Privacy Policy

This policy covers two audiences: visitors to our public marketing site (scpase.co.uk), and staff, students, guests, and administrators who use an SCPASE workspace provisioned for an organization (a “customer”).

For most of the data described below, your organization is the data controller and Techytal Ltd (“we”, “us”) is its data processor. We handle it on your organization's instructions, under its own agreement with us, and you should also check your organization's own privacy notice. For marketing-site visitor data (leads and site analytics, described below), Techytal is the data controller in its own right.

Account and identity data: your name and email address, resolved from the Google or Microsoft account you sign in with (or set by your administrator for a guest account), plus your role, department, and any room/desk assignments your organization configures. Used to operate your account and enforce who can see and do what.

Booking data: the rooms or desks you book, their time, purpose, attendee count, and any custom questions your organization has configured. Used to run the booking system itself and to give your organization visibility into its own space usage.

Admin and audit data: a record of booking decisions (who approved, rejected, or cancelled what, and when) and administrative actions taken on your account. Used for accountability within your own organization and, where relevant, to investigate misuse.

Optional Microsoft Graph integration data: if your organization turns this on, either you personally (connecting your own Outlook calendar) or your organization's IT administrator (a tenant-wide, app-only consent grant) authorizes us to read basic profile information, read/write calendar events, check for an out-of-office marker on your calendar, and send Microsoft Teams activity notifications. This is used only to sync bookings to your calendar or to remind staff who haven't booked a desk yet, and never happens unless your organization has explicitly enabled it.

Occupancy / location signal: if your organization turns on IP-based occupancy detection, the IP address your device connects from is compared, in the moment, against your organization's own declared office IP range to confirm you're physically present for a desk check-in. We don't otherwise log or retain this IP address.

Support data: anything you submit through the in-app helpdesk (subject, message, priority), optionally mirrored to Freshdesk if your organization or we have that configured.

Marketing-site data: if you submit the “Request a demo” form, we collect your name, work email, company, approximate team size, and message, protected by Cloudflare Turnstile to filter out automated submissions. We use it only to respond to your enquiry, nothing else.

Analytics cookies: if you accept our cookie banner, Google Analytics 4 records anonymized/pseudonymized usage of our marketing site (not the signed-in product), shared across Techytal's own family of sites for consistent attribution if you arrive from one of them. Nothing is set until you accept, and you can withdraw that choice at any time by clearing this site's local storage/cookies in your browser, which brings the banner back.

For account, booking, and admin/audit data: performance of our contract with your organization, and your organization's own legitimate interest in managing its spaces and staff/students.

For the optional Graph and occupancy features: your organization's own explicit, separately granted consent (via its administrator), which it can withdraw at any time by turning the feature back off.

For marketing-site leads: our legitimate interest in responding to enquiries you've chosen to send us.

For analytics cookies: your own consent, given via the cookie banner, which is never assumed.

Booking and admin-action records function as an audit trail, not just current state: editing or cancelling a booking adds a new record rather than deleting the old one, so a complete history is retained indefinitely for your organization's own accountability and audit needs, even after the booking itself is no longer active.

A practical consequence of this: if you have any booking history, your account can be disabled (immediately ending your access) rather than fully deleted, since deleting it would mean deleting records your organization is entitled to keep. An account with no booking history can be deleted outright on request.

Other data (support tickets, marketing-site leads, analytics) is kept for as long as reasonably needed for the purpose it was collected for, or as your organization instructs.

Our database, authentication, and file storage (Supabase) and our application hosting (Vercel) both run in the EU (Frankfurt), chosen deliberately to keep performance fast and personal data within the EU/UK by default.

Some of our sub-processors (listed below) are based outside the UK/EEA. Where that applies, we rely on that provider's own recognized international-transfer safeguard (such as the UK/EU Standard Contractual Clauses) before any personal data is transferred to them.

We don't sell personal data, to anyone, ever.

We share it only with the sub-processors needed to run the Service, and with your own organization's administrators as part of normal product operation:

• Supabase - database, authentication, and file storage
• Vercel - application hosting
• Resend - transactional email delivery
• Cloudflare - Turnstile bot protection on our public lead form
• Microsoft - sign-in, and Microsoft Graph for any optional calendar/Teams integration your organization enables
• Google - sign-in, and Google Analytics for consent-gated marketing-site analytics
• Freshdesk - optional helpdesk ticket mirror, only where configured

We may also disclose personal data where required by law, or to protect the rights, safety, or property of Techytal, our customers, or others.

Access to data within the Service is enforced at the database layer (row-level security), not just in the application, and is scoped to the admin tier and room/desk assignments your organization configures. Connections to the Service are encrypted in transit, and sensitive tokens (such as calendar-sync credentials) are encrypted or hashed at rest rather than stored as plain text.

No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable technical and organizational measures proportionate to the data involved.

Subject to the retention note in section 4, you have the right to ask for access to, correction of, or erasure of your personal data, to restrict or object to its processing, to receive a copy in a portable format, and to withdraw consent where we rely on it.

If you're a staff member, student, or guest of one of our customer organizations, please contact that organization's own administrator first, since it's usually the data controller for your account. You can also contact us directly at info@scpase.co.uk and we'll route your request appropriately.

If you're in the UK or EU, you also have the right to complain to your local data protection authority. In the UK, that's the Information Commissioner's Office (ico.org.uk).

SCPASE is intended for use by staff, students, and guests of our customer organizations, acting under that organization's own authorization. It is not directed at, and we do not knowingly collect personal data from, children under 13.

We may update this policy from time to time. We'll post the updated version here with a new “Last updated” date, and where a change is material we'll make a reasonable effort to notify affected organizations directly.

Questions about this policy, or a data-rights request, can be sent to info@scpase.co.uk.