Privacy & Data Protection Policy
Enterprise-grade data protection compliant with global security standards
Last Updated: January 3, 2025 | Effective Date: January 1, 2025
Privacy Policy Overview
Effective Date: January 1, 2025
Last Reviewed: January 3, 2025
This Privacy Policy describes how Reputfy Limited ("Reputfy," "we," "us," or "our") collects, uses, discloses, and protects personal information in accordance with global data protection standards including ISO/IEC 27001:2013, SOC 2 Type II, HIPAA, PCI DSS, GDPR, CCPA, and UK DPA 2018.
Key Compliance Standards
- ISO/IEC 27001:2013 - Information Security Management Systems
- SOC 2 Type II - Service Organization Control (Security, Availability, Confidentiality)
- HIPAA - Health Insurance Portability and Accountability Act
- PCI DSS - Payment Card Industry Data Security Standard
- GDPR - General Data Protection Regulation (EU)
- CCPA/CPRA - California Consumer Privacy Act
Information We Collect
We collect personal information to provide and improve our services. All data collection complies with data minimization principles under GDPR Article 5.
Personal Information (PII)
- Full name, email address, phone number
- Company name and business details
- Job title and professional information
- Billing and shipping address
Financial Information (PCI DSS Compliant)
Payment card details are processed through our PCI DSS Level 1 certified payment processor (Stripe). We never store complete credit card numbers on our servers.
- Billing address and transaction history
- Invoice information
- All payment data encrypted with TLS 1.3
Protected Health Information (PHI) - HIPAA
For healthcare clients:
- We operate as a Business Associate under HIPAA
- PHI encrypted at rest (AES-256) and in transit (TLS 1.3)
- Role-based access controls (RBAC) enforced
- Comprehensive audit logs for all PHI access
- Business Associate Agreements (BAA) available
Security Measures & Controls
We implement enterprise-grade security controls aligned with ISO 27001 and SOC 2 Type II:
Encryption Standards
- ✓ AES-256 encryption at rest
- ✓ TLS 1.3 in transit
- ✓ AWS KMS key management
Access Controls
- ✓ Multi-factor authentication (MFA)
- ✓ Role-based access control (RBAC)
- ✓ IP whitelisting available
Network Security
- ✓ Web Application Firewall (WAF)
- ✓ DDoS protection
- ✓ Regular penetration testing
Monitoring
- ✓ 24/7 security monitoring
- ✓ SIEM system
- ✓ 72-hour breach notification
Your Privacy Rights (GDPR)
Under GDPR and UK DPA 2018, you have the following rights:
Right to Access (Article 15)
Request a copy of all personal data we hold about you. Response within 30 days.
Right to Rectification (Article 16)
Correct inaccurate or incomplete personal data at any time.
Right to Erasure / "Right to be Forgotten" (Article 17)
Request deletion of your personal data, subject to legal retention requirements.
Right to Data Portability (Article 20)
Receive your data in JSON or CSV format for transfer to another provider.
Right to Object (Article 21)
Object to processing for direct marketing or legitimate interests.
California Privacy Rights (CCPA/CPRA)
Your CCPA Rights
- Right to Know: Request disclosure of personal information collected
- Right to Delete: Request deletion of personal information (45-day response)
- Right to Opt-Out: Opt-out of sale (we don't sell data)
- Right to Non-Discrimination: No discrimination for exercising rights
- Right to Correction: Request correction of inaccurate information (CPRA)
- Right to Limit: Limit use of sensitive personal information (CPRA)
Submit a CCPA Request
To exercise your CCPA rights, you can contact us through any of the following methods:
We will verify your identity before processing your request and respond within 45 days of receipt.
Data Retention & Deletion
| Data Type | Retention Period |
|---|---|
| Account Information | Duration + 30 days |
| Financial Records | 7 years (legal requirement) |
| Usage Analytics | 26 months |
| Audit Logs | 7 years (ISO 27001/SOC 2) |
Data Breach Notification
In the event of a data breach:
- Within 24 hours: Internal incident response activated
- Within 72 hours: Regulatory authorities notified (GDPR/HIPAA)
- Without undue delay: Individual notification via email if high risk
- Post-incident: Root cause analysis and corrective actions
Contact & Data Protection Officer
Data Protection Officer
Email: dpo@reputfy.com
Phone: +44 20 3476 5667
CCPA Compliance Officer
Email: ccpa@reputfy.com
Phone: +44 20 34765667
Company Information
Reputfy
124 City Road
London, EC1V 2NX
United Kingdom
Response Times
GDPR/CCPA Requests: 30 days
General Inquiries: 2 business days
Security Incidents: 24 hours
Legal Notice & Governing Law
This Privacy Policy is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of London, England.
Last Reviewed: January 3, 2025 | Next Review: July 2025