Privacy policy

VERSION: 3.0

LAST UPDATED: 06/08/2026

1. Introduction

This Privacy Policy (the “Policy”) describes how Watchers App Limited, a company incorporated and existing under the laws of England and Wales under registration number 13562970, having its registered office at 4 Hill Street, Mayfair, London W1J 5NE, United Kingdom (“Watchers”, “Company”, “we”, “us”, or “our”), collects, uses, stores, discloses and otherwise processes personal data in connection with access to and use of the website located at https://watchers.io (the “Website”).

For the purposes of applicable data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, the Company acts as the data controller in respect of personal data collected through the Website.

This Policy does not apply to personal data processed by the Company on behalf of its clients within the Watchers SaaS platform, where the Company acts as a data processor under separate contractual arrangements and pursuant to a Data Processing Addendum.

2. Scope of Application

This Policy applies to personal data collected and processed in connection with:

(a) access to and use of the Website;

(b) submission of enquiries, contact forms or other communications via the Website; and

3. Categories of Personal Data Collected

3.1 Information Collected Automatically

When an individual accesses the Website, the Company may automatically collect certain technical and usage information, including but not limited to Internet Protocol (IP) address, browser type and version, device type, operating system, language preferences, referring URLs, date and time of access, pages viewed, navigation paths, and interaction behaviour.

Such information may be collected through server logs, cookies and similar tracking technologies.
This information is processed for the purposes of ensuring the proper functioning and security of the Website, preventing misuse, analysing Website performance (subject to consent where required), and improving user experience.

3.2 Information Provided Voluntarily

Where an individual submits a contact form or otherwise communicates with the Company via the Website, the Company may collect personal data including name, email address, telephone number, organisation name, job title, country and any other information voluntarily provided. Country information is used, among other things, to identify the legal regime applicable to the individual and the relevant service region.

Such information is processed for the purposes of responding to enquiries, providing requested information, assessing potential business relationships, and communicating regarding the Company’s services.

4. Legal Bases for Processing

The Company processes personal data on one or more of the following lawful bases under the UK GDPR (and, in respect of individuals in the European Economic Area, the corresponding provisions of the EU GDPR):

4.1 Consent

Where required by law, including in relation to analytics cookies, the Company processes personal data on the basis of the individual’s consent pursuant to Article 6(1)(a) UK GDPR. Consent may be withdrawn at any time via the “Cookie Settings” link available on the Website.

4.2 Legitimate Interests

The Company may process personal data where such processing is necessary for the purposes of its legitimate interests pursuant to Article 6(1)(f) UK GDPR, including ensuring the security and integrity of the Website, preventing fraud or misuse, improving Website functionality, and managing business communications, provided that such interests are not overridden by the rights and freedoms of the individual.

4.3 Performance of Contract or Pre-Contractual Steps

Where an individual submits an enquiry relating to potential services, processing may be necessary to take steps at the request of the individual prior to entering into a contract, pursuant to Article 6(1)(b) UK GDPR.

4.4 Compliance with Legal Obligations

The Company may process personal data where required to comply with applicable legal obligations pursuant to Article 6(1)(c) UK GDPR.

5. Cookies and Tracking Technologies

The Website uses cookies and similar technologies to ensure functionality, enhance performance and, subject to consent, collect analytics information.

Analytics services currently used include Google Analytics (Google LLC) and HubSpot, Inc.

Analytics cookies are deployed only following explicit user consent and are governed by the Company’s Cookie Policy, available at:
https://watchers.io/legal/cookie-policy

6. Disclosure of Personal Data

The Company may disclose personal data to third parties in the following circumstances:

(a) to service providers engaged to support Website functionality, hosting, analytics, IT services, and customer relationship management, including Google LLC and HubSpot, Inc., who process personal data under contractual safeguards and only on documented instructions;

(b) to competent public authorities where required by applicable law, regulation, or legal process; and

7. International Transfers

Certain service providers engaged by the Company may process personal data outside the United Kingdom or European Economic Area.

Where such transfers occur, the Company ensures that appropriate safeguards are implemented in accordance with applicable data protection legislation, including reliance on adequacy decisions, UK-approved International Data Transfer Agreements (IDTA), the Standard Contractual Clauses approved by the European Commission (together with the UK International Data Transfer Addendum, where required), or other legally recognised transfer mechanisms.

8. Data Retention

The Company retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, regulatory, accounting or reporting requirements.
Contact form data shall generally be retained for the duration necessary to respond to the enquiry and to manage any subsequent business discussions.

Analytics data retention periods are determined by configuration settings within the relevant analytics tools.

Where processing is based on consent, personal data shall be retained until consent is withdrawn, unless another lawful basis applies.

9. Data Security

The Company implements appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.
Such measures are proportionate to the risks presented by the processing and may include access controls, encryption in transit, secure hosting environments, and regular system monitoring.

10. Data Subject Rights

Subject to applicable law, individuals may have the right to:

(a) request access to their personal data;

(b) request rectification of inaccurate or incomplete data;

(d) request restriction of processing;

(e) object to processing based on legitimate interests;

(f) request data portability, where applicable; and

(g) withdraw consent at any time where processing is based on consent.
Individuals also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) in the United Kingdom.

Requests relating to data protection rights may be submitted to: [email protected].
The Company may request reasonable verification of identity prior to responding to such requests.

11. Individuals in the European Economic Area

Where the processing of personal data of individuals located in the European Economic Area (“EEA”) is subject to the EU GDPR, the legal bases described in Section 4 above apply by reference to the corresponding provisions of Article 6(1) EU GDPR, and the rights described in Section 10 apply as provided for by the EU GDPR.

Individuals in the EEA have the right to lodge a complaint with the supervisory authority of the EU Member State of their habitual residence, their place of work or the place of the alleged infringement, in addition to or instead of the ICO.

Data subjects in the EEA may contact the Company directly at [email protected] in relation to any matter concerning the processing of their personal data under this Policy.

12. California Privacy Rights

This Section applies to natural persons who are California residents and supplements the remainder of this Policy, to the extent the CCPA applies to the Company.

In the preceding twelve (12) months, the Company has collected the following categories of personal information, as described in Section 3: identifiers (such as name, email address, telephone number and IP address); professional or employment-related information (such as organisation name and job title); and internet or other electronic network activity information (such as browsing and interaction data collected through cookies and similar technologies). This information is collected from the sources, processed for the purposes, and disclosed to the categories of recipients, described in Sections 3, 5 and 6 above.

The Company does not sell personal information and does not share personal information for cross-context behavioural advertising. The Company does not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. Where required by law, the Company honours opt-out preference signals such as the Global Privacy Control (GPC).

Subject to applicable exceptions, California residents have the right to: (a) know and access the personal information collected about them; (b) request deletion of personal information; (c) request correction of inaccurate personal information; (d) opt out of any sale or sharing of personal information; and (e) not receive discriminatory treatment for exercising these rights. Requests may be submitted to [email protected] and may also be submitted by an authorised agent acting on a resident’s behalf. The Company will verify the identity of the requester and respond within the timeframes required by the CCPA.

13. Canadian Residents

Where PIPEDA or substantially similar provincial legislation (including Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25) applies, the Company processes personal information with the knowledge and consent of the individual, except where otherwise permitted or required by law. Consent may be express or implied depending on the sensitivity of the information and the reasonable expectations of the individual, and may be withdrawn at any time, subject to legal or contractual restrictions and reasonable notice.

Canadian residents may request access to, or correction of, their personal information by contacting [email protected], and may address unresolved concerns to the Office of the Privacy Commissioner of Canada or the applicable provincial regulator (including the Commission d’accès à l’information du Québec).

The Company sends commercial electronic messages to recipients in Canada only in accordance with CASL: on the basis of express consent or implied consent (such as an existing business relationship or a conspicuously published business contact address relevant to the recipient’s role or functions), with clear identification of the sender and a functioning unsubscribe mechanism, actioned within ten (10) business days.

14. Brazilian Residents

Where the LGPD (Law No. 13,709/2018) applies, the Company processes personal data on the legal bases set out in Article 7 LGPD, including consent, compliance with legal obligations, the performance of contracts and preliminary procedures relating thereto, and the legitimate interests of the Company.

Brazilian residents have the rights set out in Article 18 LGPD, including confirmation of the existence of processing, access, correction, anonymisation or deletion, portability, information regarding sharing, and withdrawal of consent, and may lodge a complaint with the Brazilian National Data Protection Authority (ANPD). Requests may be submitted to [email protected].

15. Marketing Communications

The Company may send marketing and promotional communications about its services by email. Such communications are sent: (a) with the recipient’s consent; (b) where permitted, to existing customers in relation to similar services, with the opportunity to object at the time of collection and in every subsequent message, in accordance with the UK Privacy and Electronic Communications Regulations 2003 (PECR) and, where applicable, corresponding EU ePrivacy rules; (c) to recipients in Canada, only in accordance with CASL as described in Section 13; and (d) to recipients in the United States, in accordance with the CAN-SPAM Act.

Every marketing email identifies the Company, includes its contact details and contains an unsubscribe mechanism. Individuals may opt out of marketing communications at any time by using the unsubscribe link in any such email or by contacting [email protected]; opt-out requests are honoured promptly and in any event within the periods required by applicable law. Opting out of marketing communications does not affect service or transactional communications.

16. Children

The Website is intended for business users and is not directed to individuals under the age of eighteen (18). The Company does not knowingly collect personal data from children.

17. Amendments to This Policy

The Company reserves the right to amend this Privacy Policy from time to time in order to reflect changes in applicable law, regulatory guidance, technology or operational practices.

Any revised version shall be published on the Website together with an updated “Last Updated” date.
Where changes are material, the Company will take reasonable steps to bring them to the attention of Website users, for example by means of a prominent notice on the Website. Continued use of the Website following publication of an updated version constitutes acknowledgement of the revised Policy; where applicable law requires consent to such changes, the Company will obtain it.