Privacy Notice
How Deskivo collects and uses personal data, under the UK GDPR and the Data Protection Act 2018, with a section for US state privacy laws.
Last updated: October 16, 2026
Who we are
Impact Solution Group Limited a company registered in England and Wales (company number 15568941), registered office 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE (“Deskivo”, “we”, “us”). Contact: [TO CONFIRM: legal@deskivo.cloud].
ICO registration: [TO CONFIRM: ICO registration number]. Privacy contact: [TO CONFIRM: privacy@deskivo.cloud].
Our two roles
Controller. We decide how to use personal data collected on this website, on our waiting lists, and for customer accounts, billing and support. This notice covers that data.
Processor. Inside each customer's workspace (tickets, assets, users and so on) the customer organization is the controller and we process that data only on its instructions, under our Data Processing Addendum. If you are a user of a customer's workspace, please read that organization's privacy notice and contact it first.
What we collect and why
| Data | Purpose | Lawful basis (UK GDPR) |
|---|---|---|
| Waiting-list form: name, work email, organization, size, country, package of interest, optional message, consent | Confirming your place, contacting you about joining Deskivo, planning capacity by region | Consent (you can withdraw it at any time) and legitimate interests |
| Waiting-list technical data: IP address, IP-based country, browser user agent, referring page and campaign (UTM) tags | Preventing spam and abuse, understanding which channels work | Legitimate interests |
| Account data: names, emails, roles, sign-in method, two-factor status | Providing and securing the service | Contract, and legitimate interests |
| Billing data: billing contact, company details, invoices (card details are held by Stripe, not us) | Taking payment, keeping accounting records | Contract and legal obligation |
| Support tickets and emails | Helping you | Contract and legitimate interests |
| Logs: IP addresses, timestamps, actions, security events | Security, troubleshooting, audit trails | Legitimate interests and legal obligation |
| Region choice (UK or US) in your browser's local storage and a cookie | Showing the right regional site | Strictly necessary, see our cookie notice |
Sub-processors
We use these providers to run Deskivo. Each is bound by a contract that protects your data.
| Sub-processor | Purpose | Location |
|---|---|---|
| Oracle Cloud Infrastructure | Hosting of the Deskivo platform and customer workspaces | UK (London) region; US region when it opens |
| SMTP2GO | Sending transactional email (notifications, invites, password resets) | [TO CONFIRM: processing locations] |
| Stripe | Payments, subscriptions and invoicing | UK/EU and US |
| Microsoft | Single sign-on with Microsoft Entra ID, and Microsoft Graph sync when a customer connects it | Per the customer's Microsoft 365 tenant |
| Cloudflare | DNS and, if enabled, bot protection (Turnstile) on the waiting-list forms | Global network |
International transfers
UK workspaces and our website and waiting-list data are hosted in the UK. Our US region is coming online soon; US workspaces will then be hosted in the United States. Some providers above may process data outside the UK. Where personal data leaves the UK we rely on UK adequacy regulations, or on the UK International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses (SCCs), with additional safeguards where needed.
How long we keep data
Waiting-list entries: until you join Deskivo, ask to be removed, or 24 months after your last contact, whichever comes first [TO CONFIRM]. Account and support data: for the life of the account and up to 6 years afterwards for legal and accounting purposes. Security logs: up to 12 months [TO CONFIRM]. Customer workspace data: as set by the customer, and deleted within 30 days after the subscription ends, subject to backup expiry.
Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. Email [TO CONFIRM: privacy@deskivo.cloud]. We will reply within one month.
Complaints
Please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Your rights under US state privacy laws (including California)
If you live in California or another US state with a consumer privacy law (such as Colorado, Connecticut, Virginia or Utah), you may have the right to know what personal information we collect and how we use it, to access it, to correct it, to delete it, and to opt out of its “sale” or “sharing” or its use for targeted advertising. We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act (CCPA/CPRA), and we do not use it for targeted advertising. Categories we collect: identifiers and contact details (name, email), professional information (organization, size), internet activity (IP-based country, browser, referring page) and, for customers, account and usage records. Sources, purposes and retention are described above. To exercise a right, email [TO CONFIRM: privacy@deskivo.cloud]; we will verify your request and won't discriminate against you for making it. You can use an authorized agent. Where we process data as a service provider for a customer, please contact that customer first.
Changes
We will update this notice when our practices change, and change the date at the top.