Legal
Privacy policy
Last updated 21 October 2026
The short version
- This website sets no cookies and runs no analytics or third-party scripts.
- We use account holders' details to run the service, keep it secure and talk to you about it. We never sell personal data.
- Our customers decide what data about their own contacts they store and email. For that data we act on their instructions, as a processor.
- Customer data is stored in the UK and encrypted in transit and at rest.
- You have rights over your data. Email privacy@organimate.co.uk to use them.
1. Who we are
Organimate is provided by Organimate Ltd (“Organimate”, “we”, “us”). Organimate Ltd is a private limited company registered in England and Wales under company number 17532202, with its registered office at 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. Our postal address is 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.
For the personal data described in sections 3 to 6 we are the controller: we decide why and how it is used. We are registered with the UK Information Commissioner's Office (ICO) under registration number [ICO registration number].
For questions about this policy or your data, email privacy@organimate.co.uk or write to us at the address above.
2. What this policy covers
This policy explains how we handle personal data about:
- people who visit organimate.co.uk;
- people who contact us by email or otherwise;
- people who use the Organimate service (“account holders”), whether as the owner of a workspace or as a team member invited to one; and
- people whose details our customers store in Organimate or whom they email using it (“contacts” and “recipients”). Section 7 explains how this is different.
We are a business-to-business service. It isn't intended for consumers acting for personal purposes.
3. Visiting this website
This website uses no cookies, no analytics, no advertising or social media trackers, and no third-party scripts or fonts. We don't try to identify you.
To deliver pages to you and protect the site from attack, our hosting provider (Amazon Web Services, through its CloudFront network) necessarily processes technical information such as your IP address, browser type and the page requested. We don't keep website access logs, and we don't combine this information with anything else.
Lawful basis: our legitimate interests in running a secure, working website (UK GDPR Article 6(1)(f)).
4. Contacting us
If you email us, we use your name, email address, the content of your message and any details you choose to share to reply, and to keep a record of the conversation.
Lawful basis: our legitimate interests in responding to enquiries and running our business, or taking steps at your request before entering into a contract (Article 6(1)(b) and (f)).
5. Using Organimate (account holders)
| What we collect | Why | Lawful basis |
|---|---|---|
| Name, work email address and, if you give it, phone number; your workspace (organisation) and your role in it | To create and run your account, give you access to the right workspaces, and contact you about the service | Contract (6(1)(b)) |
| Sign-in details: your password (stored only as a protected hash by our sign-in provider; we never see it), multi-factor authentication settings, and sign-in records such as times and IP addresses | To authenticate you and protect accounts from misuse | Contract; legitimate interests in security (6(1)(f)) |
| Activity records: which user created or changed things in a workspace, and when | To show your team a history of changes, investigate problems and keep the service secure | Legitimate interests |
| API key details (name, scope, creation and last-use times; the key itself is stored only as a hash) | To let your systems connect securely and to revoke keys | Contract |
| Support conversations and feedback | To help you and improve the service | Contract; legitimate interests |
| Billing details, once paid plans are available (billing contact and address, plan, invoices). Card payments will be taken by a payment provider; we will not store card numbers | To charge for the service and keep financial records | Contract; legal obligation (6(1)(c)) |
| Service usage information, such as how many contacts or emails a workspace has, and system performance data | To apply plan limits, plan capacity, fix faults and improve the service. We use it in aggregate where we can | Legitimate interests |
We also use account information where needed to comply with the law, to enforce our Terms and Acceptable Use Policy, and to establish, exercise or defend legal claims.
6. Our own marketing
We send news about Organimate only where the law allows: to account holders about similar services, with a simple way to opt out every time, or to anyone who has asked to hear from us. You can unsubscribe at any time using the link in our emails or by emailing hello@organimate.co.uk. Service messages, such as security notices and changes to our terms, are not marketing and are sent regardless.
7. Data our customers store and send
Our customers use Organimate to keep records about their own contacts (for example names, email addresses, consent status, custom fields, and data such as orders or bookings), to run automated flows, and to send them email. For this data the customer is the controller and we are a processor. We handle it only on the customer's documented instructions, under the data processing terms in our Terms, and never for our own purposes.
When a customer sends email through Organimate we record, on their behalf, information about each message, such as when it was delivered, and whether it bounced, was opened, had a link clicked, or was reported as spam. We also record unsubscribes and preference changes made through the links in their emails. This lets the customer see how their emails perform, and lets the service automatically stop sending to people who have unsubscribed or whose address no longer works.
If you received an email sent through Organimate, it came from one of our customers, and they are responsible for having your permission and for telling you how they use your data. To stop receiving their marketing, use the unsubscribe link in the email. To exercise your other rights, contact the organisation that sent it. If you contact us instead, we will pass your request to them where we can identify them, and help them respond.
8. Who we share data with
We don't sell personal data or share it for others' marketing. We share it only with:
- Service providers who process it for us, under contracts that require them to protect it and use it only on our instructions:
- Amazon Web Services (AWS): hosting, databases, file storage, sign-in (Amazon Cognito), email delivery (Amazon Simple Email Service) and content delivery (Amazon CloudFront). Our service data is hosted in AWS's London region.
- Namecheap: our domain names, and forwarding of emails sent to our @organimate.co.uk addresses.
- A payment provider, once paid plans are available. We will name it here before it is used.
- Professional advisers, such as lawyers, accountants and insurers, where needed.
- Authorities and others where the law requires it, or where needed to protect the rights, property or safety of our users, recipients or the public, including to prevent abuse of email.
- A buyer or successor if all or part of our business is sold or reorganised, under equivalent protections. We would tell affected account holders.
9. International transfers
We store service data in the UK. Some of our providers may process limited data outside the UK. For example, CloudFront serves this website from locations around the world, and our providers' support staff may work elsewhere. Where personal data is transferred outside the UK, we rely on UK adequacy regulations or on safeguards approved under UK law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, which our providers include in their data processing terms.
10. How long we keep data
- Enquiries: up to 24 months after our last contact, unless you become a customer.
- Account information: for as long as the account is open, then deleted within 90 days of closure. We keep only what we need for legal obligations (for example financial records, kept for six years) or to resolve disputes.
- Security and sign-in records: up to 12 months, unless needed longer to investigate an incident.
- Customer data (section 7): as the customer decides while their account is open, and deleted within 90 days after it closes, unless they ask us to return it first.
- Backups: deleted data drops out of our rolling backups within 35 days.
11. How we protect data
We use technical and organisational measures appropriate to the risk, including:
- encryption in transit (TLS) and at rest;
- separation of each customer's data at the database level;
- least-privilege access for staff and systems, with credentials kept in managed secret stores;
- multi-factor authentication for accounts; and
- monitoring and alerting.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.
12. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to how we use it, including objecting at any time to its use for direct marketing;
- receive data you gave us in a portable format; and
- withdraw consent at any time, where we rely on consent.
Some rights apply only in certain circumstances. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. To exercise a right, email privacy@organimate.co.uk. We may ask you to confirm your identity, and we'll respond within one month (or tell you if we need longer, as the law allows). For data our customers control (section 7), please contact the customer first.
13. Children
Organimate is a service for businesses and isn't directed at children. Account holders must be 18 or over. We don't knowingly collect children's personal data for our own purposes.
14. Changes to this policy
We'll update this policy when our practices change, and change the date at the top. If changes are significant, we'll tell account holders by email or in the service before they take effect.
15. Contact and complaints
Email privacy@organimate.co.uk or write to Organimate Ltd, 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. If you're unhappy with how we've handled your data, please tell us so we can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.