Privacy Notice

This Privacy Notice describes how KACED DIGITAL LTD (trading as Asset Procure) collects, uses, and protects personal data when you use the Asset Procure platform (the "Service").

This is an information notice provided in accordance with applicable UK data protection law. This Privacy Notice does not constitute GDPR consent for any specific processing activity. Acknowledgement that you have read this notice is recorded separately from any consent mechanism.

1.1 KACED DIGITAL LTD is the data controller for the personal data it determines to process in connection with the Service. Base44, which provides the application platform, hosting, authentication, database infrastructure, and AI integration services, processes relevant application personal data on the Company's behalf as a processor under its Data Processing Addendum. The Company remains responsible for complying with its obligations as a controller under applicable UK data protection law.

2.1 The Service processes the following categories of personal data about users:

• Platform user data: platform user ID, email address, full name, and user role (admin or user).
• Organisation membership data: organisation membership records, including the organisation you belong to, your role within it (org admin or member), invitation status, and member administration data.
• Usage-event data: when a calculation is performed, a usage event is recorded containing the user ID and user email associated with the calculation, along with a cryptographic fingerprint of the calculation inputs and limited classifications (finance mode, asset category, billing class). The raw financial calculation inputs are not persisted for metering purposes. Asset Procure does not persist the raw calculation inputs for metering and does not use the SHA-256 fingerprint to reconstruct them. The asset name is excluded from the fingerprint.
• Billing and admin records: where billing, commercial terms, settlement, and usage-adjustment records are linked to users, the associated user identifiers are processed for administration and audit purposes.
• Legal acceptance records: when a user accepts the Terms of Use and acknowledges the Privacy Notice, a record is created containing the user ID, organisation ID, document versions accepted, and the date and time of acceptance.
• Stripe operational identifiers: where billing is administered through Stripe, operational identifiers (such as Stripe customer IDs) are stored and linked to the organisation. Payment-card data is handled by Stripe and is not stored in the Service's application database (see section 11).
• Webhook and audit metadata: limited metadata from webhook events and audit records, including event type, processing result, and timestamp.
• Administrative and audit records: records of administrative actions taken through the Service's administration functions, tax-monitor run and alert records, and security or operational audit information. These records are linked to admin user identifiers where applicable and do not contain end-customer identity or the raw financial inputs of calculations.

2.2 Calculation data is not persisted in raw form. The Service is designed so that the raw financial figures entered for a calculation (purchase price, lease payments, tax rates, solar assumptions, etc.) are not stored in the application database for metering. Metering stores only a SHA-256 fingerprint of the inputs plus limited classifications. The asset name is excluded from the fingerprint.

2.3 Generated PDFs are created client-side (in the user's browser) and are not stored by the Service. The Service does not retain copies of downloaded reports.

2.4 UsageEvent records that remain linked to a user ID and user email are treated as personal data, as the user ID and email allow an individual user to be identified within their organisation. Where usage events are aggregated or de-identified such that they can no longer be linked to an identifiable individual, they may no longer constitute personal data.

3.1 When you use the AI Explainer or AI-powered asset search features, the relevant prompts and input context are sent through Base44's AI integration for processing. The calculation context may include user-entered asset and calculation inputs, finance assumptions, tax assumptions, solar assumptions where applicable, and calculated outputs or results required to answer the user's request. The AI explanation feature is provided with the calculation context necessary to answer the user's request. The calculation context does not include Asset Procure source code or proprietary source implementation, organisation or account identity, or end-customer identity.

3.2 AI results are not persisted by the Service's application database. The Service does not store AI conversation history or generated explanations in its database.

3.3 AI functionality is provided through Base44's managed AI platform. Base44 may use subprocessors, including AI/LLM providers, in providing the platform and AI features, and maintains a current subprocessor directory identifying those providers and their processing locations. The Company does not control which specific AI/LLM provider handles an individual request, and no single provider is represented as handling every Asset Procure request. The applicable provider, subprocessor, retention, and international-transfer arrangements are governed by Base44's contractual documentation, including its Data Processing Addendum.

3.4 You should not enter unnecessary personal, confidential, or sensitive information into AI features. See also the Acceptable Use Policy.

4.1 We process personal data for the following purposes:

• providing and authenticating access to the Service;
• managing organisations and their members, including invitations and role administration;
• calculating usage and determining entitlement to calculations under the applicable commercial model;
• administering billing, including invoicing, payment processing, and account-status management;
• security, fraud prevention, and protection of the Service and its users;
• support and administration of the Service;
• maintaining legal and compliance records, including legal acceptance records and audit trails;
• operating AI assistance features when requested by the user.

5.1 The Service processes personal data on the following lawful bases:

• Performance of a contract or steps taken prior to entering a contract: processing necessary to provide the Service, including user authentication, organisation membership, and calculation entitlement.
• Legitimate interests: processing for B2B service administration, security, fraud prevention, usage metering, and audit, where those interests are not overridden by your rights and freedoms.
• Legal obligation: processing necessary to comply with a legal obligation, including retention of billing and tax-related records where applicable.

5.2 This Privacy Notice is an information notice and does not constitute consent. Where consent is required for a specific processing activity, it will be sought separately and will be capable of being withdrawn.

6.1 The following categories of recipients and processors may process personal data on behalf of the Company in connection with the Service:

• Base44 — provides the application platform, hosting, authentication, database infrastructure, and AI integration services, and processes relevant application personal data as a processor under its Data Processing Addendum.
• Stripe — provides payment processing and billing infrastructure. Stripe processes payment-card data directly; the Service does not store payment-card data. Stripe's Data Processing Addendum forms part of the Stripe Services Agreement.
• Base44-managed subprocessors, including AI/LLM providers — may process prompts and context when AI features are used. Base44 maintains a current subprocessor directory identifying those providers and their processing locations.

6.2 Base44 and Stripe may each use authorised subprocessors to deliver their services, subject to their respective Data Processing Addenda. The Company keeps its processor and subprocessor arrangements under review against the current contractual documentation of its providers.

7.1 Processing of personal data by the Company's service providers may involve jurisdictions outside the United Kingdom. The Company's service providers, including Base44 and Stripe, may process data in their own infrastructure locations, and their respective subprocessors may also process data outside the United Kingdom.

7.2 Where UK restricted transfer rules apply to a transfer of personal data outside the United Kingdom, the Company relies on the contractual and provider safeguards made available by its processors under their respective Data Processing Addenda, which may include Standard Contractual Clauses, the UK International Data Transfer Agreement, or other recognised transfer mechanisms as applicable to the relevant provider and transfer. The Company does not represent that a single transfer mechanism applies to every provider or transfer.

7.3 The Company keeps its international-transfer arrangements under review against the current contractual documentation of its processors and will update this Notice where material changes occur.

8.1 Personal data is retained for as long as necessary for the purposes described in this Privacy Notice, and in accordance with the following criteria-based approach:

• Account and membership data: retained while the user's account is active and for as long as is needed for service delivery and legitimate administration.
• Billing, settlement, usage, and audit records: retained as reasonably necessary for contractual, accounting, tax, fraud-prevention, dispute-resolution, and legal-obligation purposes.
• Legal acceptance records: retained as evidence of contractual acceptance for as long as is necessary to demonstrate the user's agreement to the applicable terms.
• Immutable records: certain records (such as usage events and billing settlements) are designed to protect record integrity. They are retained only for as long as reasonably necessary and lawful for contractual, accounting, tax, fraud-prevention, dispute-resolution or other legitimate or legal purposes. Technical immutability does not itself create a lawful reason to retain data.

9.1 Under applicable UK data protection law, you may have the following rights in respect of your personal data:

• the right of access to your personal data;
• the right to rectification of inaccurate personal data;
• the right to erasure of your personal data, where applicable and where no legal basis or exception requires retention;
• the right to restriction of processing;
• the right to object to processing;
• the right to data portability, where applicable; and
• the right to lodge a complaint with the Information Commissioner's Office (ICO).

9.2 The right to erasure applies only where no legal basis or exception requires the Company to retain the data. Where retention is necessary for compliance with a legal obligation, the establishment, exercise, or defence of legal claims, or the purposes described in this Privacy Notice, the Company may be unable to erase the data immediately.

9.3 To exercise any of these rights, please contact us using the contact details in section 12.

10.1 The Service is not designed to collect special-category personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data). You should not submit special-category personal data into the Service.

10.2 If you inadvertently submit special-category personal data, please contact us so that we can assess the situation and take appropriate action, including deletion where appropriate and legally/technically possible.

11.1 Payment-card data is handled by Stripe, the Company's payment processing provider. The Service does not store, receive, or transmit payment-card data in its application database. All card data is entered directly into Stripe's secure payment interface.

12.1 The Company may update this Privacy Notice from time to time. Where a material change is made, the Company will update the document version and where practicable provide notice to users.

12.2 If you have any questions about this Privacy Notice or wish to exercise your data protection rights, please contact us at: info@kaced-digital.co.uk

12.3 KACED DIGITAL LTD is registered with the Information Commissioner's Office (ICO) under registration reference ZC256704.