PRIVACY POLICY

Policy version: 08/05/2025

1. INTRODUCTION

This Privacy Policy is provided by 4Admin Ltd. (Company number 15449473) trading as 4Admin (hereinafter referred to as the “Company”, “we”, “our” or “us”) and describes how we collect, store, use, share and process your information when you use our Services, including when you visit our website at https://4admin.app or any other websites we operate with the same domain name and different extensions (“Website”) for administrative tasks and document analysis; or engage with us in other related ways, including sales, marketing, or events.

We take data protection very seriously. Please read this privacy policy carefully as it contains important information on how we process personal data when you use our Services, including document analysis and administrative tools.

It also explains your rights in relation to your personal data and how to contact us or the relevant regulator in the event you have a complaint. Our collection, storage, use and sharing of your personal data is regulated by law, including under the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the Swiss Federal Act on Data Protection (FADP), depending on your location.

1. WHAT THIS POLICY APPLIES TO

This privacy policy relates to your use of the Website and for accessing the services through the Website.

The Website may link to or rely on other apps, websites, APIs or service owned and operated by us or by certain trusted third parties to enable us to provide you with the service through the Website. These integrated third-party services, such as document processing APIs, administrative tools, and secure storage providers, may process your data in accordance with their own privacy policies, which will be clearly disclosed to you before any such integration is enabled. Any such processing will be limited to what is necessary for providing the requested document analysis and administrative services. For privacy information relating to these other apps, websites or service, please consult their privacy policies as appropriate. For more information see the section ‘Who we share your personal data with’ below.

1. PERSONAL DATA WE COLLECT ABOUT YOU

The personal data we process depends on your use of our Website and Services. This includes data from documents you submit for analysis, as well as data from any optional integrations with email communications, financial documents, and telephone systems that you choose to enable. These integrations are entirely optional and not required to access core Services. For integrated data, we maintain a 6-month automatic deletion policy, though you may manually delete this data at any time through your account settings. We will process the following personal data:

Categories of Personal Data Processed

In more detail

Data collected when you use specific functions in the Website

Data you store online with us using the Website and placing a request for accessing any services, through the Website, including your usage history, service request history or preferences (while such data may not always be personal data as defined at law in all cases, we will assume it is and treat it in accordance with this policy as if it were)

Data collected when you permit the collection of location data

If enabled, location data may be collected. This feature is optional and can be controlled through your account settings.

Other data the Website collects automatically when you use it

• Your activities on, and use of, the Website which reveal your preferences, interests or manner of use of the Website and the times of use

• Other information such as device type, IMEA numbers, MAC address of networks, other unique device identification, device operating system, mobile network information, storage usage, data usage, time zone settings etc

Data collected when you make an enquiry with us

Your name and email address

Marketing and communications data

Your preferences in receiving marketing emails from us and our third parties and your communication preferences

If you do not provide personal data we ask for where it is required, including the geo-localisation service, it may prevent us from providing certain features of the Services to you through the Website. However, optional integrations with email, financial documents, and telephone systems are not required to access and use the core Services.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals’ usage data (including information about how users interact with and use the Website and place any request for accessing services through the Website) to calculate the percentage of users accessing a specific feature of the Website in order to analyse general trends in how users are interacting with the Website to help improve the Website and our offerings.

We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.

1. SENSITIVE DATA

Sensitive personal data (also known as special category data under UK/EU GDPR and particularly worthy personal data under Swiss FADP) means information related to personal data revealing racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data (where used for identification purposes); data concerning health; data concerning a person’s sex life; and data concerning a person’s sexual orientation.

We do not actively collect or process sensitive personal information as part of our core services. Please do not submit sensitive personal data or information about criminal convictions to us through our document analysis or administrative services.

If sensitive data is inadvertently submitted through the Website or our document analysis services, we will promptly delete such data upon discovery or notification. Any forum features are not intended for and must not be used to share sensitive personal data, as by publishing it through any forum feature, we will assume that you have purposefully made such data manifestly public.

5. LOCATION SERVICE/DATA

The Website may request your consent to use location services only when necessary for specific features like address auto-completion or location-based document organisation. This consent is requested each session (i.e. each time the Website is opened or has been placed in the background for more than 30 seconds). At present, no features require such permissions.

We do not collect or process location data when location services are turned off in your device’s settings. When you allow your device to use location service/data, data will also be collected by Google in accordance with their Privacy Policy, as this is the analytics service integrated into our app.

We exert no control over Google’s Privacy Policy and we therefore recommend that you consult their privacy policy for further information on how Google protect personal data please visit their site - https://policies.google.com/privacy?hl=en-US. For more information see the section ‘Who we share your personal data with’ below.

1. HOW YOUR PERSONAL DATA IS COLLECTED

We use different methods to collect data from and about you including through:

1. Your interaction with us: We collect personal data from you directly when you sign up to the Website, upload documents for analysis, use our administrative tools, request specific services, subscribe to our communications, request marketing emails, contact us directly or reach out to us via social media, participate in our community forums when available, or indirectly through your activity while using the Website, including your document processing patterns and participation in feedback or surveys.

2. Automated technologies or interactions: As you interact with the Website, we will automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies.

1. HOW AND WHY, WE USE YOUR PERSONAL DATA

Under UK GDPR, EU GDPR, and Swiss FADP, we can only use your personal data if we have a proper legal basis, specifically:

1. where you have given consent

2. to comply with our legal and regulatory obligations

3. for the performance of a contract with you or to take steps at your request before entering into a contract, or

4. for our legitimate interests or those of a third party

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. You can obtain details of this assessment by contacting us (see ‘How to contact us’ below).

The table below explains what we use your personal data for and why.

What we use your personal data for

Our reasons

Providing service and/or the functionalities of the Website to you

Depending on the circumstances:

• to perform our contract with you or to take steps at your request before entering into a contract (in this case, the contract means the Terms and Conditions of Use which apply to the Website)

• to share your details with relevant service providers necessary for delivering the requested document analysis or administrative services through the Website

• the Maps Function will use data relating to your location only based on your consent as described in ‘Location service/data’ (above)

To enforce legal rights or defend or undertake legal proceedings

Depending on the circumstances:

• to comply with our legal and regulatory obligations

• in other cases, for our legitimate interests or those of a third party, i.e. to protect our business, interests and rights or those of others

Sending relevant marketing communications and for making personalised suggestions and recommendations to you about the products that may be of interest to you based on your profile data

Based on your explicit consent to receive direct marketing communications about our document analysis and administrative services. We will only send such communications after obtaining your consent and will provide easy opt-out options in all marketing messages. Marketing will be tailored to your service usage patterns and preferences.

Carry out market research through your voluntary participation in surveys

Necessary for our legitimate interests to study how customers use our Website and to help us improve and develop our Website and services offered through the Website.

Communications with you not related to marketing, including about changes to our terms or policies or updates concerning the requests placed by you through the Website or changes to the Website or service or other important notices

Depending on the circumstances:

• to comply with our legal and regulatory obligations

• to keep you updated on the requests placed by you

• in other cases, for our legitimate interests or those of a third party, i.e., to provide the best service to you

Protect the security of systems and data

We have organisational and technical processes and procedures in place to protect your personal information in accordance with UK GDPR, EU GDPR, and Swiss FADP requirements, including encryption and secure processing measures for document analysis, and any data obtained through optional email, financial document, and telephone system integrations. For users in the EU/EEA, UK, and Switzerland, we ensure that any transfer of personal data outside these regions complies with applicable data transfer requirements and safeguards. We maintain strict access controls and secure deletion protocols for all analysed documents. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.

See ‘Who we share your personal data with’ for further information on the steps we will take to protect your personal data where we need to share it with others.

1. MARKETING

Communications with you, including marketing (communications with your consent), service updates regarding core and integration features, and other important notices

We will send service-related communications and, with your consent, marketing communications directly to you as a user of our services. All communications will be in accordance with your preferences and applicable data protection laws.

You will have the right to opt out of receiving marketing communications at any time by:

• contacting us at: support@4admin.co.uk

• using the ‘unsubscribe’ link included in all service-related communications you may receive from us

We may share information in specific situations and with specific third parties, primarily to process payments and securely store login information. When you upload documents for analysis to 4Admin, or when we access data through authorised integrations (such as email and phone systems), we process them securely using our AI hosted by Microsoft Azure. All uploaded documents are used only for the requested analysis and are permanently deleted upon completion. Data that is not viewed or modified for 9 months is automatically deleted, though you may manually delete this data at any time through your account settings.

For more information on data subject rights and how they should be exercised through your organisation as the data controller, see ‘Your rights’ below.

1. 
   

2. YOUR PERSONAL DATA WITH

We may share personal information with specific third parties to process payments and securely store information. When you upload documents to our Website, we use them for one-off analyses with our AI – securely hosted by Microsoft Azure. Upon completion of analysis, the files are removed entirely from our systems. Any third-party service providers we engage process data under strict confidentiality obligations.

When you visit our Website or any related websites with the same domain name and different extension, we act as a data controller for all processing activities, including website usage data, AI analysis services, and integrated communication systems. We engage service providers who provide sufficient guarantees to implement appropriate technical and organisational measures that meet GDPR requirements and ensure the protection of your rights. All service providers are bound by written contracts that include specific data protection obligations, confidentiality requirements, security measures, and appropriate safeguards for your personal data. and require them to only process personal data on documented instructions from us, acting on behalf of the data controller (your organisation). These contracts include confidentiality obligations, security requirements, and audit rights that are at least as protective as those in our agreement with the data controller.

We or the third parties mentioned above may occasionally also need to share your personal data with:

• external auditors, e.g. in relation to the audit of our accounts and our company —the recipient of the information will be bound by confidentiality obligations

• professional advisors (such as lawyers and other advisors)—the recipient of the information will be bound by confidentiality obligations

• law enforcement agencies, courts or tribunals and regulatory bodies to comply with legal and regulatory obligations

• other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency—usually, information will be anonymised but this may not always be possible, however, the recipient of the information will be bound by confidentiality obligations

If you would like more information about who we share our data with and why, please contact us (see ‘How to contact us’ below).

We will not share your personal data with any third parties other than those specified above.

GOOGLE API SERVICES AND GMAIL INTEGRATION

4admin's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

When you connect a Gmail account to 4admin, we request the following OAuth scopes: gmail.readonly, gmail.send, openid and userinfo.email. We use this access only to: (a) send Letter of Authority submissions and follow-up (chaser) emails to product providers from your connected address; and (b) detect provider replies and read their content and attachments in order to display them in the relevant Letter of Authority record and extract policy information into your own client records. 4admin never modifies or deletes email in your mailbox.

Google user data is used solely to provide and improve the user-facing features of 4admin described above. We do not use it for advertising, we do not sell it, and we do not transfer it to third parties except where necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets, in which case you will be notified. Humans do not read this data unless you have given us explicit permission to do so, it is necessary for security purposes or to comply with applicable law, or it has been aggregated and anonymised for internal operations.

Google user data is processed by Microsoft Azure OpenAI Service, deployed within 4admin's own Azure tenant in the Sweden Central region, in order to classify provider replies and extract policy information. Under Microsoft's Azure OpenAI Service data terms, prompts and outputs are not used to train, retrain or improve any Microsoft, OpenAI or third-party model, and are not shared with OpenAI. No Google user data, whether raw, aggregated, anonymised or derived, is used by 4admin or any of its sub-processors to create, train or improve any artificial intelligence or machine learning model. We do not route Google user data through AI aggregators, gateways or model hubs, and we do not operate self-hosted or offline AI models against this data.

Provider replies retrieved from Gmail are stored within the relevant Letter of Authority record so that they remain visible to you alongside the extracted policy information, and are retained in accordance with the retention periods set out in 'How long your personal data will be kept' below, including automatic deletion of data not viewed or modified for 9 months. You can revoke 4admin's access to your Google account at any time from your Google Account security settings (https://myaccount.google.com/permissions), after which we will cease accessing your mailbox and delete stored Gmail data in accordance with those retention periods.

1. HOW LONG YOUR PERSONAL DATA WILL BE KEPT

We will retain and process your personal data only for as long as necessary to fulfil the purposes outlined in this privacy notice, or as required by applicable laws. For integrated email and telephone communications data, we maintain a 6-month automatic deletion policy, though you may manually delete this data at any time through your account settings. We may retain certain other data as required by law or for legitimate business purposes, such as audit requirements, dispute resolution, and enforcement of agreements.

Following the end of the aforementioned retention period, we will delete or anonymise your personal data in accordance with applicable technical standards and industry best practices, unless retention is required by law or for legitimate business purposes as outlined above.

1. INTERNATIONAL TRANSFERS OF WORKFORCE REPRESENTATIVE DATA

While we primarily process and store your personal data within the UK and European Economic Area (EEA) when you use our Website or any website of ours that links to this privacy notice, we may in the future need to transfer your personal data outside these regions to provide our services effectively. Any such transfers will only be made in compliance with UK GDPR, EU GDPR, and Swiss data protection laws, with appropriate safeguards in place. If this changes, we would comply with applicable UK laws designed to ensure the continued protection and privacy of your personal data. Any updated destinations to which we send your personal data, would be indicated in the present section and notified to you in accordance with the section on ‘Change to this privacy policy’ below.

Furthermore, under UK GDPR, EU GDPR, and Swiss Federal Data Protection Act, we will only transfer personal data outside the UK, EEA, or Switzerland where permitted by applicable data protection laws and with appropriate safeguards in place. Any such transfers would only occur where: the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’) under Article 45 of the UK GDPR; there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for data subjects; or a specific exception applies under relevant data protection law. If international transfers were to be implemented, they would only be done with prior notification to and approval from the data controller. Accordingly, if we were to start transferring your personal data from the UK to:

• The EEA: transfers would be conducted under the adequacy finding granted by the UK to the EU under the Withdrawal Agreement; for any transfers from the EU to the UK, we would rely on the adequacy regulation granted to the UK under the Adequacy Decision.

• For any transfers of personal data outside the UK/EEA, we will only process data in compliance with appropriate safeguards under the UK GDPR and other applicable data protection laws, which may include the relevant Standard Contractual Clauses or other approved transfer mechanisms included in our data processing agreements

In the event we could not or choose not to continue to rely on either of those mechanisms at any time we would not transfer your personal data outside the UK unless we could do so on the basis of an alternative mechanism or exception provided by UK data protection law.

1. YOUR RIGHTS

You have certain rights regarding your personal information when using our website and services, including any optional integrated communications features (such as email, financial documents, and telephone system integrations). To exercise your rights, please contact us directly at support@4admin.co.uk. If you do not agree with our policies and practices, including those regarding optional integrations, please do not use our Services. We will consider and act upon any request in accordance with applicable data protection laws.

For further information on each of those rights, including the circumstances in which they apply, please contact us directly at arran@4admin.co.uk. You may find it helpful to refer to guidance from the UK’s Information Commissioner, the European Data Protection Board, or the Swiss Federal Data Protection and Information Commissioner on your rights under the UK GDPR, EU GDPR, or Swiss Federal Data Protection Act respectively.

For any data rights requests or technical issues related to the platform, please:

• sufficient provide information to verify your identity as an authorised platform user (including your full name, username, and any additional verification information we may reasonably request), and

• clearly describe the technical platform issue you are experiencing or the support you need

1. KEEPING YOUR PERSONAL DATA SECURE

We have implemented appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, or accessed unlawfully. We limit access to personal data to authorised personnel who have a genuine business need to access it for the purpose of providing our administrative and document analysis services to you, subject to appropriate confidentiality obligations.

We also have procedures in place to deal with any suspected data security breach. In the event of a breach affecting your personal data, we will notify you and the relevant supervisory authorities without undue delay, in accordance with applicable data protection laws.

For information about our platform security measures and how we protect data, please contact us.

1. COOKIES

A cookie is a small text file which is placed onto your device (e.g. your smartphone or other electronic device) when you use the Website. When we use cookies on the Website, you will be presented with a cookie banner that allows you to make informed choices about which cookies you accept.

Cookies help us to recognise you and your device and allow us to store some information about your preferences or past actions, and remember your preferences next time you visit the Website.

For example, we may monitor how many times you use our Website, which features you access (including any optional integration features), which processes you initiate or participate in, and which parts of the Website you utilise most frequently. This information helps us to understand use of the Website by our users. Some of this data will be aggregated or statistical, which means that we will not be able to identify you individually. However, some cookies may collect personal data, as detailed in the cookie table below and our Privacy Policy.

For further information on our use of cookies, including a detailed list of what information we and our authorised partners may collect through cookies to facilitate our administrative and document analysis services, please see below.

For further information on cookies generally, including how to control and manage them, visit the guidance on cookies published by the UK Information Commissioner’s Office, www.aboutcookies.org or www.allaboutcookies.org.

1. CONSENT TO USE COOKIES AND CHANGING SETTINGS

We will ask for your permission through a clear and prominent notice before placing any non-essential cookies or other similar technologies on your device. Strictly necessary cookies that are essential for core platform functionality (e.g. to maintain secure access to your account, enable document processing features, manage administrative tasks, and ensure proper access to your stored documents) will be placed without explicit consent, as they are required for the service to function.

You can withdraw any previously given consent or manage your cookie preferences at any time by using our cookie management tool available within the Website itself. Your choices will be respected and implemented immediately upon selection. You can then adjust sliders or untick boxes as appropriate to reflect your choice. It may be necessary to refresh or restart the Website for the updated settings to take effect.

1. OUR USE OF COOKIES

We use the following cookies:

1. Strictly necessary cookies: These are cookies that are required for the operation of the Website. These essential cookies are always enabled because the Website will not work properly without them. They include, for example, cookies that enable you to securely access your account, manage your service settings, and utilise core platform features. You can switch off these cookies in your browser settings but then you may not be able to access all or parts of our Website.

2. Analytical or performance cookies: These allow us to recognise and count the number of visitors and to see how users interact with our platform. This helps us improve platform functionality, for example, by analysing which features are most used, how users navigate through the Website, and ensuring efficient access to core Services and optional integrations.

3. Functionality cookies: These are used to recognise when you return to the Website. This enables us to personalise your workspace, maintain your account access, remember your preferred settings including any enabled integration preferences, and customise your experience based on your selected Services.

4. Targeting cookies: These cookies record your visit to the Website, the features you've utilised, and your interaction patterns. We will use this information to customise your experience, such as prioritising relevant features and optional integrations based on your usage patterns and preferences.

The table below provides more information about the individual cookies we use and why:

The cookies we use

Name

Purpose

Whether cookie is essential for us to provide you with a service that you have requested and whether we will seek your consent before we place the cookie

Google Analytics

_ga

This cookie is used to update us on real-time usage of 4admin, i.e. the times you login and the general, non-exact location (i.e. town/city) where the app is being accessed from.

This cookie collects information such as the page visited, the actions taken and the amount of time spent on each page.

We do not exert any control over Google’s usage of cookies, which can be read more about here.

Yes, this cookie is essential to ensure that the app is not accessed from unexpected territories that may be representative of unauthorised access posing a risk to the platform and yourself, as our user.

Authentication

  session

  client_uat

These cookies track whether you are logged into the app or not. They are refreshed every few minutes on an idle page, else between each request.

Yes, this cookie is essential to ensure that only signed up, paying users can access the platform. It also provides a mechanism to ensure frequent logins, to prevent unauthorised access.

1. HOW TO TURN OFF ALL COOKIES AND CONSEQUENCES OF DOING SO

If you do not want to accept cookies, you can use our cookie management tool to reject non-essential cookies. You may also change your browser settings to block cookies, but this is not recommended as it may affect essential platform functions. Please note that blocking all cookies (including essential cookies) will significantly impact your ability to use the platform. Critical features such as secure account access, document analysis tools, administrative task management, and platform customisation may become unavailable. For further information about cookies and how to disable them please go to the guidance on cookies published by the UK Information Commissioner’s Office, www.aboutcookies.org or www.allaboutcookies.org.

1. HOW TO COMPLAIN

If you have any queries or concerns about how your personal data is processed on the Website, you may contact us directly. For technical platform issues unrelated to personal data processing, you may contact our support team (see 'How to contact us' below).

While you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO), the relevant EU Data Protection Authority in your country, or the Swiss Federal Data Protection and Information Commissioner (FDPIC), we encourage you to first contact us directly with any concerns so they can be addressed promptly.

The UK Information Commissioner's Office (ICO) can be contacted at https://ico.org.uk/make-a-complaint or telephone: 0303 123 1113. EU residents can find their national data protection authority contact details at https://edpb.europa.eu/about-edpb/board/members_en. The Swiss FDPIC can be contacted at https://www.edoeb.admin.ch.

20. CHANGES TO THIS POLICY

We may change this privacy policy from time to time. When we make significant changes, we will update the 'Last updated' date at the top of this privacy policy. For material changes affecting personal data processing, we will notify you directly through the email address associated with your account. Changes will also be posted on our platform. Your continued use of our platform after such changes constitutes acceptance of the updated privacy policy.

1. HOW TO CONTACT US

You can contact us by email at arran@4admin.co.uk if you have any questions about this privacy policy, the information we process, or our optional integration features. If you do not agree with our policies and practices, please do not use our Services. We will respond directly to any questions, concerns, or requests regarding your personal information or integrated data management.