Privacy Policy
Last updated: 3 August 2025
1. Introduction
Allocate Now ("we", "us", or "our") is a resource planning software-as-a-service (SaaS) platform operated within the European Union. We are committed to protecting your personal data and complying with the General Data Protection Regulation (GDPR) (EU) 2016/679 and all applicable data protection laws.
This Privacy Policy explains how we collect, use, store, and share your personal data when you use our website at allocate-now.com and our application.
2. Data Controller
The data controller responsible for your personal data is:
Allocate Now
Email: support@allocate-now.com
3. Personal Data We Collect
We collect the following categories of personal data:
| Category | Data Types | Purpose |
|---|---|---|
| Account Data | Full name, email address, password (hashed) | User authentication and account management |
| Organisation Data | Company name, billing address, VAT number | Subscription management and invoicing |
| Resource Data | Resource names, skills, availability, roles, allocation data | Core service functionality (resource planning) |
| Payment Data | Stripe customer ID, subscription details (card details are processed by Stripe only) | Payment processing and subscription management |
| Technical Data | IP address, browser type, access timestamps, session cookies | Security, performance monitoring, and service delivery |
4. Legal Basis for Processing
We process your personal data based on the following legal grounds under GDPR Article 6:
- Contract performance — Processing necessary to provide our service (Art. 6(1)(b))
- Legitimate interest — Security monitoring, fraud prevention, service improvement (Art. 6(1)(f))
- Consent — Analytics cookies and marketing communications (Art. 6(1)(a))
- Legal obligation — Tax and accounting requirements (Art. 6(1)(c))
5. Data Processors and Third Parties
We share your data with the following third-party processors who act on our behalf:
| Processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, database, file storage | EU (Stockholm, eu-north-1) |
| Stripe, Inc. | Payment processing and subscription billing | EU/US (with EU SCCs) |
| Zoho Corporation | Email communications (support@allocate-now.com) | EU |
All processors are bound by Data Processing Agreements (DPAs) ensuring GDPR-compliant data handling. We do not sell your personal data to any third party.
6. Data Retention
We retain your personal data only as long as necessary for the purposes described:
- Account data: Retained while your account is active, plus 30 days after deletion request.
- Organisation and resource data: Retained while the organisation subscription is active. Deleted within 30 days of account closure.
- Payment records: Retained for 7 years as required by tax and accounting regulations.
- Technical logs: Retained for up to 90 days for security and debugging purposes.
7. Your Rights Under GDPR
As a data subject, you have the following rights:
- Right of access (Art. 15): Request a copy of your personal data.
- Right to rectification (Art. 16): Correct inaccurate or incomplete data.
- Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
- Right to restriction (Art. 18): Restrict processing in certain circumstances.
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
- Right to object (Art. 21): Object to processing based on legitimate interest.
- Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting prior processing.
To exercise any of these rights, contact us at support@allocate-now.com. We will respond within 30 days.
8. International Data Transfers
Our primary infrastructure is hosted within the EU (AWS eu-north-1, Stockholm). Where data is transferred outside the EEA (e.g., Stripe's US infrastructure), we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Secure password hashing (bcrypt)
- Access controls and role-based permissions
- Regular security updates and monitoring
- Database backups with encryption
10. Cookies
We use cookies to provide our service. For detailed information about the cookies we use, please see our Cookie Policy.
11. Children's Privacy
Our service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.
12. Supervisory Authority
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on our website. The "Last updated" date at the top indicates when the policy was last revised.
14. Contact Us
For any questions about this Privacy Policy or to exercise your data protection rights, please contact us:
Allocate Now — Data Protection
Email: support@allocate-now.com