Zumiplan is a project portfolio management service operated by Measured Innovation LLC ("we", "us"), [address], United States.
This policy explains what personal information we handle, why, and what rights you have. It covers our website at zumiplan.com and the Zumiplan application.
We do not ask for and the Service is not designed to hold special category data such as health, racial or ethnic origin, religious beliefs, biometric or genetic data, government identifiers, or payment card numbers.
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Providing the Service and keeping accounts working | Performance of a contract |
| Authentication and security, including the activity log | Legitimate interests in protecting the service and our customers |
| Support and responding to your enquiries | Performance of a contract, or legitimate interests |
| Service announcements and essential notices | Performance of a contract |
| Improving and troubleshooting the Service | Legitimate interests in providing a reliable product |
| Marketing communications | Consent, which you may withdraw at any time |
| Meeting legal and accounting obligations | Legal obligation |
Where we rely on legitimate interests, we have considered your rights and concluded they are not overridden. You may object at any time using the contact details below.
We use cookies strictly necessary to keep you signed in and to keep the service secure. These cannot be switched off.
Any analytics or marketing cookies are set only with your consent, and you can change or withdraw that choice at any time through the cookie settings on our website. We honour Global Privacy Control signals as an opt-out of the sale or sharing of personal information.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
We share information with service providers who help us operate Zumiplan, each bound by contract to protect it and to use it only on our instructions. Our current providers are listed at [link to your sub-processor page] and include our database and hosting providers.
We may also disclose information where required by law, to protect our rights or someone's safety, or as part of a merger or acquisition, in which case we will notify affected customers.
We are based in the United States, and information is processed there.
Where information is transferred from the European Economic Area, the United Kingdom or Switzerland, we use the European Commission's Standard Contractual Clauses, together with the UK Addendum where relevant, and we assess whether additional safeguards are needed. You may request a copy of these safeguards using the contact details below.
Account and project data is kept while your organization's subscription is active.
After termination, data may be exported for 30 days, then deleted within 60 days. Backup copies are removed within 90 days on the ordinary backup cycle.
Activity log entries are kept for [12 months]. Records we must keep for tax or accounting purposes are kept for [7 years]. Marketing contact details are kept until you unsubscribe.
Access to each customer's data is restricted at the database level, so signed-in users can reach only their own organization's records. Data is encrypted in transit and at rest, access is governed by user roles, and changes to records are logged.
We do not have standing access to your organization's account. Where we need to look at it to investigate a fault or answer a support request, a member of our team is given a read-only support role for that account, which allows viewing but no changes, and it is removed when the work is done. Anything we do while in an account appears in that account's activity log. A small number of our personnel also hold administrative credentials to the underlying database platform, which are needed to operate, back up and repair the service.
No system is perfectly secure. If a breach affects your personal information, we will notify the relevant supervisory authority within 72 hours where required, and notify you and our affected customers without undue delay.
Depending on where you live, you may have the right to:
To exercise any right, contact us at [privacy@zumiplan.com]. We will verify your identity before responding.
We respond within one month for GDPR and UK GDPR requests, extendable by two further months for complex requests, and within 45 days for CCPA/CPRA requests, extendable once by a further 45 days. You may use an authorized agent where your law permits.
If your information is in Zumiplan because an organization put it there, we will pass your request to that organization, who is responsible for answering it.
If you are in the EEA or UK you may complain to your local supervisory authority. In Ireland this is the Data Protection Commission; in the UK, the Information Commissioner's Office. California residents may contact the California Privacy Protection Agency or the Attorney General. We would appreciate the chance to resolve your concern first.
Zumiplan is a workplace tool and is not directed at anyone under 16. We do not knowingly collect information from children. If you believe a child has provided information, contact us and we will delete it.
We do not use your personal information to make automated decisions producing legal or similarly significant effects, and we do not use it to train machine learning models.
We will post any changes here and update the date above. For material changes affecting your rights, we will give notice by email or in the application before they take effect.
[If you appoint an EU or UK representative under GDPR Article 27, name them here.]
*This is a template, not legal advice. Complete every bracketed field, delete anything that is not true of your operation, and have a privacy lawyer review it before publishing.*