Privacy notice

Who is responsible for your data

In shortMAR Squared Ltd decides how your data is used for the website, accounts and billing. For data inside a product, your organisation decides.

1. MAR Squared Ltd (company number 14798239, registered office 86-90 Paul Street, London, EC2A 4NE, United Kingdom) is the controller for the personal data described in this notice. We are registered with the Information Commissioner’s Office (ICO) under number [ICO registration number: to be confirmed].
2. When an organisation uses a MAR² product, the data it puts into that product (for example its customers, tenants, staff or records) is controlled by that organisation, and we process it on its behalf under our data processing addendum. If your data is in a product used by an organisation you deal with, please contact that organisation first.
3. For any question about this notice or your data, email privacy@marsquared.com or write to us at our registered office, marked for the attention of the Data Protection Lead.

What we collect and why

In shortWe collect what we need to reply to you, run your account, bill your organisation and keep the service secure.

Where we get it

1. Most data comes directly from you. Some comes from your organisation, for example when an administrator invites you or connects single sign-on, and some is generated automatically when you use the site or a product.
2. We may obtain company details from public sources such as Companies House to check an organisation’s identity at sign-up.

Who we share it with

In shortOnly with the service providers that help us run MAR², and with authorities when the law requires.

1. We share personal data with service providers who process it on our instructions, such as hosting, email delivery and payment processing. They are listed on our sub-processors page.
2. If you use a product feature that sends data to a third party at your request, such as filing a return with HMRC or Companies House, or connecting a bank feed, we send the data needed for that purpose.
3. We may disclose data where required by law, to enforce our terms, or to protect the rights, property or safety of MAR Squared, our customers or others. If we sell or restructure our business, data may transfer to the new owner under the same protections.
4. We do not sell personal data, and we do not use it for third-party advertising.

Where it is stored

1. We host our platform on Microsoft Azure in the UK South (London) region. Customer data is stored in the United Kingdom.
2. Some service providers may access data from outside the UK, for example for support. Where they do, we rely on UK adequacy regulations or put in place the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

How long we keep it

Your rights

In shortYou can ask to see, correct, delete or move your data, and object to how we use it. It is free and we reply within a month.

1. You have the right to: access your personal data; have inaccurate data corrected; have data erased; restrict or object to our processing; data portability; and withdraw consent where we rely on it. You also have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. We do not make such decisions.
2. To use a right, email privacy@marsquared.com or use the Privacy option on our contact page. We may need to verify your identity. We respond within one month, which may be extended by two months for complex requests, and we do not normally charge.
3. If your request is about data held in a product on behalf of an organisation, we will pass it to that organisation and help it respond.

How we protect it

1. We protect personal data with encryption in transit and at rest, access controls, multi-factor authentication for administrators, separation between customer organisations, and audit logging. Our security overview gives more detail.

Cookies

1. Our website uses only cookies that are strictly necessary to sign you in and keep your session secure. Our cookie notice lists each one.

Children

1. Our website and products are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18.

Complaints

1. If you are unhappy with how we have handled your data, please tell us first at privacy@marsquared.com so we can put it right.
2. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

Changes to this notice

1. We will update this notice when our processing changes. The version and date at the top show the latest version, and the change log records each change. We will tell account holders about significant changes by email or in the product.