Privacy Policy

1. Who controls your data

The data controller is Fusia Tech Ltd, registered in United Kingdom (company number 16871848), registered office 24-26 Regent Place, Birmingham, England, B1 3NJ.

Privacy enquiries and rights requests: privacy@fatberrydsp.com.

We have not appointed a Data Protection Officer, and are not required to. If that changes, or if an EU or UK Article 27 representative is appointed, their details will be published in this section. Until then, address every data-protection question to privacy@fatberrydsp.com.

2. What we collect

We do not receive or store full card numbers. Card details are entered into our payment processor and never reach our servers.

Browser notifications are optional. Use the notification controls near the footer to change topics or switch them off, or revoke notification permission in your browser. Your browser provider operates the push delivery service.

• Account data, name, email address, hashed password, account creation date.
• Order data, products purchased, amounts, currency, billing country, VAT status, invoice records.
• Licence data, licence keys, activation count, and the machine identifiers used for activation.
• Support data, the content of support tickets and any correspondence you send us.
• Newsletter data: your email address and subscription state when you subscribe. Separately, for relevant professional business introductions, we may record your name, role, organisation, publicly published professional contact details, the first-party source, the reason the proposed product or partnership relates to your work, and correspondence and delivery outcomes. We do not enrol researched professional contacts into our newsletter.
• Browser notification data, only if you enable notifications: your browser push endpoint and encryption keys, selected topics, consent and unsubscribe records. An email address is not required. Subscription details are encrypted in our database.
• Technical data: IP address, user agent, and request logs generated when you use the site.
• Optional Google Analytics data, only if you allow analytics: browser and device information, public pages visited, product and cart interactions, campaign identifiers, and purchase reference, products, currency, tax and value. We do not send your name, email address, licence keys or payment credentials to Google Analytics.
• Product-video playback, only after you press play on a YouTube-hosted film: YouTube’s privacy-enhanced player receives your IP address and player interactions under its own terms. We do not receive a playback profile from YouTube.

3. Why we process it, and on what legal basis

• To supply what you bought, issue licences and provide support, performance of a contract.
• To keep invoices and tax records, legal obligation (UK and EU tax law, generally six years).
• To detect fraud, enforce licence terms and secure the service, legitimate interests.
• To send newsletter product marketing, consent, which you can withdraw at any time. To research and send a relevant professional business introduction where applicable electronic-marketing rules permit it, legitimate interests in developing relevant business relationships. We assess professional relevance and the effect on the recipient, respect any published contact restrictions, and obtain consent where it is required. You may object to direct marketing at any time.
• To run affiliate referral tracking, legitimate interests, and consent where cookies are used.
• To measure website visits and shopping activity through Google Analytics, your consent. You can decline or withdraw through Analytics preferences without affecting your shopping.

4. Who else processes your data

We use the following processors. Their roles are described below; contact us for applicable data-protection and transfer information.

• OVHcloud, VPS hosting, application and database storage, and installer delivery. Shared: Account, order, licence and service data stored on our server. Processing location: Germany (the existing OVH DE2 VPS); hosting data-protection and transfer terms apply.
• Google (Google Analytics 4), Optional website and ecommerce analytics, only after visitor consent. Shared: Browser/device information, public page/campaign identifiers, product interactions, purchase references and amounts; no customer names, emails or payment credentials. Processing location: Google processing infrastructure; see https://policies.google.com/technologies/partner-sites and https://business.safety.google/adsprocessorterms/.
• Stripe, Card payment processing and fraud screening; sales-tax calculation where enabled. Shared: Name, email address, billing address, card details (collected directly by Stripe). Processing location: Stripe service infrastructure; contact us for the processing and transfer information applicable to your transaction.
• Microsoft (Microsoft 365 / Exchange Online), Delivery of professional email through our Microsoft sender. Shared: Recipient name and email address, message content and delivery metadata. Processing location: Microsoft 365 service processing locations; Microsoft contractual data-protection and transfer terms apply.
• Resend, Email delivery fallback and permitted subscribed messages. Shared: Recipient address, message content and delivery metadata. Processing location: Service processing locations; contact us for applicable transfer information.
• Keygen, Software licence and activation management. Shared: Account identifiers, licence entitlement and device activation metadata. Processing location: Service processing locations; contact us for applicable transfer information.

5. International transfers

Where a processor operates outside the UK or EEA, transfers rely on UK adequacy regulations, the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses, together with supplementary technical measures such as encryption in transit and at rest.

You can request a copy of the relevant transfer safeguards from privacy@fatberrydsp.com.

6. How long we keep it

• Order and invoice records, six years from the end of the tax year in which the order was placed.
• Account and licence records, for as long as the account is open, then 12 months.
• Support tickets: 24 months from the last message.
• Marketing subscriptions, until you unsubscribe, then a suppression record only.
• Professional-contact research and correspondence records are kept only for as long as necessary to assess and carry out the relevant business approach, record its outcome, and meet applicable obligations. We retain the minimum suppression and identity-history information needed to honour objections and prevent duplicate approaches.
• Server request logs: 90 days.

7. Your rights

Under the UK GDPR and EU GDPR you have the right to:

• Access, obtain a copy of the personal data we hold about you.
• Rectification, have inaccurate data corrected.
• Erasure, have data deleted where we no longer have a lawful reason to keep it. Tax records are an exception.
• Restriction, ask us to pause processing while a dispute about accuracy or legitimate interest is resolved.
• Portability, receive your account, order and licence data in a machine-readable format.
• Objection, object to processing based on legitimate interests, and to direct marketing at any time and without giving a reason.
• Withdraw consent, for anything we do on the basis of consent, without affecting processing already carried out.

8. Exercising your rights and complaining

Send rights requests to privacy@fatberrydsp.com. We respond within one month and will tell you if we need to extend that period for a complex request. We do not charge for a first request.

If you are unhappy with how we handled it, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or, in the EU, to your national supervisory authority. We would prefer you raised it with us first.

9. Automated decisions and profiling

We do not make decisions producing legal or similarly significant effects about you by automated means. Our payment processor runs automated fraud scoring on transactions; a declined payment can be reviewed manually on request.

10. Children

The service is not directed at children under 16. We do not knowingly collect their data. If you believe a child has registered, contact us and we will delete the account.

11. Changes to this policy

Material changes are announced by email to registered account holders at least 14 days before they take effect. The "last updated" date above always reflects the current version.