UK PRIVACY NOTICE

UK Privacy Notice

[ One Legal-approved sentence identifying the notice scope and controller/controller-group context. ]

AT-A-GLANCE PRIVACY SUMMARY

A plain-language map — never a substitute for the legally required detail

Who is responsible for your information

[ Exact controller wording. ]

Why information is processed

[ Approved purpose categories only. ]

Your rights / how to make a request

[ Approved route and wording. ]

International transfers / retention / contact

[ Only if an approved concise summary can remain accurate across relationships. ]

Who We Are / Controller Identity

Controller identity
[ Exact Legal-approved entity/entities and role wording. ]
Corporate relationship
[ Brand/entity relationships from the approved Legal Entity Registry only. ]
Address/contact
[ Approved public contact details only. ]
DPO / privacy lead
[ Shown only if Legal has approved a DPO/privacy contact disclosure — never assumed to exist. ]
Data processor references
ZoikoSuite or customers are labeled controller/processor in a specific context only where approved notice copy supports it.

Scope & Applicability

Covered services
[ Exact services/surfaces from the Service Scope Registry. ]
Audience/relationship
[ Approved visitor/customer/user/prospect scope, only if applicable to this public notice. ]
Geographic scope
Applicability is never inferred solely from IP/device location.
Relationship to Privacy Policy
[ Legal-approved explanation of how this notice supplements or forms part of the wider Privacy Policy. ]

Personal Data Categories & Sources

Category
[ Legal-approved data category from processing records. ]
Examples
[ Approved representative examples only — never raw user values. ]
Source categories
[ Direct from user, account/admin, device/system, partner/vendor, or public source — only if approved. ]
Special-category / criminal-offence flags
Governed separately — never inferred from a label or data type.

Purposes & Legal Bases Matrix

⇄ Swipe horizontally to view all columns
Purpose
Personal data involved
Legal basis
Recipient/transfer link
State
[ Approved purpose ]
[ Approved category IDs ]
[ Exact approved basis wording ]
[ optional ]
[ Approved/ Conditional ]
[ Approved purpose ]
[ Approved category IDs ]
[ Exact approved basis wording ]
[ optional ]
[ Approved/ Conditional ]

Legitimate Interests

Conditional — rendered only when approved processing records identify relevant legitimate-interest processing and Legal approves public detail.

Interest description
[ Legal-approved plain-language interest — no Product-authored rationale. ]
Balancing / safeguards
[ Only approved summary — internal privileged analysis is never exposed. ]
Opt-out / objection route
[ Only if the approved Rights Registry provides an applicable path. ]

Special-Category / Criminal-Offence Data

Conditional and Legal-controlled. If not applicable, this section is omitted or renders an approved neutral statement — it never claims "none" without confirmation.

The template never infers the legal condition from the category alone — purpose, basis, and condition all require exact Legal-approved wording.

Recipients & Disclosures

Recipient category
[ Approved category label. ]
Purpose/reason
[ Approved disclosure reason. ]
Subprocessor link
Uses the approved Subprocessor List only where relevant — never equates all recipients with subprocessors.
Third-party names
Vendor names are never added unless approved notice/data-governance records require and authorize them.

International Transfers

Transfer applicability
Governed state from the Transfer Registry — unknown blocks the required disclosure.
Destination description
[ Approved countries/regions/categories only — never inferred from vendor marketing. ]
Safeguard / mechanism
[ Exact Legal-approved wording — adequacy, SCCs, or binding rules are never assumed. ]

Retention

Uses an approved duration only when Legal/data governance provides one; otherwise uses approved criteria. Retention can vary — the structured mapping is shown rather than one blanket duration. An unknown state blocks the required row rather than falling back to generic "as long as necessary" filler.

Automated Decision-Making / Profiling

Conditional and Legal-controlled. State is approved-none / approved-applicable / conditional / unknown-blocked — all public wording from Legal only.

Regulated automated decision-making is never inferred merely because Responsible AI or AI features exist elsewhere on the platform.

UK Privacy Rights

Sourced from the Rights & Requests Registry tied to this notice's current version.

[ Exact Legal-approved right label ]

Who may use it: [ Approved eligibility/scope statement. ]

What it does: [ Legal-approved plain-language description. ]

Limitations: [ Only approved legal language. ]

[ Exact Legal-approved right label ]

Who may use it: [ Eligibility statement ]

What it does: [ Description ]

Response/status timing is published only as approved operational/legal wording — no invented SLA. Complaint/escalation is conditional and Legal - approved.

How to Submit a Privacy Request

Primary route
Consumer Rights Request / UK privacy request route — exact approved URL only.
Sign-in
Marketing account creation is never required; authentication only if the approved request process requires it.
Verification
High-level, privacy-preserving explanation only.
Request receipt
Controlled by the request system — no invented promise on this page.

Security vulnerabilities route to the approved Security Disclosure channel, never to privacy request intake.

Complaints / Supervisory Authority

Internal complaint route
Approved privacy contact/complaint route and wording only.
Supervisory authority
[ Legal-approved authority name/link/address/telephone only if approved for publication — never hard- coded from template knowledge. ]
Sequence
A contact-us-first requirement is never imposed unless Legal approves it.

This section provides route information, not legal advice or a guarantee of regulatory outcome.

Children, Cookies & Security / Responsible AI

Children / minors
Conditional — publishes only counsel-approved scope, age-related wording, and request/consent mechanics; no threshold assumptions.
Cookie Policy
Contextual approved link — this notice avoids duplicating a volatile cookie inventory.
Security Disclosure
Contextual link only, describing safeguards with approved wording — never a guarantee.
Responsible AI
Contextual link where this notice references AI-related processing — no invented training/ADM/profiling claims.
Data Processing Agreement
Linked for enterprise/procurement context where approved — never presented as a consumer rights mechanism.

Contact

Uses the approved public privacy contact route/details only — this page never invents a privacy@ email, postal address, DPO name, or phone number.

Frequently Asked

[ One concise answer sourced from approved scope/controller text. ]

Use the same approved request route and wording shown in the rights section above.

Answered only from approved purpose/legal-basis content — never a general-law explanation detached from product truth.

Answered only when current approved transfer disclosure supports a safe, accurate summary.

Uses the same approved internal/regulator wording and links as the complaints section above.

Related Legal Destinations