Privacy, Data Processing & Cookie Policy
REMINDOO LIMITED
12 London Road, Morden, England, SM4 5BQ · Company Number: 16910665 · ICO: ZC099417
Version: 3.0 Effective Date: 27 September 2026
This document combines three related parts:
Part A, Privacy Notice (how we handle personal data as Controller)
Part B, Data Processing Agreement (our obligations as Processor of your client data, satisfying Article 28 UK GDPR)
Part C, Cookie Policy (cookies and similar technologies on our website)
We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). We are registered with the ICO (registration ZC099417).
PART A, PRIVACY NOTICE
1. Introduction
REMINDOO LIMITED ("Remindoo", "we", "our", "us") is committed to protecting personal data and respecting privacy. This Notice explains how we collect, use, store, share and safeguard personal data when you visit www.remindoo.co, register for or use the Remindoo platform, request a demo, subscribe, or contact us.
2. Who We Are and Our Roles
We act as Data Controller for website visitors, marketing contacts, demo/enquiry submissions, account holders, billing contacts and support interactions.
We act as Data Processor when our customers (such as accounting firms) use the Platform to manage their own clients' data, in which case the customer is the Controller and our processing is governed by Part B (DPA).
We do not use customer-controlled client data for our own marketing or commercial purposes, and we do not sell or rent personal data.
3. Personal Data We Collect
3.1 Data you provide (we are Controller): full name, job title, company name, email, telephone, billing address, payment details, login credentials, and the content of communications and support requests.
3.2 Customer-controlled platform data (we are Processor): where you use Remindoo, the Platform may store client names and contacts, financial and tax records, compliance and AML records, identification information, uploaded documents, service notes and communications. This data is controlled by our customer. Where it includes special category data or criminal-offence-related data (for example arising from AML, PEP or sanctions checks), the customer is responsible for ensuring an appropriate condition under Articles 9/10 UK GDPR, and we process it only on the customer's documented instructions under Part B.
3.3 Automatically collected data (we are Controller): IP address, browser type/version, device and operating-system information, usage statistics, log files and cookie data (see Part C).
4. Lawful Bases for Processing
| Purpose | Lawful basis |
|---|---|
| Providing/maintaining the Platform; subscriptions, billing, authentication | Performance of a contract |
| Customer support | Contract / legitimate interests |
| Service improvement, analytics, fraud prevention, network and information security | Legitimate interests |
| Legal, accounting, tax and regulatory compliance | Legal obligation |
| Marketing communications | Consent and/or legitimate interests (soft opt-in), subject to PECR |
Where we rely on legitimate interests (including improving our website/services, understanding usage through aggregated and depersonalised analysis, risk assessment, and fraud prevention), we have assessed that those interests are not overridden by your rights; you may request details.
5. How We Use Personal Data
To provide and maintain the Platform; manage subscriptions and billing; authenticate users; provide support; improve functionality and security; prevent fraud; send service updates; invite feedback; and comply with legal obligations.
6. Marketing Communications
Where permitted, we may send service updates, product announcements and marketing by email and, where you have consented, by SMS or WhatsApp, in accordance with PECR. You may opt out at any time via the unsubscribe link, by replying STOP, or by contacting us. We action opt-outs promptly and keep a suppression record so we do not re-contact you.
7. AI Features and Third-Party AI Providers
The Platform includes AI functionality (e.g. task/client summaries, email suggestions, workflow recommendations). These are assistive and do not make autonomous legal, tax or compliance decisions. AI outputs may be inaccurate, incomplete or "hallucinated", must be independently verified before reliance, and are used at your own risk; we accept no responsibility for AI outputs (see clause 10 of our Terms and Conditions).
We do not use customer data to train public AI models.
Where AI features are powered by third-party providers, certain inputs may be processed by them solely to generate the requested output, under contracts that prohibit training their models on that data beyond producing the output.
You remain responsible for ensuring lawful authority to submit any personal data to AI features.
Under UK GDPR you have the right not to be subject to a decision based solely on automated processing producing legal or similarly significant effects; our AI tools do not make such decisions.
8. Data Sharing and Sub-processors
We share personal data with trusted service providers acting on our behalf, including cloud hosting/infrastructure, payment processors, email delivery, analytics, AI providers, support tooling and review platforms. All are bound by written contracts requiring them to protect personal data, process it only on our instructions, and not use it for their own purposes..
We may also disclose data where required by law; to co-operate with police or regulatory investigations or legal proceedings; to establish, exercise or defend legal rights (including fraud prevention); or in connection with a merger, acquisition or sale, subject to appropriate safeguards.
9. International Data Transfers
Where personal data is transferred outside the UK, we ensure an appropriate safeguard: a UK adequacy decision; the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; supported by a transfer risk assessment where required. You may request details of the safeguard used for a specific transfer.
[CONFIRM] State actual destinations (e.g. UK/EU hosting; USA for [AI provider]). Any provider in a country without UK adequacy (note: this would include any China-based AI provider) requires the IDTA plus a transfer risk assessment.
10. Data Security
We implement appropriate technical and organisational measures, including: encryption in transit (SSL/TLS); secure cloud infrastructure; role-based access controls; authentication and passwords; multi-factor authentication (where enabled); monitoring and audit logging; and staff confidentiality obligations. No system can guarantee absolute security. Where we act as Processor and become aware of a Personal Data Breach affecting customer-controlled data, we notify the affected customer (Controller) without undue delay (see Part B).
11. Data Retention
| Data | Retention |
|---|---|
| Account and contract records | Duration of contract + 6 years |
| Billing and financial records | 6 years from end of relevant financial year |
| Marketing contact data | Until opt-out, or 24 months of inactivity |
| Website, analytics and cookie data | Per Part C (up to 26 months) |
| Support communications | Duration of contract + 2 years |
| Customer-controlled platform data (as Processor) | Returned/deleted within 30 days of termination unless retention required by law |
After the applicable period, data is securely deleted or anonymised.
12. Your Data Protection Rights
You have the right to: access; rectification; erasure; restriction; objection; data portability; and to withdraw consent where processing is consent-based. To exercise these, contact hello@remindoo.co. We respond within one month (extendable by two for complex requests), normally free of charge, and may verify your identity first. If we hold your data as Processor on behalf of a customer (e.g. you are a client of an accounting firm using Remindoo), please direct your request to that firm; we will assist them.
13. Children
The Platform and website are for business users and are not directed at children; we do not knowingly collect children's data through our own processing.
14. Responsibility Split
Where we act as Processor we are not responsible for data unlawfully collected by a customer, customer misuse of the Platform, customer-side security failures, or incorrect or misleading data uploaded by a customer. Customers are responsible for lawful collection and processing of data uploaded to the Platform.
15. Complaints
Please contact us first. You may also complain to the ICO: https://ico.org.uk · 0303 123 1113.
16. Changes and Contact
We may update this Notice; changes take effect on publication and we will flag material changes prominently. Contact: REMINDOO LIMITED, 12 London Road, Morden, England, SM4 5BQ; hello@remindoo.co; ICO ZC099417.
PART B, DATA PROCESSING AGREEMENT
This DPA forms part of, and is incorporated into, the Remindoo Terms and Conditions (the "Agreement") and is entered into automatically when the Customer accepts the Agreement. It is designed to satisfy Article 28 UK GDPR. Where it conflicts with the Agreement on data-protection matters, this DPA prevails.
B1. Roles and Scope
B1.1 In respect of Client Data, the Customer is the Controller and Remindoo is the Processor. The details of processing are in Annex 1.
B1.2 Each party shall comply with its obligations under UK data-protection law.
B2. Processor Obligations
Remindoo shall:
(a) Documented instructions, process Client Data only on the Controller's documented instructions (including for transfers), unless required by law, in which case it will inform the Controller first (unless prohibited). The Agreement, this DPA and use of the Platform's features are the Controller's documented instructions.
(b) Unlawful instructions, inform the Controller if, in its opinion, an instruction infringes data-protection law.
(c) Confidentiality, ensure persons authorised to process are bound by confidentiality.
(d) Security, implement the Article 32 measures in Annex 2.
(e) Sub-processors, engage sub-processors only per clause B3.
(f) Data-subject rights, assist the Controller, by appropriate technical and organisational measures and insofar as possible, to respond to data-subject requests.
(g) Compliance assistance, assist the Controller with Articles 32–36 (security, breach notification, DPIAs, prior consultation), taking into account the nature of processing and information available.
(h) Deletion or return, at the Controller's choice, delete or return all Client Data at the end of services and delete copies, unless storage is required by law. The Platform allows export for 30 days post-termination, after which Client Data is deleted or anonymised.
(i) Records and audits, make available information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits per clause B6.
B3. Sub-processors
B3.1 The Controller gives general authorisation for Remindoo to engage sub-processors (such as hosting/infrastructure, email delivery, payment processing, analytics, support tooling and AI providers).
B3.2 Remindoo will give at least 14 days' notice of any intended addition or replacement, allowing the Controller to object on reasonable data-protection grounds. If unresolved, the Controller may terminate the affected service.
B3.3 Remindoo will impose data-protection terms equivalent to this DPA on each sub-processor and remains liable for their performance.
B4. International Transfers
B4.1 Remindoo will not transfer Client Data outside the UK except under an appropriate safeguard (UK adequacy, IDTA, or UK Addendum to the EU SCCs), supported by a transfer risk assessment where required.
B5. Personal Data Breach
B5.1 Remindoo will notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting Client Data, and provide information reasonably required for the Controller's own notification obligations, and take reasonable steps to mitigate and remediate.
B6. Audit
B6.1 Remindoo will respond to reasonable information requests and make available relevant certifications or third-party audit reports. On-site audits may occur up to once per year (or following a material breach or regulator requirement), on reasonable notice, during business hours, subject to confidentiality and minimal disruption, at the Controller's cost.
B7. Liability and Term
B7.1 Liability under this DPA is subject to the limitations in the Agreement, except where UK GDPR provides otherwise. This DPA continues while Remindoo processes Client Data; clauses intended to survive do so.
Annex 1, Details of Processing
Subject-matter: provision of the Remindoo platform.
Duration: the Subscription Term plus the deletion/return period in B2(h).
Nature and purpose: hosting, storage, organisation, retrieval, display, summarisation (including via AI features) and processing of Client Data to provide the Platform on the Controller's instructions.
Types of Personal Data: names, contact details, job titles; financial and tax records; compliance and AML records; identification information; uploaded documents; service notes and communications. May include special category and criminal-offence-related data where the Controller uploads it.
Categories of Data Subjects: the Controller's clients and their representatives; the Controller's staff and Authorised Users; and other individuals whose data the Controller uploads.
Annex 2 — Technical and Organisational Security Measures
Encryption in transit (TLS) [and at rest, CONFIRM]; secure access-controlled cloud hosting [CONFIRM provider/region]; role-based, least-privilege access; password policies and MFA (where enabled); monitoring, audit logging and alerting; backups and documented restore procedures; staff confidentiality undertakings and data-protection awareness; vulnerability management and patching [CONFIRM cadence]; logical multi-tenant separation; documented incident response and breach-notification procedures.
PART C, COOKIE POLICY
C1. About Cookies
Cookies are small files placed on your device when you visit a website; "similar technologies" include pixels, tags, web beacons and local storage. They help a site function, remember preferences, measure performance and support marketing.
C2. Categories of Cookies
| Category | Purpose | Consent required |
|---|---|---|
| Strictly necessary | Core functionality, security, load balancing (e.g. Cloudflare), form submission | No (legitimate interests) |
| Preference / functional | Remember settings; embedded form/widget tools (e.g. GoHighLevel/LeadConnector) | Yes |
| Statistics / analytics | Understand usage to improve the site (e.g. Google Analytics, if used) | Yes |
| Marketing / tracking | Measure and target advertising; includes the Meta (Facebook) Pixel | Yes |
C3. Legal Basis and Consent
C3.1 The legal basis for strictly necessary cookies is our legitimate interest in operating the website and services. The legal basis for all non-essential cookies (preference, statistics, marketing) is your consent, which you may withdraw at any time.
C3.2 We obtain your consent before any non-essential cookie is placed on your device, via our cookie banner, which offers equally prominent options to accept or reject and lets you choose categories. You can change your choices any time via the "Cookie Settings" link in the website footer.
C4. Specific and Third-Party Technologies
Meta (Facebook) Pixel, advertising measurement and audience building (marketing; consent required).
GoHighLevel / LeadConnector, embedded forms, chat/booking widgets (functional).
Cloudflare, security and performance (strictly necessary).
[Analytics provider, if used], usage measurement (statistics).
Embedded third-party content (e.g. YouTube, X/Twitter, LinkedIn) may set its own cookies under that provider's policy; blocking them may stop some content working.
[CONFIRM] Run a cookie scan via your consent platform to produce a precise, dated cookie table (names, providers, durations).
C5. Managing Cookies, Retention, Changes
C5.1 Manage non-essential cookies via our banner/"Cookie Settings". Browser controls also exist, but blocking strictly necessary cookies may affect functionality, and browser settings alone are not a substitute for our consent banner.
C5.2 Cookie data is retained per the lifespan of each cookie (up to 26 months) or until consent is withdrawn.
C5.3 We may update this Policy and the cookies deployed; please check periodically.
C6. Contact
hello@remindoo.co · REMINDOO LIMITED, 12 London Road, Morden, England, SM4 5BQ.
Note: Professional-grade draft for solicitor sign-off. Part C is only effective if paired with a live consent banner that blocks non-essential cookies (especially the Meta Pixel) until opt-in, install a consent management platform (e.g. Complianz, CookieYes, Cookiebot). Confirm all bracketed items before publishing.