Simana Privacy Policy

Effective date: 29 October 2026 | previous versions

1. Who we are and how to contact us

Simana is provided by See Data Limited. In this policy, “we”, “us”, “Simana” and “See Data” mean See Data Limited.

This policy explains how we collect, use, share and retain personal data when you visit our websites, contact us or use our software and services. It also explains the different responsibilities we and our organisational customers have for personal data.

You can contact us or our Data Protection Officer about this policy, our privacy practices or your data protection rights at privacy@simana.com, or write to: See Data Limited, 1 Emperor Way, Exeter Business Park, Exeter, EX1 3QS, United Kingdom.

2. Our relationship with you

When we process data for your organisation

Simana is intended for use by organisations. If your organisation provides or administers your access, it generally determines why and how personal data in its Simana environment is used. It is usually the controller, and we process that data on its behalf as a processor. Where an organisation itself acts for another controller, we may act as its subprocessor.

We call personal data processed on an organisation's behalf Customer Personal Data. This includes relevant account and profile information, workspace content, operational records, support materials and personal data in enabled AI features. We process it under the customer's documented instructions and the applicable Data Processing Addendum. The same distinction applies to an organisational trial or free service where we process data on the organisation's behalf.

Your organisation is responsible for explaining its purposes, lawful bases and use of your information. Its administrators manage accounts, permissions, integrations and sharing within its environment. Refer to its privacy information or contact its administrator if you have questions about those activities.

When we act as a controller

We act as an independent controller when we determine our own purposes and means for processing personal data. This includes appropriate business contact and relationship records, sales enquiries, contractual correspondence, invoicing and accounting records, and information collected for our own website and marketing activities.

These records may include contact details for someone who also has a Simana user account. The purposes and responsibilities remain separate: deleting the user's service account does not necessarily require deletion of lawfully retained business relationship or accounting records.

Customer Personal Data does not become our independent controller data merely because it is copied into a CRM, support system, accounting system or another tool. We do not use this policy to expand our rights to use data entrusted to us as a processor.

3. Information we collect and receive

Information you or your organisation provide

Account and profile information. This may include your name, work email address, job role, organisation and team affiliations, account identifiers and permissions. You may also choose to provide interests, expertise or a profile photograph. Profile information may be visible to other users according to the service's sharing arrangements and your organisation's settings.

Workspace content. You or other authorised users may include personal data in cards, spaces, projects, comments, tasks, documents, attachments, messages, charts and other content. Information may be entered directly, imported or received through an authorised integration or API.

Support information. When you contact support, we receive your contact details, correspondence, a description of the issue and any relevant technical information or materials you provide. Please share only what is necessary to investigate your request. Workspace content supplied for troubleshooting remains subject to the applicable customer instructions and DPA.

Business contact and transaction information. When you enquire about Simana or manage a customer relationship with us, we may receive names, roles, business contact details, organisation details, communications, contract and order details, billing information, invoice records and payment status. Payment providers handle payment information directly under their own arrangements; we describe our relevant disclosures in section 7.

AI feature information. If your organisation enables an AI feature, the information processed may include prompts, messages, selected contextual content and generated outputs. Section 5 explains this processing.

Information collected automatically

Service and administrative records. These may include authentication and access events, timestamps, activity records, permissions, organisation and object identifiers, usage counts and relevant audit history. We process customer service records on the customer's behalf where that is their purpose.

Device and connection information. We may receive IP addresses, browser and device information and technical identifiers when you use our websites or services. These records support delivery, troubleshooting and security. An IP address may also indicate an approximate location.

Cookies and similar technologies. These may collect technical information, preferences and information about interactions with our websites or services, subject to the applicable choices and legal requirements described in section 6.

Information from other sources

Your organisation, its administrators or other authorised users may provide your business contact details, invite you to Simana or assign you work. Authorised integrations, including identity providers used for single sign-on, may provide account, authentication or other information needed for the integration.

We may also receive business enquiry or relationship information through referrals and business interactions. Where we obtain personal data from another source for our own controller purposes, we provide the applicable privacy information and explain the source, as required by law.

Information needed to provide a service

Some information is necessary to create and secure an account, provide a requested service, manage a business relationship or meet a legal obligation. Without it, we may be unable to provide the relevant service or complete a transaction. We explain any mandatory requirements at the point of collection. Optional profile information and optional marketing choices are not conditions of receiving unrelated services.

4. Why we use personal data and our lawful bases

Processing on a customer's behalf

For Customer Personal Data, the customer determines its purposes and lawful basis. We process the data under its documented instructions to provide, administer, host, secure, maintain and support its Simana environment, including customer-authorised integrations and AI features. Our processor activities are governed by the DPA, rather than an independent claim that all processing is based on our legitimate interests or the user's consent.

Our independent controller activities

The table below describes our own controller purposes and the relevant lawful bases under UK GDPR and, where applicable, EU GDPR.

Purpose	Information used	Lawful basis and relevant interests
Responding to business enquiries, arranging demonstrations and managing customer and supplier relationships	Business contact details, enquiry information and relevant correspondence	Legitimate interests in responding to requests, communicating with business representatives and managing business relationships.
Administering agreements, billing and payments	Contract contacts, orders, invoices, payment status and related correspondence	Legitimate interests in administering organisational contracts and receiving payment; legal obligation for records we must keep under accounting or tax law.
Meeting legal obligations and handling privacy requests	Relevant identity, contact, transaction and correspondence records	Legal obligation where the processing is required by applicable law.
Managing complaints, disputes and legal claims involving our own business records	Relevant relationship, contract, transaction and correspondence records	Legitimate interests in resolving complaints and establishing, exercising or defending legal rights; legal obligation where a specific legal requirement applies.
Protecting our own websites and business systems and preventing misuse	Relevant technical, security and access records	Legitimate interests in maintaining secure systems and preventing fraud and abuse; legal obligation where a specific duty requires processing. Customer service logs processed on a customer's behalf remain governed by the DPA.
Sending relevant business marketing and managing preferences	Appropriate business contact details, interests communicated to us and marketing preferences	Consent where required by law. Otherwise, legitimate interests in promoting relevant services to business contacts, subject to applicable marketing rules and the right to object.
Understanding and improving our own website and responding to feedback	Website interaction information and feedback supplied for that purpose	Consent where required for tracking and the associated personal data use. Otherwise, legitimate interests in maintaining a useful website and improving our services from appropriate feedback, where lawful and consistent with people's rights. This does not authorise independent use of Customer Personal Data.

Where we rely on legitimate interests, we assess whether the processing is necessary and whether those interests are overridden by your interests, rights or freedoms. We use only the information needed for the purpose and apply appropriate safeguards.

We do not treat visiting our websites, using Simana or accepting general terms as blanket consent to personal data processing. Where we rely on consent, we ask for it for the particular purpose and explain how to withdraw it.

We do not use Customer Personal Data for unrelated marketing or to train generative AI models. Any product improvement activity involving that data must remain within lawful customer instructions and the DPA. This policy does not grant a separate right to create or use anonymous statistics from customer data.

5. AI features

Where your organisation enables an AI feature, we process personal data in prompts, messages, selected context and outputs to deliver that feature under the customer's instructions. Only the data needed for the feature should be submitted or made available to it.

Authorised AI providers and their processing locations are identified in our subprocessor register. Their authorised processing is limited to delivering the agreed feature, including necessary security and abuse prevention within the documented scope and lawful instructions.

We do not use Customer Personal Data to train generative AI models, and do not permit our AI subprocessors to do so. This is not a statement that every AI provider operates with zero retention. Applicable storage, access and deletion arrangements remain subject to the DPA, including its subprocessor, transfer and deletion requirements.

Your organisation controls which features it enables and what information it authorises for use. Please follow its instructions and the restrictions in section 12 when using AI features.

6. Cookies marketing and communications

Cookies and similar technologies

We use cookies and similar technologies for service functions such as authentication and remembering preferences, and, where enabled and lawful, to understand website use and support marketing.

We obtain consent before using advertising tracking and other technologies for which consent is required. Where we rely on a legal exception, we meet its conditions, including any required information and ability to object. We do not treat continued browsing as consent.

Our Cookie Policy explains the technologies used, their purposes, applicable durations and how to manage them. You can use the available cookie preference controls to change choices or withdraw consent. Browser controls may provide additional options, although blocking necessary technologies may affect service functions.

Marketing communications

We may use appropriate business contact information to send relevant information about Simana, including newsletters, feature announcements, events and invitations to provide feedback. We do so only where we have a lawful basis and meet the applicable electronic marketing requirements. Where consent is required, we obtain it before sending the communication.

You can stop our direct marketing at any time by using an unsubscribe link or contacting privacy@simana.com. We do not continue direct marketing to you after you object. We may keep a limited suppression record to respect your choice.

Service communications

We send communications needed to administer and secure the service and our relationship with you, such as security notices, billing messages and essential account information. These are distinct from promotional communications. Optional activity notifications depend on the available settings and your organisation's arrangements.

Advertising

We may work with advertising platforms and email delivery and analytics providers to promote Simana, measure campaign effectiveness and make our communications more relevant. These activities may involve cookies, tracking pixels and similar technologies that collect website interactions, device identifiers and information about email opens and link clicks. Email engagement information may be associated with your contact record. Where we use audience matching, we may share business contact identifiers, such as hashed email addresses, with advertising platforms to identify relevant audiences. Hashing does not make this information anonymous.

We obtain consent before using advertising tracking and, where required by law, email tracking or audience matching. You can change your choices or withdraw consent through the relevant preference controls or by contacting privacy@simana.com. You can stop marketing emails using their unsubscribe links.

Our Cookie Policy and relevant consent information provide further details about tracking providers, purposes, durations and choices. We do not use personal data processed on our customers’ behalf for unrelated advertising or audience matching.

7. How we share personal data

Providers acting on our instructions

We use providers for functions such as hosting, communications, support, security and business administration. Where they process personal data on our behalf, we require appropriate contractual safeguards and restrict their use to authorised purposes.

Where a provider processes Customer Personal Data while we act as a processor, it is our subprocessor. The operative list is our subprocessor register. Changes affecting Customer Personal Data follow the DPA's notice and objection process; updating the register alone does not replace that process.

Other recipients

We may share relevant personal data with:

Your organisation and authorised collaborators, according to their roles, permissions and sharing settings. Administrators may access or export information within their authorised scope. Any paid-plan limits on ordinary export features do not override the DPA's contractual return obligations or individuals' statutory rights.
Integrations selected by your organisation or you, where the integration is authorised. The integration's own privacy information and contractual arrangements may also apply.
Professional advisers and payment providers, where needed for the relevant advice, transaction or legal purpose. A recipient may act as an independent controller for its own legally defined or independently determined functions.
Advertising providers, only to the extent described in section 6 and subject to the applicable choices and safeguards.
Authorities or other recipients where lawfully required, following assessment of the request and applicable legal restrictions. For Customer Personal Data, the DPA's instruction, notification and transfer requirements continue to apply.
Parties to a potential or completed business transaction, where necessary for a lawful merger, acquisition, restructuring or asset transfer, with appropriate safeguards. Such a transaction does not remove applicable data protection duties or customer contractual protections.

We do not sell your personal data.

8. Storage locations and international transfers

The standard Simana application is hosted in AWS London, United Kingdom, with standard backup copies retained in the UK. A separately agreed deployment may have different specified locations. The applicable DPA and order form govern the agreed core hosting and backup locations for Customer Personal Data.

Other authorised providers may process information outside the UK, including in the United States or the European Economic Area. Core UK hosting does not mean that all support, communications, AI or other provider processing takes place in the UK. The subprocessor register identifies the listed processing locations for Customer Personal Data.

Before making a restricted international transfer, we ensure an appropriate legal route is in place. Depending on the transfer and applicable law, this may be an adequacy arrangement covering the actual recipient and processing, or appropriate contractual safeguards supported by the required assessment and any supplementary measures.

For UK restricted transfers, contractual safeguards may include the UK International Data Transfer Agreement (IDTA), or the European Commission's standard contractual clauses together with the UK International Data Transfer Addendum. EU restricted transfers may use the applicable EU standard contractual clauses. Other national requirements apply where relevant. These mechanisms are used where applicable to the actual transfer; listing them here does not mean every mechanism applies to every provider.

You can contact privacy@simana.com for information about the safeguards relevant to your personal data and to request a copy, subject to appropriate redaction to protect confidential information. Transfers of Customer Personal Data remain subject to the customer's documented instructions and DPA clause 9.

9. How we protect personal data

We apply technical and organisational measures appropriate to the nature of the information and the risks of processing it. These address matters such as access control, confidentiality, encryption, monitoring, supplier management, incident response, backups and secure deletion.

The DPA and its security schedule set out our contractual security commitments for Customer Personal Data. Information about our practices is available in the Simana Trust Centre.

No system can eliminate every security risk. This does not limit our data protection duties or our contractual security and incident-response obligations.

10. How long we retain personal data

Customer Personal Data processed on an organisation's behalf

During the service, we retain and process Customer Personal Data under the customer's documented instructions and the applicable DPA. The customer may give lawful deletion instructions during the service, subject to applicable requirements and agreed technical implementation.

When the relevant service ends, we return or securely delete Customer Personal Data in accordance with the customer’s instructions and the applicable Data Processing Addendum. Section 11 of the DPA explains the return options, deletion deadlines and limited arrangements for backups and retention required by law.

Our independent controller records

The service deletion timetable does not require us to delete separate business records that we lawfully hold as a controller.

We retain those records only for specified lawful purposes, using the following criteria:

Record category	Purpose and criteria determining retention
Business relationship contacts and correspondence	While needed for an active relationship or an identifiable, reasonable continuing business relationship purpose. We review former-customer contacts for continued relevance and delete or update information when the purpose no longer applies. Marketing objections and consent withdrawals are respected.
Contracts and transaction correspondence	For administration, outstanding obligations, complaints and relevant legal claims. Retention reflects applicable claims periods and any actual ongoing dispute, rather than indefinite retention of all correspondence.
Invoices accounting and tax records	For the period required by the accounting, tax or other recordkeeping duties applicable to the particular record. We retain the relevant financial evidence without using that obligation to retain unrelated workspace content.
Controller security and access records	For the period reasonably needed to detect and investigate misuse or incidents and protect our own systems, with a longer limited period where necessary for a specific incident or legal duty.
Marketing consent preference and suppression records	For the period needed to evidence the applicable permission and respect choices. Where necessary, a limited suppression record is kept after other marketing information is deleted so that we do not contact someone who has objected.
Privacy requests and complaints	For handling the request or complaint and retaining proportionate evidence of our response, taking account of relevant legal obligations and claims periods.

We keep only the information needed for the relevant purpose, apply documented retention arrangements and review continued necessity. We erase or irreversibly anonymise controller information when it is no longer needed. Retaining a record in an archive or backup remains processing and requires appropriate protection and justification.

We do not retain or repurpose Customer Personal Data as a controller merely by moving it to another system.

11. Your rights and choices

Which organisation handles your request

If your request concerns Customer Personal Data processed for your organisation, contact its administrator or privacy contact. It normally decides how the request should be answered. If you contact us first, we forward the request without undue delay and within three Business Days under the standard DPA, and assist the customer. We do not decide the substantive response on its behalf unless instructed or legally required.

If your request concerns information we hold as an independent controller, contact privacy@simana.com or write to the address in section 1. If you are unsure which applies, contact us and we will help identify the appropriate route.

Rights over your information

Depending on the applicable law and circumstances, you may have the right to:

Access your personal data and receive information about how it is used.
Correct inaccurate or incomplete personal data.
Request erasure where the relevant legal conditions are met.
Restrict processing in the circumstances provided by law.
Receive data you have provided in a structured, commonly used and machine-readable format, and request transmission to another controller where the portability conditions apply.
Withdraw consent for processing based on consent, without affecting the lawfulness of processing before withdrawal.
Object to processing, as explained separately below.
Complain to a supervisory authority.

These rights are subject to their applicable conditions and exemptions.

Your right to object

You can object at any time to use of your personal data for direct marketing, including related profiling. We will stop that use when you object.

Where we rely on legitimate interests for other processing, you can object on grounds relating to your particular situation. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims, as permitted by law.

Making and verifying a request

You do not need to use a prescribed form or legal wording. A request can be made verbally or in writing. We ask for additional information to verify identity only where necessary, using checks proportionate to the information and risk. Please do not send a passport, driving licence or financial document unless we explain why it is needed and how to provide it securely.

For requests we handle as controller, we respond without undue delay and normally within one month. Where the law allows an extension or adjustment, we explain the reason and relevant timing. Requests are normally free; any permitted fee or refusal is explained in accordance with applicable law. The DPA's three-Business-Day forwarding commitment is not the deadline for the controller's substantive response.

You may be able to update some account or profile information through Simana or your administrator. The availability of a self-service feature, a paid export tool or a current subscription does not limit your statutory rights. Contractual return through the DPA's export process is separate from an individual's rights request.

Complaints

We welcome the opportunity to address a concern, but you do not have to complain to us before contacting a supervisory authority. In the UK, you can contact the Information Commissioner's Office. Where EU GDPR applies, you may complain to the relevant authority, including in the country where you habitually live or work or where the alleged infringement occurred. The European Data Protection Board provides authority contact details.

12. Children and restricted information

Our standard websites and services are intended for organisational use and are not directed at children under 16.

The standard service is not authorised for patient-identifiable information, special-category personal data, criminal-conviction or offence data, or personal data of children under 16. Such use requires a prior written variation specifying the processing and safeguards. Please do not enter this information into workspaces, support materials or AI features unless the particular use has been expressly agreed.

If you believe restricted information has been submitted accidentally, contact privacy@simana.com. Accidental submission does not remove our confidentiality, security, assistance or deletion duties. We work with the customer to contain and address the issue under lawful instructions and the applicable DPA.

13. Third-party websites and services

Links and integrations may lead to websites or services operated by other organisations. Their own privacy information applies to processing for which they are responsible. Please review it before providing information directly to them. This does not remove our responsibilities for providers acting on our instructions or for disclosures we make. Those responsibilities are described in this policy and, for Customer Personal Data, the DPA.

14. Changes to this policy

We may update this policy to reflect changes in our practices or applicable requirements. We publish the revised policy with its effective date and provide additional notice of material changes where appropriate or required, for example by email or through the service.

A policy update does not itself provide consent, create a new lawful basis or authorise an incompatible new use of personal data. Where further information, consent or another legal step is required, we take it before the relevant processing begins.

For Customer Personal Data, this policy does not amend or override the DPA. Changes to the DPA, subprocessors and security measures follow their respective contractual processes. Your statutory rights and the customer's contractual rights continue to apply.

Previous versions