Privacy Policy
What we collect, why we collect it, how we treat information from accounts you choose to connect, and the choices you have.
Scope of this policy
This policy explains how we handle personal information in connection with this website and with the services we make available through it. It covers information you give us, information we collect automatically when you visit, and information we access from accounts you choose to connect.
Where we provide a service to an organisation and handle information on that organisation's instructions, the organisation decides how that information is used, and its own privacy notice governs. In that case we act on its behalf, and this policy describes our practices rather than replacing that notice.
Who we are
This website is operated by BQX, a limited liability company registered in Dubai, UAE. Where this policy says "we", "us" or "our", it means that company. Where we determine why and how personal information is handled, we are the controller of it.
You can reach us at the address in section 15.
Information we collect
We collect only what we need for the purposes described in section 5.
| Category | What it covers |
|---|---|
| Information you give us | Details you provide when you contact us or register for a service, such as your name, your email address, the organisation you represent, and the content of your message. |
| Account information | Where a service requires an account, the identifiers and settings needed to create and operate it, and a record of the permissions granted to it. |
| Technical information | Information your browser or device sends when it requests a page, such as an IP address, a browser and device type, a referring page, and the date and time of the request. Our hosting provider records this to deliver pages and to keep the service secure. |
| Service records | Records generated as a service operates, such as logs of significant actions, errors and security events, kept so we can run the service, support it and investigate problems. |
| Connected account content | Information we access from an account you have chosen to connect, described in section 4. |
We do not ask you for special categories of personal information, and we ask that you do not send them to us in an unsolicited message.
Accounts you connect
Some features work only if you choose to connect an account you already hold with another provider. This section explains, plainly, what that means. It is the part of this policy most worth reading closely.
Nothing happens until you authorise it
A connection is created only through the other provider's own sign-in and consent screen. That screen names the permissions being requested before you decide. We never ask you for the password to that account, and we never receive it.
We request the narrowest permissions the feature needs
We request only the permissions required for the features you have enabled, and no others. Where a feature reads information but does not need to change anything, we do not request permission to make changes, so no permission to make changes exists to be misused. Where you select a read-only level of access, permission to make changes is never requested at all.
What we do with the information, and what we never do
Information from a connected account is used only to provide the features you have enabled, and to support and secure them. Specifically:
- we do not sell it, and we do not share it for anyone's advertising or marketing
- we do not use it to build advertising profiles or to target advertising
- we do not use it to train general purpose artificial intelligence models
- we do not allow humans to read it, except with your explicit permission, where you ask us to investigate a problem, where it is necessary to address a security incident, or where the law requires it
- we do not transfer it to anyone else except as described in section 7
You can end a connection at any time
You can disconnect from within our service, or revoke our access directly from the other provider's own security settings. Once a connection ends we stop accessing the account, and we delete or de-identify the information we hold from it within the period described in section 9, except where we are required to keep a record for legal reasons.
Your organisation may decide instead of you
If the account belongs to an organisation, that organisation's administrator may control whether a connection can be made, may approve it on the organisation's behalf, and may revoke it. Your agreement with that organisation and with the provider governs those controls.
How we use information
| Purpose | What that means |
|---|---|
| Providing the service | Operating this site and delivering the features you have asked for, including those that depend on an account you have connected. |
| Support | Answering your questions, diagnosing faults, and telling you about a problem that affects you. |
| Security and integrity | Protecting the service, its users and the public against fraud, abuse, unauthorised access and misuse, and investigating incidents. |
| Service quality | Understanding whether the service works correctly, and improving its reliability and performance. We use aggregated or de-identified information for this wherever it will answer the question. |
| Administration | Managing accounts, billing where a service is paid for, and keeping records of the agreements we have entered into. |
| Legal obligations | Meeting obligations under law, responding to lawful requests, and establishing, exercising or defending legal claims. |
We do not use your information for automated decision making that produces a legal effect for you or that similarly significantly affects you.
Our legal grounds
Where data protection law requires us to identify a legal ground for handling personal information, we rely on one or more of the following: that it is necessary to perform a contract with you or to take steps at your request before entering one; that you have given consent, which you can withdraw at any time; that it is necessary for our legitimate interests in operating, securing and improving our service, where those interests are not overridden by your rights; and that it is necessary to comply with a legal obligation.
Where we rely on consent, withdrawing it does not affect anything done before you withdrew it.
When we share information
We do not sell personal information. We share it only in the following situations, and only to the extent needed:
- Service providers. Organisations that provide infrastructure and operational functions on our behalf, such as hosting, storage, communications delivery, payment processing where a service is paid for, and support tooling. They may handle personal information only on our documented instructions, under a written contract, and only to provide the function we engaged them for.
- Your organisation. Where you use a service through an organisation, the administrators of that organisation's account.
- Professional advisers. Our lawyers, auditors and insurers, where they are bound by a duty of confidentiality.
- Legal and safety. Where we are required to disclose by law, court order or a lawful request from a competent authority, or where disclosure is necessary to protect the rights, safety or property of any person. Where we are permitted to do so, we will tell you first.
- Corporate transactions. In connection with a merger, acquisition, financing or sale of assets, in which case the recipient remains bound by this policy or by a policy that offers equivalent protection.
We keep the list of organisations that handle personal information on our behalf under review, and we make it available on request to a customer who asks under a written agreement with us.
International transfers
We operate internationally, so personal information may be handled in a country other than the one you are in, including countries whose data protection laws differ from those of your own. Where we transfer personal information out of a jurisdiction that restricts such transfers, we do so using a lawful transfer mechanism recognised there, such as standard contractual clauses, together with additional safeguards where they are needed.
You can ask us for information about the safeguards that apply to a transfer relevant to you, using the contact address in section 15.
How long we keep it
We keep personal information only for as long as we need it for the purpose it was collected for, and then delete it or de-identify it.
How long that is depends on the information. Messages you send us are kept while we deal with them and for a reasonable period afterwards. Account information is kept for as long as the account is open. Information from a connected account is kept while the connection is active and is deleted or de-identified within a reasonable period after the connection ends. Security and service records are kept for a limited period appropriate to their purpose. Where a law requires us to keep a record for a set period, or where information is relevant to a legal claim, we keep it for as long as that requires and no longer.
Security
We use technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration and loss. These include encryption of information in transit and at rest, access controls that limit access to those who need it for their role, separation of customer environments, credential storage designed so that secrets are not readable in plain form, logging of significant actions, and review of our systems and practices.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will act on it and notify you and the relevant authority where the law requires us to.
You also have a part in this. Keep your credentials confidential, use a strong and unique password, enable multi factor authentication where it is offered, and review the connections and permissions on your accounts from time to time.
Your rights and choices
Depending on where you live, you may have some or all of the following rights in relation to your personal information:
- to ask for a copy of the information we hold about you, and information about how we use it
- to ask us to correct information that is inaccurate or incomplete
- to ask us to delete information, where there is no lawful reason for us to keep it
- to ask us to restrict how we use information, or to object to our use of it where we rely on our legitimate interests
- to receive information you gave us in a portable form, and to ask us to transmit it to another organisation where that is technically feasible
- to withdraw consent at any time, where we rely on consent
- to lodge a complaint with your local data protection authority
To exercise a right, write to us at the address in section 15. We may need to verify your identity before we act, so that we do not disclose your information to someone else. We answer within the period the applicable law requires, and we do not charge for a request unless the law allows us to. We do not discriminate against anyone for exercising a right.
If you use a service through an organisation, please send your request to that organisation. Where we hold the information on its behalf, we will refer your request to it and support it in responding.
Cookies and local storage
This website does not set cookies, does not run analytics, and does not embed advertising or third-party tracking.
If you turn off the ambient motion on the home page, that single preference is saved in your own browser's local storage so the site remembers it on your next visit. It stays on your device, it is not sent to us, and clearing your browser's site data removes it.
Where a separate BQX service uses cookies, for example a cookie that keeps you signed in, that service explains its use of cookies where you use it.
Children
This website and our services are intended for adults and for people acting for an organisation. They are not directed at children, and we do not knowingly collect personal information from a child. If you believe a child has given us personal information, write to us at the address in section 15 and we will delete it.
Changes to this policy
We may update this policy as our services change or as the law requires. When we do, we will change the effective date shown at the top of this page and publish the revised version here.
If a change materially affects how we handle your personal information, we will give you notice by a reasonable means before it takes effect, and where the law requires it we will ask for your consent.
Contact
Write to us with any question about this policy, any request about your personal information, or any concern about how we have handled it. If we cannot resolve your concern, you may complain to your local data protection authority.
We answer privacy questions and rights requests at this address.
privacy@bqx1.comSee also our terms of service, which govern your use of this site.