Cholcom Limited
Trading name: Cholcom
Company number: 16427926 (registered in England and Wales)
Registered office: 13 Rectory Park Avenue, Northolt, UB5 6BD, United Kingdom
Business address: as registered office
Email: support@cholcom.com
Data Protection Contact:
Director, Data Protection Lead
support@cholcom.com
ICO registration number: ZB999178
References to "you" or "your" in this Privacy Policy include website visitors, users, customers, prospective customers, authorised account users, contacts at business customers or suppliers, applicants and other individuals whose personal data we process.
3. Our Role as Controller or Processor
Our data protection role depends upon the circumstances in which personal data is processed.
3.1 When We Act as a Controller
We generally act as a controller where we determine why and how personal data is processed.
This may include personal data relating to:
- customers and prospective customers;
- website and application visitors and users;
- account administrators;
- business contacts;
- suppliers and service providers;
- sales and marketing contacts;
- individuals making enquiries;
- individuals contacting technical or customer support;
- applicants for employment;
- users of our own business systems;
- fraud and security investigations;
- regulatory and legal compliance; and
- administration of our own business.
3.2 When We Act as a Processor
Where a business customer uses our products or services (for example our managed IT, cloud backup, Microsoft 365 or cybersecurity services) to process personal data relating to its own customers, employees, users or other individuals, that customer may act as the controller and we may act as its processor.
In those circumstances:
- we process the relevant personal data on the customer's documented instructions;
- our processing is governed by applicable contractual data protection provisions or a Data Processing Agreement;
- the customer's privacy notice ordinarily explains why the customer processes that personal data;
- requests concerning such information should usually be directed to the relevant customer; and
- we assist customers with applicable data protection obligations where required by law and contract.
We may nevertheless act as an independent controller for limited processing undertaken for our own purposes, including billing, business administration, fraud prevention, cybersecurity, legal compliance and establishing or defending legal claims.
4. Personal Data We May Collect
"Personal data" means information relating to an identified or identifiable living individual.
The personal data we process depends upon how you interact with us and which services you use. We may process the following categories.
4.1 Identity Information
Name; title; username; customer number; user identifier; job title; employer; organisation; department; and other identifiers associated with your account or relationship with us.
4.2 Contact Information
Email address; telephone number; postal address; business address; billing address; and other contact information.
4.3 Account and Authentication Information
Usernames; user identifiers; password hashes; authentication records; account status; account creation date; user roles; access permissions; login records; multifactor authentication information; account preferences; and subscription information.
Passwords are not stored in plain text.
4.4 Transaction and Billing Information
Products or services purchased; subscription information; invoices; payment status; transaction dates; billing contacts; billing addresses; VAT information; credits; refunds; and information required for financial administration.
Where payments are processed by external payment service providers (including Google Play for in-app purchases), payment-card information is processed directly by those providers and is not stored by us.
4.5 Communications Information
Emails; support tickets; telephone correspondence; chat communications; enquiries; complaints; feedback; meeting records; service requests; correspondence; and other communications with us.
4.6 Technical and Device Information
IP address; device type; browser type and version; operating system; application version; screen or device characteristics; referring website; approximate location inferred from an IP address; device identifiers (including, where an app shows ads, the device's advertising ID); session identifiers; network information; and other technical information provided when accessing our systems.
4.7 Website and Application Usage Information
Pages visited; screens viewed; buttons or links selected; features used; dates and times of access; session duration; navigation paths; application events; referring and exit pages; error events; and other interaction information.
4.8 Security and Audit Information
Successful and unsuccessful login attempts; authentication events; account changes; administrative activity; access logs; API activity; audit records; security alerts; firewall events; suspected malicious activity; fraud indicators; incident investigation records; and information used to secure our systems and services.
4.9 Customer-Provided Information
Where our products or services allow customers or users to submit, upload, store, transmit or create information, we may process information contained within that content as necessary to provide the applicable service.
Where we process such information solely on behalf of a business customer, we act as a processor and that customer's privacy notice will ordinarily govern the underlying processing purposes.
Some of our apps process your documents and files only on your own device and never send them to us. Where that is the case, the app-specific privacy information says so.
4.10 Recruitment Information
If you apply for employment, contracting or another professional opportunity, we may process: CVs; employment history; educational information; qualifications; professional certifications; references; interview information; right-to-work information; professional profiles; and other information relevant to the application.
5. Special Category Personal Data
Certain categories of personal data receive additional protection under UK data protection law. These include personal data revealing or concerning racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic information; biometric information used for unique identification; health; sex life; and sexual orientation.
We do not intentionally collect special category personal data through our ordinary website and business operations unless it is necessary for a specific purpose, permitted by law and subject to appropriate safeguards.
Where we process special category personal data, we identify an appropriate lawful basis under Article 6 UK GDPR and an applicable condition for processing under Article 9 UK GDPR and, where relevant, the Data Protection Act 2018, and apply additional safeguards where appropriate.
6. Criminal Offence Data
We do not intentionally process personal data relating to criminal convictions or offences unless the processing is necessary, there is an appropriate lawful basis, applicable legal requirements are satisfied and appropriate safeguards are in place.
7. How We Obtain Personal Data
7.1 Directly From You
For example, when you create an account; complete a form; request a quotation; purchase or subscribe to a service; communicate with us; request technical support; attend a meeting; respond to a survey; provide feedback; subscribe to communications; or apply for a position.
7.2 Automatically
Technical, security and usage information may be generated automatically when you access our websites, applications, networks or online services, including server logs; access logs; authentication events; security events; device information; application events; network records; and cookie or similar-technology information where permitted.
7.3 From Your Organisation
Where you use our services through an employer, customer, educational institution or other organisation, that organisation may provide information required to establish or administer your account or access.
7.4 From Third Parties
We may receive information from customers; suppliers; service providers; authorised partners; payment providers (including Google Play); identity or authentication providers; business information services; professional advisers; publicly available sources; Companies House; other official registers; and other lawful sources.
Where personal data is obtained from another source rather than directly from you, we provide required privacy information within the period required by applicable law unless an exemption applies.
8. Purposes and Lawful Bases for Processing
We only process personal data where an appropriate lawful basis applies. Depending upon the circumstances, our lawful bases may include performance of a contract; taking steps at your request before entering into a contract; compliance with a legal obligation; our legitimate interests or those of a third party; consent; or another lawful basis permitted by applicable legislation.
| Purpose | Typical information | Typical lawful basis |
|---|---|---|
| Providing products and services | Identity, contact, account and service data | Contract |
| Responding before a contract is entered | Identity, contact and enquiry information | Steps at your request before entering a contract |
| Creating and administering accounts | Identity, account and authentication data | Contract; legitimate interests |
| Providing customer or technical support | Identity, contact, communications and technical data | Contract; legitimate interests |
| Managing subscriptions and orders | Identity, account, transaction and billing information | Contract |
| Processing payments and invoices | Identity, transaction and billing information | Contract; legal obligation |
| Accounting and taxation | Transaction, invoice and financial records | Legal obligation; legitimate interests |
| Operating websites and applications | Technical, usage and log information | Legitimate interests; consent where required |
| Showing ads in free versions of our apps | Device identifiers, approximate location, ad interactions, diagnostics | Consent (UK/EEA personalised ads); legitimate interests where permitted |
| System administration | Technical, account, audit and security information | Legitimate interests |
| Cybersecurity | Authentication, network, audit, security and log information | Legitimate interests; legal obligation where applicable |
| Detecting fraud or misuse | Account, technical, transaction and security information | Legitimate interests; legal obligation where applicable |
| Investigating incidents | Account, communications, security and technical information | Legitimate interests; legal obligation |
| Business administration | Identity, business contact, financial and communications data | Legitimate interests; legal obligation |
| Managing suppliers and partners | Identity, business contact and contractual information | Contract; legitimate interests |
| Service improvement | Usage, diagnostics and feedback | Legitimate interests; consent where required |
| Analytics | Usage, technical and device information | Consent where required; legitimate interests where legally permitted |
| Direct marketing | Identity, contact and preference information | Consent, legitimate interests and applicable PECR provisions |
| Legal claims | Relevant records and communications | Legitimate interests; legal obligation |
| Regulatory compliance | Relevant personal data | Legal obligation |
| Recruitment | Identity, contact, employment, qualification and application data | Pre-contract steps; legitimate interests; legal obligation |
The lawful basis applied to a particular processing activity depends upon its circumstances.
9. Legitimate Interests
Where we rely upon legitimate interests, those interests may include operating our business; supplying reliable services; administering customer relationships; maintaining network and information security; preventing fraud and misuse; protecting systems, customers and users; improving products and services; investigating incidents; maintaining business records; enforcing contractual rights; protecting legal rights; managing relationships with business customers, suppliers and partners; and communicating with business contacts.
We consider whether our interests are overridden by your interests, rights or freedoms, and document this through a Legitimate Interests Assessment where appropriate.
10. Consent
Where processing relies upon your consent, consent will be requested in an appropriate manner; you may refuse consent without suffering inappropriate detriment; you may withdraw consent at any time; and withdrawal will not affect processing that was lawful before consent was withdrawn.
In our apps that show ads, you can change your advertising consent at any time from the app's Settings → Privacy options.
11. When Providing Personal Data Is Required
Certain information may be required to enter into or perform a contract; to provide a service you request; to establish or administer an account; to process a payment; to verify identity or authority; for security purposes; to comply with law; or to fulfil a regulatory obligation.
If required information is not provided, we may be unable to enter into a contract, provide the requested service, maintain an account, process a transaction or comply with the relevant request.
12. Server Logs, Security Logs and Technical Records
Our websites, applications, hosting environments, databases, authentication systems, security systems and service providers may automatically generate technical records, including IP addresses; dates and times; URLs or resources requested; HTTP methods and status codes; user-agent information; browsers; operating systems; device information; session and request identifiers; API activity; authentication events; account identifiers; administrative activity; database events; application errors; security alerts; firewall events; infrastructure events; and other diagnostic or security information.
We process these records to deliver content; maintain availability; administer systems; diagnose faults; plan capacity; monitor performance; detect malicious activity; prevent unauthorised access; investigate security incidents; prevent fraud and misuse; maintain audit trails; enforce contractual rights; and establish or defend legal claims.
Our lawful basis is ordinarily our legitimate interests in operating reliable and secure systems and, where relevant, compliance with legal obligations.
Logs are retained only for the periods set out in section 22. Access to security and operational logs is restricted to authorised personnel and authorised service providers with a legitimate need.
13. Service Providers and Data Processors
We use carefully selected third-party service providers to help operate, secure and deliver our websites, applications, IT infrastructure and business services, for purposes such as website and application hosting; cloud infrastructure; databases and application backends; authentication; data storage; backup and disaster recovery; business email; identity management; file storage; productivity and collaboration; cybersecurity; infrastructure monitoring; customer support; payment processing; advertising in free app versions; analytics where permitted; and communications.
Our principal technology providers currently include:
- Microsoft, which provides business productivity, business email, identity, document storage, communication and collaboration services through Microsoft 365 and related services;
- Hostinger, which provides website hosting and related infrastructure services;
- Supabase, which provides database, authentication, storage and application-backend infrastructure for certain applications and services; and
- Google, which provides app distribution and in-app payments (Google Play), advertising in the free versions of our apps (Google AdMob) and on-device software components used by some apps (such as ML Kit). For advertising and payments, Google acts as an independent controller under its own privacy policy.
Depending upon the particular service, these providers may process names; business contact information; account information; email content; documents; application records; user-generated content; authentication information; database records; uploaded files; IP addresses; server and security logs; service-generated information; and other information necessary to provide the relevant service.
We may change individual technology providers from time to time as our business, products or security requirements develop.
Where a service provider acts as our processor, we require appropriate contractual and data protection commitments covering, as relevant: processing only on documented instructions; confidentiality; information security; use of sub-processors; assistance with individual rights; personal data breach assistance; regulatory cooperation; deletion or return of personal data; audit and compliance information; and international transfers.
We periodically review material service providers and maintain appropriate internal records concerning processors and relevant sub-processors.
14. Other Recipients of Personal Data
Depending upon the circumstances, we may disclose personal data to cloud, IT, software and hosting providers; telecommunications providers; authentication and cybersecurity providers; backup and recovery providers; payment processors; banks; accountants; auditors; insurers; lawyers and other professional advisers; contractors and consultants; customer-support providers; advertising and analytics providers where legally permitted; business partners; prospective purchasers or investors where appropriate; and courts, regulators, tax authorities, law-enforcement bodies and other public authorities where disclosure is lawful.
We disclose personal data only where there is an appropriate legal basis and the disclosure is necessary and proportionate. Where a third party acts as our processor, we require appropriate data protection arrangements. Where a recipient acts as an independent controller, its own privacy information also applies.
We do not sell personal data.
15. Sub-Processors
Some service providers that process personal data on our behalf may appoint other organisations (sub-processors) to assist them, for example with cloud infrastructure, data centre services, hosting, content delivery, cybersecurity, email delivery, technical support, infrastructure monitoring, backups, resilience and communications.
We require processors to manage their sub-processors in accordance with applicable contractual and data protection requirements, and we maintain appropriate internal records of material processors and sub-processors. Where we act as processor for a customer, sub-processor arrangements may also be governed by our agreement with that customer.
16. Data Location
We select hosting locations and service configurations appropriate to the nature and sensitivity of the personal data being processed and, where suitable and available, use UK or European hosting regions.
The location of a primary server does not necessarily mean that every element of associated processing takes place exclusively within that location. Authorised service providers or sub-processors may provide technical support, cybersecurity, content delivery, network protection, system monitoring, backup, communications, resilience or administrative services from other locations. We therefore assess data location together with contractual, technical and legal safeguards.
17. International Transfers
Some of our service providers or their authorised sub-processors may process personal data outside the United Kingdom, including in the United States.
Where a transfer is a restricted international transfer under UK data protection law, we use an appropriate lawful transfer mechanism, which may include UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified); the UK International Data Transfer Agreement ("IDTA"); the UK International Data Transfer Addendum to approved EU Standard Contractual Clauses; another approved safeguard; or a legally permitted exception in limited circumstances.
Where required, we assess the transfer and apply additional safeguards such as encryption, access restrictions, contractual commitments, security controls, data minimisation or pseudonymisation. You may contact us for further information regarding safeguards applicable to your personal data.
18. Data Security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, unlawful disclosure, alteration, destruction, misuse and other unlawful processing.
Depending upon the system and the risks involved, our safeguards include unique user accounts; role-based and least-privilege access; multifactor authentication; password security controls and hashing; encryption in transit; encryption at rest where appropriate and supported; network and firewall protection; endpoint protection; vulnerability management and patching; malware protection; logging and monitoring; audit trails; backups and recovery procedures; business continuity arrangements; confidentiality obligations; security awareness; supplier due diligence; access reviews; incident-response procedures; and secure deletion.
Security controls are reviewed and adjusted according to the nature, scope, context and risks of the processing. No Internet-connected system can be guaranteed to be completely secure.
19. Personal Data Breaches and Security Incidents
We maintain procedures for identifying, assessing, containing, investigating and responding to suspected personal data breaches and security incidents.
Where required by applicable law, we notify the Information Commissioner's Office within 72 hours of becoming aware of a reportable breach, and we communicate with affected individuals where a breach is likely to result in a high risk to them. Where we process personal data on behalf of a customer, we provide breach notifications and assistance in accordance with applicable law and our contractual obligations. We keep records of personal data breaches as required.
20. Data Minimisation
We seek to ensure that the personal data we collect is adequate, relevant and limited to what is necessary for the purpose for which it is processed, and we periodically review our collection and retention practices.
21. Accuracy
We take reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date. You may contact us to request correction of inaccurate or incomplete information, which we will correct or delete without undue delay where appropriate.
22. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected or subsequently lawfully processed, taking account of the purpose; the nature, sensitivity and volume of the information; legal, accounting, tax, contractual and regulatory requirements; limitation periods; security and fraud-prevention needs; and dispute resolution.
| Information category | Retention |
|---|---|
| Active customer account information | Duration of the customer relationship plus 6 years |
| Contracts and material commercial records | Contract duration plus 6 years |
| Accounting and taxation records | 6 years from the end of the relevant financial year |
| Invoices and payment records | 6 years from the end of the relevant financial year |
| Customer-support records | 3 years from closure of the ticket or request |
| Routine website server logs | 90 days |
| Application logs | 90 days |
| Authentication logs | 12 months |
| Security and audit logs | 12 months |
| Cybersecurity incident records | 6 years from closure of the incident |
| Unsuccessful enquiries | 12 months from last contact |
| Marketing information | Until you withdraw consent or object, or 2 years without engagement |
| Marketing suppression records | As long as necessary to honour your opt-out |
| Recruitment records for unsuccessful applicants | 6 months after the recruitment decision |
| Legal claims and disputes | Until final resolution plus 6 years |
| Backups | Until expiry under the normal backup rotation (typically up to 90 days) |
| Data held on your device by our apps | On your device only, until you delete it, clear the app's data or uninstall the app |
Where a legal hold, regulatory investigation, litigation or dispute applies, information may be retained beyond its ordinary deletion date until the matter is concluded. Where appropriate, information that no longer needs to identify an individual may be irreversibly anonymised.
23. Backups and Disaster Recovery
We maintain backup copies of data for business continuity, disaster recovery, resilience and protection against accidental deletion. Backups may contain personal data; they are protected against unauthorised access, accessed only where there is an appropriate operational or security need, retained under controlled rotation, and not used for routine processing.
Deleted information may remain in backups until those backups expire in the normal cycle. Where a backup is restored, we take reasonable steps to ensure that previously deleted information is not reintroduced into active processing.
24. Cookies and Similar Technologies
Our websites and apps may use cookies, local storage, pixels, SDKs or similar technologies for maintaining sessions; authentication; security; fraud prevention; remembering preferences; functionality; load balancing; performance; analytics; advertising in free app versions; and other permitted purposes.
24.1 Strictly Necessary Technologies
Some technologies are necessary to provide an online service you request, or for another legally exempt purpose, and may be used without consent where the law permits. We still provide information about them.
24.2 Non-Essential Technologies
Where consent is required, we do not activate non-essential technologies (such as certain analytics, advertising, tracking, social-media and behavioural measurement tools) before obtaining valid consent. Our consent mechanisms let you accept, reject and manage non-essential technologies.
Our website currently uses only one strictly necessary cookie (a session cookie on our Contact page, which protects the contact form) and no analytics, advertising or tracking technologies, so there are no cookie preferences to set. If we add any non-essential technology in future, we will ask for your consent first and provide a way to change your choice.
In our apps that show ads, you can change your choice at any time in Settings → Privacy options.
Further information is available in our Cookie Policy: https://cholcom.com/cookies
25. Analytics
We may use analytics technologies to understand how websites, apps and services are used. Where analytics technologies require consent under PECR, we obtain it before enabling them. Where analytics can lawfully be used without consent, we still comply with UK GDPR transparency and lawful-basis requirements.
26. Direct Marketing
We may send information about our products, services, events or business activities where permitted by law, relying on consent, legitimate interests and applicable PECR provisions (including, where legally available, the existing-customer "soft opt-in").
Every marketing communication includes a way to unsubscribe or object, and you may object to direct marketing at any time. We keep limited suppression information to make sure we continue to respect your opt-out. Unsubscribing does not stop transactional, contractual, security, service or regulatory communications that remain necessary.
27. Social Media
If you interact with us through social-media platforms, the relevant platform processes personal data independently under its own privacy terms. We may receive your username, profile information made available to us, messages, comments, reactions and other interactions, and we use them only on an appropriate lawful basis.
28. Artificial Intelligence and Automated Tools
We may use artificial intelligence, machine-learning or automated tools in parts of our business or services. Where such tools process personal data, we assess the purpose, lawful basis, information used and its sensitivity, supplier arrangements, retention, security, international transfers, human oversight, fairness, transparency and risks to individuals.
We do not submit confidential or personal information to public AI services unless the processing has been appropriately assessed and authorised. Where a third-party AI provider processes personal data on our behalf, we assess the relevant contractual, security, retention, sub-processor and transfer arrangements.
Some of our apps use on-device machine learning (for example, reading text from a scanned document). This runs on your phone and does not send your documents to us or to the provider.
29. Automated Decision-Making and Profiling
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
We use automated technologies for routine purposes such as cybersecurity, spam detection, fraud detection, service monitoring, authentication, system administration and prioritisation of operational alerts. These do not involve significant solely automated decisions. Advertising partners may use profiling to personalise ads in the free versions of our apps, only where you have consented where consent is required.
30. Children's Personal Data
Our services are intended for businesses and for individuals aged 18 or over.
We do not knowingly collect children's personal data. If we become aware that information relating to a child has been collected where it should not have been, we will delete it and take any other appropriate action.
31. Your Data Protection Rights
Depending upon the circumstances and subject to applicable exemptions, you have the following rights.
31.1 Right of Access
You may request confirmation of whether we process your personal data and obtain a copy of it, together with other information required by law.
31.2 Right to Rectification
You may ask us to correct inaccurate personal data and complete incomplete information.
31.3 Right to Erasure
In certain circumstances you may request deletion of your personal data. This right is not absolute: we may retain information where a lawful basis or legal obligation requires it.
31.4 Right to Restriction
In certain circumstances you may ask us to restrict the processing of your personal data.
31.5 Right to Data Portability
Where the legal requirements apply, you may request certain personal data in a structured, commonly used and machine-readable format, and ask for it to be transmitted to another controller where technically feasible.
31.6 Right to Object
Where processing is based on legitimate interests, you may object. We will stop the relevant processing unless we have compelling lawful grounds to continue or the processing is needed for legal claims.
31.7 Right to Object to Direct Marketing
You may object at any time to processing for direct marketing, and we will stop.
31.8 Rights Regarding Automated Decision-Making
Where applicable, you have rights relating to significant decisions based solely on automated processing.
31.9 Withdrawal of Consent
Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew.
32. How to Exercise Your Rights
To exercise a data protection right, contact:
Email: support@cholcom.com
Postal address: Cholcom Limited, 13 Rectory Park Avenue, Northolt, UB5 6BD, United Kingdom
Please give enough information for us to identify you and the relevant records and to understand your request. We may take reasonable steps to verify your identity before acting.
We do not normally charge a fee. We respond within one month, which may be extended by up to two further months for complex or numerous requests, in which case we will tell you. Some rights are subject to legal conditions and exemptions.
33. Complaints
Please contact us first if you have concerns about how we process your personal data:
Data Protection Contact: Director, Data Protection Lead
Email: support@cholcom.com
Address: 13 Rectory Park Avenue, Northolt, UB5 6BD, United Kingdom
You also have the right to complain to the Information Commissioner's Office ("ICO"), the UK's independent data protection regulator: ico.org.uk/make-a-complaint. Individuals outside the UK may also complain to another competent supervisory authority where applicable.
34. Third-Party Websites and Services
Our websites, apps or communications may link to external websites, apps or services operated by independent organisations, which act as independent controllers. We are not responsible for their privacy practices, and we recommend reading their privacy information before sharing personal data with them.
35. Business Transfers and Corporate Transactions
If our business is involved in a merger, acquisition, reorganisation, restructuring, investment, financing, sale of assets, business transfer or similar transaction, personal data may be disclosed to appropriate prospective purchasers, investors, advisers, lenders or counterparties where reasonably necessary, subject to confidentiality and data protection safeguards. If responsibility for your personal data transfers to another controller, we will provide relevant privacy information where required.
36. Legal and Regulatory Disclosures
We may disclose personal data where reasonably necessary to comply with a legal obligation or lawful court order; respond to a regulator or a legally valid request from a public authority; investigate or prevent crime, fraud or cybersecurity incidents; protect our rights or the rights of another person; enforce contractual rights; or establish, exercise or defend legal claims. We assess such requests in accordance with applicable law.
37. Data Protection by Design and Default
We build privacy into the design and operation of our systems, services and processes, for example by collecting only necessary data, limiting access, choosing privacy-conscious defaults, applying retention controls and security measures, reviewing suppliers, assessing international transfers, considering anonymisation or pseudonymisation, reviewing privacy before material changes and carrying out Data Protection Impact Assessments where required. Where practical, our apps process your files on your device rather than on our servers.
38. Data Protection Impact Assessments
We carry out a Data Protection Impact Assessment ("DPIA") where processing is likely to result in a high risk to individuals' rights and freedoms, and we consult the ICO before high-risk processing where the law requires it.
39. Processor and Supplier Due Diligence
Before appointing material providers that process personal data on our behalf, we assess their security controls, confidentiality, contractual protections, resilience, data location, international transfers, sub-processors, breach processes, deletion arrangements, certifications, audit information and ability to comply with data protection obligations, and we review material suppliers periodically according to risk.
40. Changes to Our Services or Processing
When we introduce a new product, feature, integration, analytics service, infrastructure provider or processing activity, we assess whether this Policy or other privacy information needs updating, whether consent or a DPIA is required, and whether new processor contracts, transfer safeguards or security measures are needed.
41. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to our products, services, processing activities, technology, suppliers or organisation, legislative developments, regulatory guidance or improvements to our privacy practices. The current version is always available on our website, and the "Last updated" date at the top identifies it. Where a change materially affects how we process your personal data, we will take reasonable steps to bring it to your attention.
42. Contact Us
Questions about this Privacy Policy or our processing of personal data may be directed to:
Cholcom Limited
Data Protection Contact: Director, Data Protection Lead
Email: support@cholcom.com
Registered office: 13 Rectory Park Avenue, Northolt, UB5 6BD, United Kingdom
Company number: 16427926
ICO registration number: ZB999178
SCHEDULE 1 – CATEGORIES OF SERVICE PROVIDERS
This public summary does not replace our more detailed internal processor and supplier records.
| Provider category | Purpose | Typical information |
|---|---|---|
| Hosting and cloud infrastructure | Website, application and infrastructure hosting | Website information, application data, IP addresses, technical and security logs |
| Database and backend infrastructure | Databases, authentication, APIs and storage | Account information, application data, authentication information and technical records |
| Business productivity and communication | Email, collaboration, documents and identity | Contact information, communications, files, documents and account information |
| Cybersecurity providers | Security monitoring and protection | Technical information, network information, logs and security events |
| Backup and recovery | Business continuity and disaster recovery | Copies of relevant hosted information |
| Payment providers (including Google Play) | Processing payments | Billing and transaction information |
| App distribution and advertising (Google Play, Google AdMob) | Distributing our apps; showing ads in free app versions | Device identifiers, approximate location, ad interactions, diagnostics |
| Customer support providers | Customer service and ticketing | Identity, contact, account and communications information |
| Analytics providers | Website and app measurement where permitted | Usage, device and technical information |
| Professional advisers | Legal, accounting, audit and insurance | Information relevant to their professional function |
Our principal technology providers presently include Microsoft, Hostinger, Supabase and Google for the purposes described in section 13. Individual providers may change from time to time.