Privacy Policy

Arran Logic Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use SolanFM, our facilities management platform, and our website solanfm.co.uk. This policy complies with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the Data Protection Act 2018.

We collect the following categories of personal data: • Account data: your name, email address, company name, and role. • Authentication data: encrypted password hash, JWT tokens, refresh tokens. • Profile data: phone number (optional), avatar image. • Usage data: IP address, browser type, device information, access logs. • Operational data: work orders, comments, photos, and documents you create within SolanFM. • Integration data: credentials and configuration you provide when connecting third-party systems (stored encrypted; never shared). We do not collect special category data (health, religion, ethnicity, etc.) unless you voluntarily provide it in a free-text field.

We process your personal data under the following lawful bases (Article 6 UK/EU GDPR): • Performance of a contract (Art. 6(1)(b)): providing the SolanFM service you signed up for, including account management and work order processing. • Legal obligation (Art. 6(1)(c)): retaining billing records, tax invoices, and audit trails as required by UK law. • Legitimate interests (Art. 6(1)(f)): detecting fraud, securing the platform, improving service quality, and sending essential service notifications. • Consent (Art. 6(1)(a)): sending marketing communications and setting non-essential cookies. You can withdraw consent at any time.

We use your personal data to: • Create and manage your SolanFM account. • Deliver the facilities management features you request. • Process work orders, assets, buildings, and related operational data. • Send service notifications (e.g., work order assignments, system alerts). • Provide technical support and respond to your enquiries. • Detect, prevent, and investigate fraud or security incidents. • Improve our platform through aggregated, anonymised analytics. • Comply with legal and regulatory obligations.

We do not sell your personal data. We share it only with: • Sub-processors who provide infrastructure services: cloud hosting (for database and application hosting), email delivery, and error monitoring. Each sub-processor is bound by a data processing agreement compliant with UK/EU GDPR. • Integration providers you connect (e.g., Xero, HubSpot, Twilio) — only when you explicitly configure an integration. We transmit data to these providers on your behalf; their privacy policies govern the data once received. • Law enforcement or regulatory authorities, where required by law. A current list of sub-processors is available on request at privacy@solanfm.co.uk.

Your personal data is primarily processed and stored within the United Kingdom and the European Economic Area. Where data is transferred to a country outside the UK/EEA (e.g., to a US-based sub-processor), we ensure appropriate safeguards are in place, including: • The UK International Data Transfer Addendum or EU Standard Contractual Clauses. • Adequacy decisions where applicable. • Binding Corporate Rules where the recipient has them. No transfer occurs without a legal transfer mechanism in place.

We retain your personal data only for as long as necessary: • Account data: retained for the duration of your SolanFM subscription, then deleted or anonymised within 90 days of account closure. • Billing and tax records: retained for 6 years from the end of the financial year, as required by UK tax law. • Security logs and audit trails: retained for 12 months. • Marketing data (where you consented): retained until you withdraw consent or 24 months of inactivity, whichever is sooner. • Integration credentials: deleted immediately when you remove the integration.

Under UK GDPR and EU GDPR, you have the following rights: • Right of access: request a copy of your personal data. • Right to rectification: correct inaccurate or incomplete data. • Right to erasure ("right to be forgotten"): request deletion of your data, subject to legal retention obligations. • Right to restrict processing: limit how we use your data in certain circumstances. • Right to data portability: receive your data in a structured, machine-readable format. • Right to object: object to processing based on legitimate interests or for direct marketing. • Right to withdraw consent: withdraw consent for processing that relied on it, at any time. • Right to lodge a complaint: with the Information Commissioner's Office (ICO) at ico.org.uk or your local data protection authority. To exercise any of these rights, contact us at privacy@solanfm.co.uk. We respond within one month, as required by law.

We implement appropriate technical and organisational measures to protect your personal data, including: • Encryption at rest (AES-256) and in transit (TLS 1.2+). • Per-tenant credential isolation using a dedicated secrets vault. • Regular security assessments and penetration testing. • Role-based access control with least-privilege principles. • Incident response procedures with notification to affected users and the ICO within 72 hours of a confirmed breach, as required by law. No system is 100% secure. We continuously review and improve our security posture.

We use cookies and similar technologies on our website. Essential cookies are necessary for the site to function (e.g., authentication, session management, language preference). Non-essential cookies (e.g., analytics) are only set after you give consent via our cookie banner. You can manage your cookie preferences at any time. See our Cookie Policy for details.

SolanFM is a B2B platform and is not intended for use by individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact privacy@solanfm.co.uk and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by email or a prominent notice on the website. The "Last updated" date at the top of this page indicates when the policy was last revised.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact: Arran Logic Ltd 5 South Charlotte Street EH2 4AN Edinburgh United Kingdom Email: privacy@solanfm.co.uk Our Data Protection Officer can be reached at the same address.