Privacy Policy

1. Introduction

GreenTick ("we", "us", or "our") operates the GreenTick platform available at https://greentickapp.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website or use our Service. We are committed to protecting your personal data and complying with applicable data protection laws.

By using the Service, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Data Controller

The data controller responsible for your personal data is:

GreenTick
Email: greentickapp@gmail.com

If you have any questions about this Privacy Policy or our data practices, you can contact us at the address above.

3. Personal Data We Collect

We may collect the following categories of personal data:

• Identity Data: Full name, job title, and role within your organisation.
• Contact Data: Email address, telephone number, and business address.
• Account Data: Username, password (hashed), and authentication provider identifiers (e.g. Auth0 subject ID).
• Technical Data: IP address, browser type and version, time zone setting, operating system, and device information.
• Usage Data: Pages visited, features used, time spent on the Service, and interaction patterns.
• Financial Data: General ledger account data, trial balance data, and reconciliation records uploaded to or created within the Service. This data belongs to your organisation and is processed by us on your behalf.
• Communication Data: Messages sent via support or contact forms, including your name, email, and message content.

4. How We Collect Your Data

We collect personal data through the following means:

• Directly from you: When you register for an account, fill in forms, upload data, or contact us.
• Automatically: When you interact with our Service, we may automatically collect Technical Data and Usage Data through cookies and similar technologies.
• From third parties: We may receive data from authentication providers (such as Auth0) to facilitate secure sign-in.

5. How We Use Your Data

We use your personal data for the following purposes and on the following lawful bases under applicable data protection law:

6. Data Sharing and Disclosure

We do not sell your personal data. We may share your data with the following categories of recipients:

• Service providers: Hosting (cloud infrastructure), authentication (Auth0), email delivery, and analytics providers who process data on our behalf under data processing agreements.
• Within your organisation: Administrators and authorised users in your organisation may access data uploaded or created within the Service in accordance with their assigned role.
• Legal requirements: We may disclose data where required by law, regulation, legal process, or enforceable governmental request.
• Business transfers: In connection with a merger, acquisition, or sale of all or part of our assets, your data may be transferred as part of that transaction.

7. International Data Transfers

Your data may be transferred to and processed in countries other than where you are located. Where such transfers occur, we ensure appropriate safeguards are in place in accordance with applicable data protection law, including Standard Contractual Clauses (SCCs) or other recognised transfer mechanisms.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Account data is retained for the duration of your subscription and for up to 12 months afterwards. Financial Data uploaded by your organisation is retained for the duration of your subscription and deleted within 90 days of account termination unless you request earlier deletion.

9. Your Rights

You have the following rights in relation to your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can request that we correct inaccurate or incomplete data.
• Right to erasure: You can request that we delete your personal data in certain circumstances.
• Right to restrict processing: You can request that we restrict the processing of your data in certain circumstances.
• Right to data portability: You can request that we transfer your data to another organisation in a structured, commonly used, machine-readable format.
• Right to object: You can object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at greentickapp@gmail.com. We will respond to your request within one month.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS) and at rest, access controls and role-based permissions, regular security assessments, and secure authentication via Auth0. However, no method of transmission over the Internet or electronic storage is 100% secure.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on this page with a revised effective date. We encourage you to review this Privacy Policy periodically.