Data Management
Where Drool Limited acts as a data controller and where it acts as a data processor.
1. Purpose
The purpose of this document is to outline where Drool Limited is a Data Controller and where it is a Data Processor under the UK GDPR. It should be read alongside our Privacy Policy. Any changes to our processing activities will be reflected here.
2. Controller and processor - overview
In the course of its operations, Drool Limited acts as both a Data Controller and a Data Processor. In summary, Drool Limited is a Data Controller for its own business, member-account and marketing data, and a Data Processor for the client data that members put into the Service.
3. Where we are the Data Controller
Member and business data: Drool Limited is the controller of the personal data of its members and prospective members, such as the name, email, account credentials, studio details and billing information collected to provide the Service and run our business.
Human resources data: information collected for our role as an employer, including payroll. If you apply for a job with Drool Limited, we will receive the personal data you provide, such as your name, address, contact information, education and professional experience, and use it for hiring purposes only.
Marketing data: data captured when an individual opts into marketing, in certain cases through cookies, or through lead-generation data from a third party.
4. Where we are the Data Processor
Drool Limited may collect, store and analyse information (including personal data) about individuals whose personal data is processed during the provision of the Service to its members, for example the clients whose details a member adds to a quote, review or portal ("Customer Data"). This information is controlled by our member, and Drool Limited processes it on that member's behalf and on their instructions, as a data processor only, in accordance with our Terms of Service.
5. If you are a client invited by a member
If Customer Data includes your personal data, or you are using the Service by invitation of a Drool Limited member (for example to review work or leave feedback), we collect, store and analyse your personal data on behalf of that member. The member decides its own policies for that data, which may apply to your use of the Service. Please check with them. If you have a question about how your data is used in that context, contact the member first.
6. Account and billing data
To create a Drool Community account and access the Service, members provide us with names, usernames, passwords and contact information. To take out a paid plan, members also provide billing information, which is handled by our payment processor to complete transactions relating to the Service.
7. Our sub-processors
To run the Service we use a small number of trusted sub-processors under contracts that require them to protect personal data, including providers of hosting and database infrastructure, payment processing, transactional email, authentication and product analytics. Where any of these process data outside the UK or EEA, we rely on appropriate safeguards as described in our Privacy Policy.
8. Security, retention and contact
We apply appropriate technical and organisational measures to protect the data we hold, and retain it only as long as needed for the purposes described in our Privacy Policy or as required by law. For any question about how we manage data, including data-protection or sub-processor queries, contact us at alex@drool.design or write to Drool Limited, 8 Sycamore Street, London, England, EC1Y 0SW.