Legal
illapa Cloud Privacy Policy
Effective date: 9 September 2026Last updated: 9 September 2026
1 About this policy
This Privacy Policy explains how illapa collects, uses, shares and protects personal data when you:
- visit www.illapa.cloud or another illapa website linking to this policy;
- contact us or request a demonstration;
- subscribe to communications;
- attend an illapa event or webinar;
- interact with us as a customer, prospective customer, supplier, partner or professional adviser; or
- apply for a position with illapa through our website.
In this policy, personal data means information relating to an identified or identifiable individual.
2 Who is responsible for your personal data
The controller responsible for the processing described in this policy is:
Illapa Cloud Limited, trading as illapa Cloud ( "illapa", "we", "us" or "our").
- Registered in: England and Wales
- Company number: 10890314
- Registered office: 11 Castle Hill, Maidenhead, Berkshire. SL6 4AA
- Privacy contact: [email protected]
- UK representative: Not applicable
- EEA representative: Not applicable
- Data Protection Officer: Not applicable
If more than one illapa group company is involved, the relevant company will be the controller for the relationship it manages. You can contact us if you need confirmation of the relevant entity.
3 illapa products and customer-controlled data
illapa provides technology that enables organisations to build, operate and deliver their own multi-tenant branded cloud services.
This policy principally covers illapa's use of personal data for its own website, sales, marketing and business operations.
When illapa processes personal data contained in Commander, OpsMgr or another illapa service solely on a customer's documented instructions, illapa generally acts as a processor and the customer acts as controller. That processing is governed by the applicable customer agreement and data processing agreement.
If you use an illapa-powered service supplied under another organisation's brand, consult that organisation's privacy notice first. Requests concerning data controlled by that organisation should normally be directed to it.
4 Personal data we collect
Depending on how you interact with us, we may collect the following categories of personal data.
Identity and business contact information. This may include your name, job title, employer, department, business address, email address, telephone number and professional profile information.
Enquiry and relationship information. This may include demonstration requests, correspondence, meeting notes, product interests, procurement requirements, support enquiries, feedback and information about your organisation's proposed use of illapa technology.
Account information. If the Website offers an account, demonstration environment or restricted partner area, we may collect usernames, authentication information, account permissions and records of account activity.
We do not ask you to provide your password in readable form and you should not send passwords or production credentials through general Website forms.
Technical and usage information. This may include IP address; browser type and version; device and operating-system information; approximate location derived from an IP address; pages viewed and links selected; referral source; session times and identifiers; consent and cookie preferences; and diagnostic, performance and security logs.
Marketing and preference information. This may include your communication preferences, subscriptions, event registrations, campaign interactions and records of whether you opened or selected a link in a message, where permitted.
Information from third-party and public sources. We may receive business contact information from your employer or colleagues; customers, partners and professional advisers; event organisers; referral partners; publicly available company websites, professional directories and corporate records; and business-information providers, where their collection and disclosure of the information is lawful.
Recruitment information. If you apply for a role, we may collect your employment history, qualifications, application materials, interview notes, references, work-authorisation information and other information you choose to provide.
Please do not send special-category or highly sensitive personal data unless it is necessary and we have asked for it.
5 How we use personal data and our lawful bases
We process personal data only where we have a lawful basis.
| Purpose | Personal data commonly used | Lawful basis |
|---|---|---|
| Operating, maintaining and securing the Website | Technical, usage, account and security information | Our legitimate interests in providing a reliable and secure business website |
| Responding to enquiries and arranging demonstrations | Identity, contact, enquiry and relationship information | Taking steps at your request before entering into a contract and our legitimate interests in responding to business enquiries |
| Managing customer, partner and supplier relationships | Identity, contact, account, correspondence and relationship information | Performance of a contract and our legitimate interests in managing business relationships |
| Providing accounts or restricted Website features | Identity, account, technical and usage information | Performance of a contract and our legitimate interests in administering authorised access |
| Improving the Website, products and communications | Usage, diagnostic, feedback and relationship information | Our legitimate interests in understanding and improving our services, subject to cookie and similar-technology rules |
| Sending relevant business marketing | Identity, business contact, preference and engagement information | Consent where required or our legitimate interests in promoting relevant services to business contacts |
| Managing events and webinars | Identity, contact, registration and participation information | Performance of an event arrangement, consent where required and our legitimate interests in running business events |
| Preventing fraud, misuse and security incidents | Account, technical, usage and security information | Our legitimate interests in protecting illapa, our customers and our systems and, where relevant, compliance with legal obligations |
| Meeting legal, regulatory, tax and governance obligations | Any information reasonably required for the obligation | Compliance with a legal obligation |
| Establishing, exercising or defending legal claims | Contact, account, correspondence, transaction and technical information | Our legitimate interests in protecting our legal rights |
| Evaluating corporate transactions or reorganisations | Relevant business relationship and due-diligence information | Our legitimate interests in managing and developing our business, subject to appropriate confidentiality controls |
| Managing recruitment | Identity, contact and recruitment information | Taking steps before entering into an employment contract, compliance with legal obligations and our legitimate interests in recruitment |
Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights, interests and reasonable expectations.
We will obtain consent where the law requires it. You may withdraw consent at any time, although this will not affect processing that took place before withdrawal.
6 Business marketing
We may send relevant information about illapa products, demonstrations, events and services to business contacts.
Where consent is required, we will ask for it before sending the communication. In other business-to-business circumstances, we may rely on legitimate interests where permitted by law.
Every marketing email will provide a way to unsubscribe. You may also opt out by contacting [email protected].
You have an absolute right to object to the use of your personal data for direct marketing. If you object, we will stop using your personal data for that purpose.
After an opt-out, we may keep the minimum information needed on a suppression list so that we can respect your preference.
7 Cookies and similar technologies
The Website may use cookies, pixels, local storage, software development kits and similar storage or access technologies.
We use strictly necessary technologies to provide requested features, maintain security, remember privacy choices and operate the Website.
We will ask for consent before using analytics, advertising or other non-essential technologies unless a specific legal exception applies. Declining non-essential technologies will not prevent access to the main Website.
Our Cookie Policy explains:
- which technologies we use;
- who provides them;
- what each technology does;
- how long it remains active; and
- how you can change or withdraw your choices.
You can revisit your choices at any time through Cookie Settings.
8 Sharing personal data
We may share personal data with:
- illapa group companies;
- website-hosting, infrastructure and content-delivery providers;
- customer-relationship management, communications and email providers;
- analytics, security, authentication and diagnostic providers;
- event and webinar providers;
- professional advisers, auditors, insurers and financial institutions;
- customers or partners where you have asked us to make an introduction or where sharing is reasonably necessary for the relevant relationship;
- public authorities, regulators, courts and law-enforcement bodies where required or permitted by law; and
- prospective purchasers, investors or transaction advisers in connection with a financing, merger, acquisition, reorganisation or transfer of all or part of our business.
Service providers acting for illapa may use personal data only for the contracted purpose and must protect it appropriately.
We do not permit third parties to use personal data supplied to them by illapa for their own unrelated marketing.
illapa does not sell personal data or share it for cross-context behavioural advertising.
9 International transfers
illapa and some of its service providers may operate outside the country in which you are located. Personal data may therefore be transferred to or accessed from the United States, United Kingdom, European Economic Area or other countries.
Where data protection law restricts an international transfer, we use an approved transfer mechanism where required. Depending on the transfer, this may include:
- a UK adequacy regulation;
- an adequacy decision of the European Commission;
- the UK International Data Transfer Agreement;
- the UK Addendum to the European Commission Standard Contractual Clauses;
- the European Commission Standard Contractual Clauses; or
- another legally recognised safeguard.
We also assess relevant transfer risks and use supplementary contractual, technical or organisational protections where appropriate.
To request further information about the safeguards used for a particular transfer, contact [email protected].
10 Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, accounting, security and dispute-resolution requirements.
| Information | Normal retention period |
|---|---|
| General enquiries and demonstration requests that do not progress | Up to 24 months after the last meaningful interaction |
| Customer, partner and supplier relationship records | For the relationship and normally up to 6 years afterwards |
| Marketing contact information | Until you opt out, the information is no longer relevant or we determine it should be deleted |
| Marketing suppression records | As long as reasonably necessary to honour the opt-out |
| Website analytics information | Page views, referrers, device and browser data, and custom events such as contact form submit, held in illapa's Umami instance for up to 14 months. Session recordings, if you consent, are kept for 30 days. |
| Security and access logs | Normally up to 12 months unless needed to investigate an incident |
| Cookie consent records | For the life of the consent plus a reasonable period needed to demonstrate compliance |
| Rights requests and privacy complaints | Normally up to 6 years after closure |
| Unsuccessful recruitment applications | Normally 6 months after the recruitment process, unless a different period is agreed |
| Legal and transaction records | For the applicable statutory or limitation period |
We may keep information for longer where litigation, an investigation, a legal hold or another legal requirement applies. We may delete or anonymise it earlier where it is no longer required.
11 Security
We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or access.
These measures may include access controls, encryption where appropriate, authentication controls, logging, backups, staff confidentiality obligations, supplier due diligence and incident-response procedures.
No internet-based service is completely secure. You should not submit passwords, production credentials, special-category data or other sensitive information through a general Website form.
If you believe personal data has been compromised, contact [email protected].
12 Your rights
Depending on applicable law and the circumstances, you may have the right to:
- ask whether we process your personal data;
- obtain a copy of your personal data;
- correct inaccurate or incomplete information;
- request deletion of your personal data;
- restrict how we use your personal data;
- object to processing based on legitimate interests;
- object to direct marketing;
- receive certain personal data in a portable format;
- withdraw consent at any time;
- complain about our use of your personal data; and
- receive safeguards in connection with certain solely automated significant decisions.
These rights are not absolute. Exemptions may apply, and the rights available can depend on our lawful basis.
To exercise a right, email [email protected]. Please describe your request clearly. We may ask for information reasonably necessary to confirm your identity and authority. We will not ask for more identifying information than necessary.
We normally respond within one calendar month, subject to any extension permitted by law.
13 Automated decision-making
illapa does not use personal data collected through the Website to make solely automated decisions that produce legal or similarly significant effects on individuals.
If this changes, we will provide the information and safeguards required by applicable law, including an appropriate opportunity to obtain human intervention, make representations and contest the decision.
Website analytics, lead prioritisation or email-engagement measurements may involve automated processing, but illapa will not use them alone to make a legally or similarly significant decision about you.
14 Privacy complaints
You may raise a data protection complaint by contacting:
Email: [email protected]
Post: Illapa Cloud Limited, 11 Castle Hill, Maidenhead, Berkshire. SL6 4AA
Please include enough information for us to understand the issue. You may submit a complaint on behalf of another person if you provide appropriate evidence of your authority.
We will acknowledge a data protection complaint within 30 days, investigate it appropriately, keep you informed where necessary and communicate the outcome without unnecessary or unjustifiable delay.
You also have the right to complain to a data protection regulator.
In the United Kingdom, contact the Information Commissioner's Office:
- Website: https://ico.org.uk/make-a-complaint/
- Telephone: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
If you are in the European Economic Area, you may complain to the supervisory authority in the country where you live, work or believe an infringement occurred.
We would appreciate the opportunity to address your concerns directly, but contacting us first does not affect your right to approach a regulator.
15 Information about other people
If you provide personal data about another person, you must ensure that you are authorised to do so and that the person receives this policy where required.
16 Children
The Website and illapa's business services are not directed to children. We do not knowingly collect personal data from anyone under 18 through the Website.
If you believe a child has provided personal data to us, contact [email protected].
17 External websites
The Website may link to websites and services controlled by other organisations. Their privacy practices are governed by their own policies. illapa is not responsible for how an external organisation processes personal data.
18 Changes to this policy
We may update this policy when our processing, technology, corporate structure or legal obligations change.
We will publish the updated version on this page and change the last updated date. If a change materially affects how we use personal data, we will provide additional notice where appropriate.
19 Contact us
Questions, rights requests and privacy complaints should be sent to:
Illapa Cloud Limited
11 Castle Hill, Maidenhead, Berkshire. SL6 4AA
Email: [email protected]
Company number: 10890314
For security reports, contact [email protected].