Privacy policy

1. Who we are and how to contact us

Granwel Technologies LTD is a company registered in England and Wales under company number 17419846. Our registered office is Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom.

For the purposes of the UK GDPR, we are the controller of the personal information described in this policy. That means we decide why and how it is used. Where we handle information on behalf of a business customer as part of a service we provide to them, that customer is the controller and we act as its processor, and this policy does not apply to that information.

If you have a question about this policy or about how we handle your information, please use our website contact form and say that your message is a privacy matter. You can also write to us at the registered office above. We do not publish a general email address, and the contact form is the quickest way to reach the right person.

2. What this policy covers

This policy applies when you:

• visit or use our websites, including granwel.com and aulendra.granwel.com;
• use the Aulendra apps and related account and subscription services;
• contact us, use our support features or ask us about our services;
• do business with us, or work with us on a project; or
• use any other product or service we offer that refers to this policy, including products we may offer in future.

Some products or services may have their own supplementary notice, which will explain anything specific to them. If there is a conflict between a supplementary notice and this policy for that product, the supplementary notice takes priority for that product.

Our websites may contain links to other websites and services that we do not control. This policy does not apply to them, and we encourage you to read the privacy policy of any site you visit.

3. Information we collect

The information we handle depends on how you interact with us. It falls into three broad groups.

Information you give us

• Contact and enquiry details. Your name, email address, organisation, subject, the contents of your message and anything else you choose to tell us when you use a contact form, support feature or other channel.
• Account details. If you create an account, information such as your email address, a display name if you give one, and the sign-in details you use to protect and access the account.
• Subscription and purchase details. Where you subscribe to a paid product, the information we need to confirm your entitlement, such as the product, status and dates of your subscription.
• Content you create or upload. Material you choose to create, store, share or upload using our products, to the extent that it is made available to us to provide the service you have chosen.
• Business and supplier information. Contact details and professional information about individuals at organisations that are customers, suppliers or prospective partners.
• Preferences and requests. Your communication choices, consent choices, and details of any privacy, support or complaint request you make.

Information collected automatically

• Technical information. Details that your device or browser shares when it connects to us, such as your IP address, browser and device type, operating system, language settings, referring page and the date and time of requests.
• Usage information. Which pages or features you use and how you move between them, collected on an aggregated basis for the purposes described in the analytics section below.
• Security and diagnostic information. Records that help us keep our services available and secure, detect abuse and automated traffic, and find and fix faults.
• Information from cookies and similar technologies. Described in the cookies section below and on our cookie page.
• Optional diagnostics. Where a product offers optional usage or crash reporting, information about how the product performs, only if you choose to switch it on.

Information from third parties

• Sign-in and platform providers. If you choose to sign in using a third-party sign-in option, we receive the identifier and the basic profile details that provider shares with us, which may include your name and email address, according to the choices you make with that provider.
• Payment and app store platforms. Where you buy through an app store, we receive confirmation of the transaction and the status of your subscription. We do not receive your payment card details.
• Service providers and partners. Information from the trusted service providers that help us operate our services, for example confirmation that a message was delivered or that a security check was passed.
• Publicly available and business sources. Professional contact information that is publicly available or provided by your organisation, where we have a legitimate reason to contact you about a business matter.
• Other people. Where someone else gives us information about you, for example a colleague who adds you to a shared space or an invitation, we use it only for the purpose for which it was given.

Where we collect information directly from you, we will tell you if providing it is a statutory or contractual requirement, or necessary to enter into a contract, and what the consequences are of not providing it. In most cases, if you choose not to provide information we need, we will not be able to provide the related feature or service.

We do not intentionally collect special category information, such as information about health, beliefs or ethnicity, and we ask that you do not send it to us unless it is necessary. Where you choose to include such information in content you create, we handle it only to provide the service you have chosen.

4. How we use personal information

We use personal information only where we have a lawful reason to do so. In general terms, we use it to:

• provide, maintain and secure our websites, products and services;
• create and manage accounts, authenticate users and manage subscriptions;
• respond to enquiries, requests and support questions, and keep a record of our dealings with you;
• understand how our websites and products are used so that we can improve them;
• detect, prevent and investigate fraud, abuse, security incidents and other unlawful activity;
• send you service messages, such as security notices, account notices and important changes;
• send you information about our products where the law allows, and respect your choices about it;
• administer our business, including accounting, record-keeping, audit and the management of suppliers and professional advisers;
• comply with our legal and regulatory obligations and respond to lawful requests from authorities; and
• establish, exercise or defend legal claims.

We do not sell personal information. We do not use personal information for third-party advertising, and we do not build advertising profiles of our visitors or users.

If we want to use your information for a purpose that is materially different from the one it was collected for, we will tell you and, where required, ask for your consent or explain our lawful basis before doing so.

5. Our lawful bases

UK data protection law requires us to have a lawful basis for each use of personal information. The table below sets out, at a general level, the lawful bases we rely on for each purpose.

Where we rely on legitimate interests, we consider whether those interests are outweighed by your interests, rights and freedoms, and we put safeguards in place to protect you. You can ask us for more information about this assessment at any time. Where we rely on consent, you may withdraw it at any time, and withdrawing it does not affect the lawfulness of what we did before you withdrew it.

6. Website analytics

We measure how our websites are used so that we can keep them useful, fast and accessible. In practice this means we measure the number of visits, the pages that are viewed, and the approximate location of visitors, shown as a country or city, which is derived from IP addresses. IP addresses are not stored in full for this purpose.

We keep this measurement privacy-friendly. We do not use advertising cookies, we do not follow you across other sites, we do not sell analytics information, and we do not use it to build advertising profiles. The results are used in aggregate form to understand trends, not to identify individual visitors.

Our analytics rely on service providers acting on our instructions. Where the law requires your consent for any particular measurement, we ask for it, and we provide a way to change your choice at any time using the cookie settings link in the footer of our website.

7. Cookies and similar technologies

Cookies are small files that a website asks your browser to store. Similar technologies include local storage and pixels. Under PECR, we need your consent before storing information on your device or reading it back, unless the storage is strictly necessary to provide something you have asked for.

We use strictly necessary storage to remember your cookie choice, to keep you signed in where you sign in, and to protect our services and forms from automated abuse. We do not use advertising or cross-site tracking cookies. Anything optional is off unless you allow it.

Our cookie page explains the types of storage we use, how to change your choice, and how to control cookies in your browser.

8. Who we share information with

We do not sell personal information. We share it only in the following categories of circumstances, and only to the extent necessary.

• Trusted service providers. Companies that act on our behalf and on our documented instructions to host our services, deliver email, provide analytics and security, process payments, handle support, and otherwise help us run our business. They are bound by contracts that require them to protect personal information and to use it only for the services they provide to us.
• Platform providers you deal with directly. Where you use Sign in with Apple, buy through the App Store or turn on iCloud sync of your own data, Apple handles that part of your experience and uses information as an independent controller under its own privacy policy. Where you choose the Sign in with Google option, the provider of that option handles its part in the same way.
• Other people you choose. Where a feature lets you share content or invite others, information you choose to share will be visible to the people you share it with.
• Professional advisers. Lawyers, accountants, auditors, insurers and other professional advisers, who are subject to duties of confidentiality.
• Authorities and courts. Regulators, law enforcement, courts and other public bodies, where the law requires or permits it, or where it is necessary to protect rights, safety or property.
• Business transactions. A prospective or actual buyer, investor or successor if we are involved in a merger, acquisition, financing or sale of assets, in which case we will require them to respect this policy or tell you of any change.
• With your consent or at your request. Anyone else, where you ask us to or have given us your consent.

We do not allow our service providers to use your personal information for their own marketing purposes.

9. International transfers

Some of our service providers, and some of the organisations described above, operate internationally, so your information may be handled in countries outside the United Kingdom. Those countries may have data protection laws that differ from those in the United Kingdom.

Whenever we transfer personal information outside the United Kingdom, we make sure it is protected to a standard that is essentially equivalent to UK law. We do this by relying on one or more of the following safeguards, depending on the circumstances: transfers to countries that the United Kingdom recognises as providing adequate protection, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, and other lawful transfer mechanisms. Where required, we also carry out a transfer risk assessment and apply additional measures.

You can ask us for more information about the safeguards we use by contacting us through the details in this policy.

10. How long we keep information

We keep personal information for no longer than is necessary for the purposes for which it was collected, including to satisfy legal, accounting and reporting requirements. To decide how long that is, we consider the amount, nature and sensitivity of the information, the risk of harm from keeping it, the reasons we hold it and whether we can achieve those reasons by other means, and the periods set by law.

By way of general guidance:

• enquiries are kept until they are no longer needed to respond to you or manage the conversation;
• account information is kept while your account is open, and is then deleted or anonymised, apart from limited records we are required or entitled to keep;
• purchase and financial records are kept for as long as tax and accounting rules require;
• short-lived technical and security records are kept only for a short period; and
• records of privacy requests and complaints are kept for as long as we need to demonstrate that we handled them properly.

When we no longer need personal information, we delete it or anonymise it so that it can no longer be linked to you. Information that has been anonymised or aggregated so that it no longer identifies you is not personal information, and we may keep and use it.

11. Security

We take the security of personal information seriously. We use technical and organisational measures that are appropriate to the nature of the information and the risks involved, including measures designed to protect against unauthorised access, loss, alteration and disclosure. These include controls on who can access information, protections for information in transit and at rest, monitoring for misuse, and processes for handling incidents. We limit access to personal information to people and providers who need it to do their job, and who are subject to duties of confidentiality.

No system can be completely secure. You can help to protect your information by keeping your sign-in details confidential, using a strong and unique password, keeping your devices up to date and telling us promptly if you think your account has been compromised. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner and, where required, you, in accordance with the law.

If you believe you have found a security vulnerability in our websites, please follow the guidance on our security page.

12. Your rights

Under UK data protection law, you have the following rights in relation to your personal information. Some of them apply only in certain circumstances.

• The right to be informed. To be told how your information is used, which is the purpose of this policy.
• The right of access. To ask for confirmation that we process your information and for a copy of it, together with certain details about how it is used.
• The right to rectification. To ask us to correct information that is inaccurate and to complete information that is incomplete.
• The right to erasure. To ask us to delete your information in certain circumstances, for example where it is no longer needed or where you withdraw consent and no other basis applies.
• The right to restrict processing. To ask us to pause our use of your information in certain circumstances, for example while we check its accuracy or consider an objection.
• The right to data portability. Where we process information that you gave us by consent or to perform a contract, using automated means, to receive it in a structured, commonly used and machine-readable format and to ask that it be sent to another controller where this is technically feasible.
• The right to object. To object to our use of your information where we rely on legitimate interests, and to object at any time to direct marketing, in which case we will stop.
• Rights relating to automated decision-making. Described in the section on automated decision-making below.
• The right to withdraw consent. Where we rely on your consent, to withdraw it at any time. Withdrawing consent is as easy as giving it.
• The right to complain. To complain to the Information Commissioner's Office, as explained below.

These rights are subject to conditions and exemptions under the law. For example, we may need to keep certain information to comply with legal obligations or to establish, exercise or defend legal claims, and we may be unable to disclose information that would reveal the personal information of someone else. If we cannot meet a request in full, we will explain why.

13. How to exercise your rights

To exercise any of your rights, use our website contact form and say that your message is a privacy request, or write to us at the registered office. Please tell us which right you wish to use and give enough detail for us to find your information. You do not need to use any particular wording.

We may need to ask for information to confirm your identity, and for more detail if your request is complex. We do this to protect your information from being disclosed to someone who is not entitled to it. You can also make a request through someone else, such as a solicitor, if they have your authority.

We normally respond within one month of receiving your request and of any information we need from you. If your request is complex or you have made several requests, we may extend this by up to two further months, and we will tell you within the first month if we do. We do not charge a fee for making a request, unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse it, and we will explain our reasons.

Where you use a feature that has its own settings, such as account settings in a product, you may also be able to correct or delete some information there directly.

14. Complaints to the Information Commissioner

We would like the chance to put things right, so please contact us first if you have a concern. You are not required to do so, and you have the right to complain at any time to the Information Commissioner's Office (ICO), the UK data protection regulator. You can find information about how to report a concern on the ICO website at ico.org.uk. If you live or work elsewhere, you may also be able to complain to your local supervisory authority.

15. Children

Our websites and products are not directed at children, and we do not knowingly collect personal information from children under 13. If you are under 18, please use our services only with the involvement of a parent or guardian. If you believe a child has given us personal information, please contact us and we will take steps to delete it.

16. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that have a legal effect on you or similarly significantly affect you. We use automated tools in limited ways, for example to detect automated abuse and to keep our services secure, and these do not make decisions of that kind. If this changes, we will update this policy and tell you about the logic involved and your right to request human review, to express your view and to contest the decision.

17. Artificial intelligence features

Some of our websites and products include features that use artificial intelligence, for example to help answer customer questions or to help you work with your own content. When you use such a feature, the information you provide to it is processed to prepare the response you asked for.

We apply the following principles to these features:

• we use them only to provide the feature you have chosen and to keep it safe and reliable;
• we do not use your personal information or your content to train artificial intelligence models;
• we ask you not to include sensitive information in messages you send to them;
• we do not use them to make decisions about you that have legal or similarly significant effects; and
• where a feature offers to pass a conversation to a person, it does so only if you choose.

Responses from artificial intelligence features can be incomplete or inaccurate, so please check anything important with us directly.

18. Aulendra

This section applies in addition to the rest of this policy when you use the Aulendra apps, the Aulendra website and related services.

Accounts and sign-in

You can create an Aulendra account using your email address, or using Sign in with Apple or Sign in with Google where offered. We use account information to create and secure your account, to let you sign in, to keep you signed in on your devices and to contact you about your account. If you use a third-party sign-in option, that provider shares with us the details described above, according to the choices you make with it.

Your content

Aulendra is designed so that your study material is kept on your device by default. Creating an account does not by itself send your library to us. Material leaves your device only where you choose a feature that needs it, such as syncing through your own iCloud account, which Apple provides and which is governed by your agreement with Apple, or sharing with other people in a shared space, where we hold the content you upload so that you and the people you invite can use it. You can remove content you have uploaded, and you can ask us to delete your account and associated information as described in the section on your rights.

Subscriptions and payments

Subscriptions are bought through the App Store. Apple handles payment, billing and refunds, and we do not receive your payment card details. We receive the information needed to confirm that your account has an active subscription. Our terms and prices explain the plans.

Optional diagnostics

Aulendra can offer optional usage and crash reporting. It is off unless you switch it on in the app, it is not a condition of using the app or of buying a subscription, and it does not include the content of your study material. You can switch it off at any time.

Artificial intelligence in Aulendra

Where Aulendra offers features that use artificial intelligence to help you work with your material, it processes the content you choose to use with that feature in order to produce the result you asked for. We do not use your content to train artificial intelligence models, and we do not use these features to make decisions about you with legal or similarly significant effects.

When you stop using Aulendra

If you close your account or ask us to delete your information, we will delete or anonymise it as described in the section on how long we keep information. Uninstalling the app, signing out or deleting your account does not cancel a subscription, which you manage through your Apple account.

19. Marketing and service messages

We send service messages when they are needed to run your account or respond to you, such as security notices, verification messages and replies to your enquiries. These are not marketing. We will send you marketing about our products only where the law allows, for example where you have asked for it or you are an existing customer or contact and we are offering similar products, and every marketing message will include a simple way to opt out. You can also ask us to stop at any time, using the contact form.

20. Changes to this policy

We may update this policy from time to time, for example to reflect changes in our products, our practices or the law. The version number and date at the top show the current text. If we make a significant change, we will take reasonable steps to tell you, for example by a notice on our websites or, where appropriate, a message to you, and where the law requires your consent to a change, we will ask for it.

21. Contact

Granwel Technologies LTD, Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom. Company number 17419846.

For any question about this policy, or to make a privacy request, use our website contact form and mark your message as a privacy matter. We will respond as soon as we reasonably can, and within the time limits set by law.