Plumsail Privacy Policy

Updated August 7, 2026

1. Who We Are and Scope of This Policy

Plumsail Inc. (“Plumsail,” “we,” “us,” or “our”) is a software company that develops and provides productivity, document automation, and workflow tools. Some products are standalone SaaS; others integrate with platforms such as Microsoft 365, SharePoint, and Power Automate.

This Privacy Policy applies to all of the following:

Our websites, including plumsail.com and its subdomains (such as community.plumsail.com)
Plumsail customer accounts and related account management
Plumsail products and services, including all features and functionality offered through those products
Our community and forum services
Customer communications, support interactions, and related correspondence
Our social media pages
Any other interaction with Plumsail in which personal information is collected or processed

Important note about Plumsail.io: This Privacy Policy does not apply to plumsail.io subdomains (for example, yourcompany.plumsail.io). These subdomains are operated by Plumsail customers to host their own web forms and content. Personal information collected through those subdomains is controlled by the relevant customer, not by Plumsail. Please refer to that customer's own privacy policy for information about how your data is handled.

This Policy is intended to give you a clear and honest account of how we handle your personal information. It covers both the information you provide directly to us and the information we collect automatically through your use of our services. Use of Plumsail products and services is also governed by the Master Service Agreement.

Our Role: Controller and Processor

Plumsail operates in two distinct capacities depending on the context, and it is important to understand the difference.

When Plumsail collects and processes personal information about its own website visitors, account holders, community members, support contacts, and marketing contacts (for example, to operate its websites, manage subscriptions, or respond to inquiries) Plumsail acts as a data controller. This Privacy Policy governs that processing.

When customers use Plumsail products and services to process personal information about their own end-users, employees, clients, or other individuals, Plumsail acts as a data processor on behalf of those customers. In that context, the customer is the data controller and is responsible for its own compliance obligations. Plumsail’s processing of that data is governed by the applicable Data Processing Agreement (DPA) between Plumsail and the customer, not by this Privacy Policy.

If you are an individual whose personal information is being processed through a Plumsail customer’s use of our products, and you have questions about how that data is handled or wish to exercise your rights in relation to it, you should contact that customer directly. Plumsail’s sub-processor register (listing the third parties Plumsail engages in the delivery of its products) is available at Plumsail Sub-processors.

Data Controller:
Plumsail Inc.
2125 Biscayne Boulevard, Suite 212, Miami, FL 33137, United States
Email: privacy@plumsail.com (Preferred method of communication for all privacy requests)

2. Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information:

Identity and contact data: name, email address, phone number, company name, and job title
Account and profile data: username, password (stored in hashed form), account preferences, product settings, and subscription details
Communications data: the content of inquiries, support requests, privacy or security-related messages, community posts, survey responses, and other correspondence with us
Transaction and payment data: billing address, subscription and order history, and payment confirmation details. We do not store full card numbers; payment card data is processed directly by our payment processor
Technical and usage data: IP address, browser type and version, operating system, device information, referring URL, pages visited, time on pages, and other usage and interaction data
Marketing and preference data: email marketing preferences, opt-in and opt-out records, and communication history

Where certain personal information is required to enter into or perform a contract with you, or to comply with a legal obligation, we may not be able to provide the relevant service without it. Where this is the case, we will make this clear at the point of collection.

3. How We Collect Personal Information

We collect personal information in the following ways:

Directly from you, when you use our websites, create an account, contact us, book a demonstration or meeting, submit a support request, complete a survey, or interact with our community
Automatically, through your use of our websites and services, via server logs, cookies, analytics tools, and similar technologies (see Sections 6 and 9)
From single sign-on providers, if you choose to sign in using a third-party identity provider such as Microsoft or Google
From service providers or third parties, where relevant, such as when a service provider passes us information in connection with your use of our services

Where certain data is required to enter into or perform a contract, or to comply with legal obligations, we may not be able to provide the relevant service without it.

4. How We Use Personal Information

We use personal information for the following purposes:

To operate, provide, maintain, and secure our services, including monitoring and protecting against security threats, fraud, and unauthorized access
To handle inquiries and contact requests, including general customer inquiries and pre-sales questions
To arrange demonstrations and appointments, including booking and managing demonstrations and meetings
To create and manage accounts, including setting up and maintaining Plumsail accounts, community accounts, and related access
To support single sign-on authentication, where applicable
To process orders, subscriptions, and payments, including billing, invoicing, and renewals
To respond to support requests, including technical support, troubleshooting, and customer service interactions
To handle privacy and security inquiries, including responding to data subject requests and any security-related communications
To send newsletters and marketing communications, where permitted by applicable law or with your consent
To conduct customer surveys and collect feedback, for the purpose of improving our services and understanding customer satisfaction
To analyze usage and improve our services, including understanding how our websites and products are used
To comply with legal obligations and respond to regulatory or legal requests
To prevent fraud, maintain service stability, and protect our rights and those of our users

Processing on behalf of customers: Where Plumsail acts as a data processor for a customer, the purposes and legal bases for that processing are determined by the customer as controller. That processing is governed by the applicable DPA and is outside the scope of this Privacy Policy.

Plumsail does not use fully automated decision-making processes that produce legal or similarly significant effects on individuals, in its own customer or business relationships.

5. Legal Bases for Processing

EU and UK Residents (GDPR and UK GDPR)

Where the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal information, we process it on one of the following legal bases:

Consent: where you have given your consent for a specific purpose, such as receiving our newsletter or accepting non-essential cookies. You may withdraw consent at any time.
Contract: where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract, such as providing your account or processing your subscription.
Legal obligation: where processing is necessary for us to comply with a legal obligation.
Legitimate interests: where processing is necessary for our legitimate interests, or those of a third party, provided those interests are not overridden by your rights and interests. Examples include maintaining the security and integrity of our services, preventing fraud, understanding how our services are used, and communicating with existing customers about relevant updates.

Swiss Residents (nFADP)

Where the Swiss Federal Act on Data Protection (nFADP) applies, we process your personal information on one of the following bases:

Consent: where you have given your consent for a specific purpose
Contract: where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract
Overriding interest: where processing is necessary for an overriding private or public interest, including maintaining the security of our services, preventing fraud, and communicating with existing customers
Legal obligation: where processing is necessary to comply with a legal obligation

Canadian Residents (PIPEDA and Quebec Law 25)

Where Canadian federal or provincial privacy law applies, we collect, use, and disclose your personal information with your consent, which may be express or implied depending on the sensitivity of the information and the circumstances of collection. You may withdraw your consent at any time, subject to legal or contractual restrictions, by contacting us at privacy@plumsail.com. In limited circumstances, we may collect or use personal information without consent where permitted or required by applicable law, such as for legal proceedings, law enforcement purposes, or where obtaining consent would compromise the accuracy or availability of the information.

Other Jurisdictions

For users located outside the jurisdictions mentioned above, Plumsail processes data in accordance with applicable local laws. Where no stricter local requirement applies, we use the standards set out in the GDPR as our baseline.

6. Cookies and Similar Technologies

We use cookies and similar technologies on our websites. Full details of the specific cookies we use, their duration, their providers, and how to manage your preferences are set out in our Cookie Policy. We encourage you to review it alongside this Privacy Policy.

7. Website Use, Accounts, and Communications

Informational Use of Our Websites

When you visit our websites without creating an account or submitting any information, our servers automatically record certain technical information in server logs. This typically includes:

IP address
Date and time of the request
Time zone difference to GMT
Content of the request (page or resource accessed)
Access status / HTTP status code
Amount of data transferred
Referring website (if applicable)
Browser type and version
Operating system and interface
Language and browser software version

This data is used to ensure the technical operation of our websites and to identify and address any errors or security issues. It is retained only for as long as necessary for these purposes and then deleted (see Section 12).

Hosting and Delivery

Our websites and related infrastructure are hosted by Hetzner Online GmbH (Germany). We also use Cloudflare, Inc. (USA) to help deliver our websites reliably and securely. Both providers act as data processors under appropriate data processing agreements.

For EEA, UK, Swiss, and Canadian users:

Hetzner International Data Transfer Mechanism: Hetzner processes data within the EU. No international transfer applies.
Cloudflare International Data Transfer Mechanism (EEA, UK, and Swiss users): For EEA users, the primary legal basis for any transfer of data to the USA is the adequacy decision of the European Commission in respect of the EU-U.S. Data Privacy Framework, as Cloudflare, Inc. is certified under that framework. If the EU-U.S. DPF adequacy decision is suspended or invalidated, transfers shall be governed by the Standard Contractual Clauses (Module 2, Controller to Processor) pursuant to European Commission Implementing Decision 2021/914, which Cloudflare maintains as a fallback mechanism. For UK users, the transfer is primarily covered by the UK-U.S. Data Bridge, under which Cloudflare, Inc. is separately certified, with the UK International Data Transfer Addendum to the EU SCCs applying as fallback. For Swiss users, the transfer is primarily covered by the Swiss-U.S. Data Privacy Framework, under which Cloudflare, Inc. is separately certified, with the EU SCCs applied with Swiss nFADP modifications serving as fallback.
Cloudflare International Data Transfer Mechanism (Canadian users): For users located in Canada, transfers of personal data to Cloudflare's US infrastructure are governed by contractual safeguards under Cloudflare's Data Processing Addendum, providing comparable protection as required under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Hetzner Privacy policy: Hetzner Online GmbH — Privacy Policy
Cloudflare Privacy policy: Cloudflare, Inc. — Privacy Policy

Contact Forms and Direct Contact

If you contact us through a contact form on our website, or directly by email, we process the personal information you provide (such as your name, email address, and the content of your message) to handle your inquiry and respond to you. If your inquiry develops into an ongoing customer relationship, relevant data may be retained as part of that relationship.

Booking Appointments

If you book a demonstration, consultation, or other appointment via our website, we process the personal information you provide for the purpose of arranging and managing that appointment. We may use third-party scheduling tools for this purpose.

Plumsail Accounts

To access most Plumsail products and services, you need to create a Plumsail account. Some products (for example, Plumsail HelpDesk and Plumsail Org Chart) are deployed into the customer's own Microsoft 365 environment and do not require a separate Plumsail account for end users. Where you do create a Plumsail account, we process the account information you provide (including your name, email address, and account credentials) to create and manage your account, authenticate you, and provide access to our services.

Community Accounts

If you register for our community at community.plumsail.com, we process your registration information and any content you submit (such as posts, comments, and replies) to provide and manage your community access. Community content may be visible to other community members.

Single Sign-On

You may have the option to sign into Plumsail using a third-party identity provider (i.e., Microsoft or Google). If you do so, we receive certain authentication and profile information from that provider, in accordance with your settings and the provider’s own privacy policy. We use this information to create or access your Plumsail account. Microsoft and Google act as independent data controllers for this processing; their privacy practices are governed by their own privacy policies.

Payments

Subscription fees and other payments are processed by Stripe, Inc. (USA). Stripe operates as an independent data controller for payment processing; it determines the purposes and means of processing payment data under its own legal obligations, including financial regulation, fraud prevention, and risk management. A data processing agreement does not apply to this arrangement. Plumsail does not store full payment card numbers. For information about how Stripe processes personal information, please refer to Stripe’s privacy policy.

8. Marketing, Surveys, and Related Communications

Marketing Communications

We may send marketing communications (including newsletters, product updates, and relevant announcements) to existing customers and, where applicable, to other contacts where permitted by law. Where required, we will obtain your consent before sending marketing communications. For users in the UK and EEA, this includes compliance with applicable rules on electronic marketing, including PECR and the ePrivacy framework where relevant.

You can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email we send, or by contacting us by email privacy@plumsail.com. We will process your request promptly.

We use Brevo (Sendinblue SAS) to send and manage our email communications.

Customer Surveys and Feedback

We may occasionally invite you to participate in surveys or to provide feedback on our services. Participation is voluntary. Any personal information you provide in connection with a survey is used to improve our services and to understand customer satisfaction. We may use third-party survey tools for this purpose.

CAN-SPAM Compliance

Our commercial email communications comply with the CAN-SPAM Act. Our emails identify Plumsail as the sender, use accurate and non-deceptive subject lines, include a valid physical postal address, and provide a clear and easy mechanism to opt out of future communications. Opt-out requests will be processed promptly.

9. Analytics, Tracking, and Related Providers

Google Analytics

We use Google Analytics, provided by Google LLC (USA), to analyze how visitors use our websites. Google Analytics collects information such as pages visited, time spent on pages, traffic sources, and device information, which we use to understand usage patterns and improve our websites. Where required by applicable law, Google Analytics is used only with your consent. You can also opt out via the Google Analytics Opt-out Browser Add-on. Google may also process some Analytics data for its own purposes (including product improvement and security) in which case Google acts as an independent controller.

FirstPromoter

We use FirstPromoter (Igil Webs SRL) to manage our affiliate and referral program. FirstPromoter may process information relating to referrals and affiliate activity in connection with our program. Where required, its use is subject to your consent.

Google Tag Manager

We use Google Tag Manager, provided by Google LLC (USA), to manage and deploy tracking and analytics tags on our websites. Google Tag Manager itself does not collect personal information, but it facilitates the use of the other tools described in this section.

Google Ads

We use Google Ads, provided by Google LLC (USA), to promote our services through paid advertising on Google's search and display networks. Google Ads uses cookies, including the _gcl_au conversion linker cookie, to track conversions and measure the effectiveness of our advertising campaigns. Where required by applicable law, Google Ads is used only with your consent. You can manage your Google advertising preferences at Google Ads Settings.

Microsoft Clarity

We use Microsoft Clarity, provided by Microsoft Corporation (USA), to understand how users interact with our websites. Microsoft operates Clarity as an independent data controller; it processes usage and interaction data under its own terms and privacy policy, and does not execute data processing agreements or joint controller arrangements in respect of Clarity. This is a controller-to-controller data sharing arrangement. Clarity may process usage and technical data, including page interactions, session replay data, device information, and IP-related data. Where required by applicable law, use of Microsoft Clarity on our websites is subject to your consent.

Clarity’s Terms of Use: Clarity — Terms of Use
Microsoft Privacy policy: Microsoft Corporation — Privacy Statement

For EEA, UK, Swiss and Canadian users: For details of the safeguards that apply to transfers of personal data to the United States by the providers listed in this section, please refer to Section 11.

10. When We Share Personal Information

We do not sell your personal information. We may share personal information with third parties in the following circumstances:

Hosting and infrastructure providers, including Hetzner and Cloudflare, who host and deliver our websites and services
Analytics, communications, and marketing providers, including Google Analytics, Google Tag Manager, Google Ads, FirstPromoter, and Brevo, for the purposes described in this Policy
Authentication providers, if you use single sign-on
Independent data controllers, including Stripe, Inc. for payment processing and Microsoft Corporation for Clarity analytics, who process personal information under their own terms and privacy policies. Plumsail is not responsible for the processing carried out by these parties in their capacity as independent controllers
Professional advisors, including legal, financial, and compliance advisors, where necessary
Regulatory authorities, law enforcement, or courts, where we are required or permitted to do so by applicable law, or where necessary to protect our rights, property, or the safety of others
In the event of a business transaction, such as a merger, acquisition, or sale of assets, in which case personal information may be transferred as part of that transaction, subject to appropriate confidentiality obligations

Where we share data with third parties who process it on our behalf, we require them to comply with appropriate data protection standards and, where required, to enter into data processing agreements.

A full list of sub-processors is maintained separately and is available to customers on request or via our website at plumsail.com/sub-processors

11. International Data Transfers

Plumsail is based in the United States, and some of the providers and tools we use are located outside the EEA, the United Kingdom, or Switzerland.

Where we transfer personal information internationally, we use appropriate safeguards in line with applicable data protection laws. Depending on the provider and destination, these safeguards may include:

Adequacy decisions, where applicable, including the EU-U.S. Data Privacy Framework or the UK Extension or the Swiss-U.S. Data Privacy Framework where relevant
Standard Contractual Clauses (SCCs) adopted by the European Commission, including where applicable the modifications required for transfers subject to the Swiss Federal Act on Data Protection (nFADP) as recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC)
The UK International Data Transfer Addendum issued by the Information Commissioner's Office, where applicable
Contractual protections and comparable safeguards for transfers subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25), ensuring an equivalent level of protection applies to personal information transferred outside Canada
Other recognized transfer mechanisms or supplementary safeguards, where appropriate

We may offer customers the ability to select a preferred hosting or service region for certain Plumsail products. However, even where a region is selected, some supporting services, operational activities, or limited support functions may still involve processing in other jurisdictions, including the United States, depending on the product, feature, and configuration.

We aim to be transparent about this and to ensure that appropriate safeguards are in place wherever personal information is processed.

12. Retention of Personal Information

We retain personal information only for as long as necessary for the purposes for which it was collected, and in accordance with applicable law. When data is no longer required, we take reasonable steps to delete, anonymize, or securely dispose of it.

Retention periods may vary depending on the type of data involved and the service or product concerned. Relevant factors include:

Legal obligations, including tax, accounting, and regulatory requirements
Security purposes, including the need to retain certain logs for security monitoring and incident response
Support purposes, including the ability to assist with customer queries relating to past interactions
Billing and subscription management, including retention of transaction records
Dispute handling, including retention of information that may be relevant to any disputes or claims
Compliance purposes, including the ability to demonstrate compliance with our legal obligations

Where personal information cannot be deleted because it is subject to a legal retention obligation, we restrict its processing so that it is blocked and not used for any other purpose for the duration of the retention period. This applies, for example, to data that must be retained for tax or commercial law reasons.

13. Your Privacy Rights

The rights available to you depend on your location and the law applicable to you.

Rights available to all users

Regardless of your location, you may contact us at any time to:

Access: request a copy of the personal information we hold about you
Correction: request that we correct inaccurate or incomplete personal information
Deletion: request that we delete your personal information, subject to applicable legal exceptions
Data portability: request your personal information in a structured, commonly used, and machine-readable format

Additional rights for EEA and UK residents (GDPR and UK GDPR)

If the GDPR or UK GDPR applies to you, you also have the right to:

Restriction of processing: request that we restrict our processing of your personal information in certain circumstances
Object to processing: object to processing based on our legitimate interests, including for direct marketing purposes
Withdraw consent: where processing is based on your consent, withdraw that consent at any time, without affecting the lawfulness of processing that took place before withdrawal

Additional rights for Swiss residents (nFADP)

If the Swiss Federal Act on Data Protection (nFADP) applies to you, you have the right to access, correct, delete, and obtain a portable copy of your personal information. You also have the right to object to processing in certain circumstances. If you have a concern about our data practices, you may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch/en.

Additional rights for Canadian residents (PIPEDA and Quebec Law 25)

If you are located in Canada, you have the right to access and correct the personal information we hold about you, and to withdraw your consent to processing at any time, subject to legal or contractual restrictions. If you are a resident of Quebec, you also have the right to request the deletion of your personal information and to be informed of any automated decision-making that produces legal or significant effects concerning you. If you have a concern about our data practices, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or the Commission d'accès à l'information du Québec at www.cai.gouv.qc.ca if you are a Quebec resident.

US State Privacy Rights

Residents of certain US states have additional privacy rights under applicable state law. Please refer to Section 14 for full details, including the states covered and the rights available to you.

How to exercise your rights

To exercise any of the rights described above, please email us at privacy@plumsail.com. We may need to verify your identity before processing your request. We will respond in accordance with applicable law and within the timeframes required by your jurisdiction.

Complaints and regulatory recourse

If you have a concern about the way we handle your personal information, you may contact the relevant regulatory authority:

US residents: you may contact the Federal Trade Commission (FTC) at ftc.gov/consumer. California residents may also contact the California Privacy Protection Agency (CPPA) at www.cppa.ca.gov
UK residents: you may contact the Information Commissioner's Office (ICO) at www.ico.org.uk
EEA residents: you may contact the supervisory authority in your country of residence or the authority with jurisdiction over Plumsail.
Swiss residents: you may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch/en
Canadian residents: you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca. Quebec residents may also contact the Commission d'accès à l'information at www.cai.gouv.qc.ca

14. Additional Notice for US Residents

If you are a resident of a US state with an applicable comprehensive privacy law, you may have specific privacy rights. This section explains those rights and how to exercise them.

The laws covered by this section include:

California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA)
Colorado Privacy Act (CPA)
Connecticut Data Privacy Act (CTDPA)
Virginia Consumer Data Protection Act (VCDPA)
Texas Data Privacy and Security Act (TDPSA)

Residents of the following states also have rights under applicable comprehensive privacy laws in their state: Utah (UCPA), Oregon (OCPA), Montana (MTCDPA), Delaware (DPDPA), Iowa (ICDPA), Nebraska (NDPA), New Hampshire (NHPA), New Jersey (NJDPA), Tennessee (TIPA), Minnesota (MNDPA), Maryland (MODPA), Indiana (INCDPA), Kentucky (KCDPA), and Rhode Island (RIDTPPA).

As additional state privacy laws come into effect, Plumsail will honor the rights and obligations they establish. This section will be updated accordingly.

Rights available to residents of all covered states

Depending on your state of residence, you may have the right to:

Access the personal information we hold about you, including the categories of information collected, the purposes for collection, and the categories of third parties with whom it is shared
Correct inaccurate personal information we hold about you
Request deletion of your personal information, subject to applicable exceptions
Obtain a portable copy of your personal information in a format that allows you to transfer it to another organization
Opt-out of the sale or sharing of your personal information, and opt out of the use of your personal information for targeted advertising or profiling in connection with decisions that produce legal or similarly significant effects
Appeal a decision we make in response to your rights request (see below)
Not be discriminated against for exercising any of the rights described in this section

Not all rights apply in all states. We will honor the rights applicable to you under the law of your state of residence.

Additional rights for California residents (CCPA/CPRA)

If you are a California resident, you also have the right to:
Know the specific pieces of personal information we have collected about you
Limit our use and disclosure of sensitive personal information to the purposes permitted under the CPRA
Request information about any automated decision-making processes that may affect you

Nevada residents

Plumsail does not sell personal information as defined under the Nevada Online Privacy Law. Nevada residents with questions about our data practices or who wish to submit an opt-out request may contact us at privacy@plumsail.com.

Sale and Sharing of Personal Information

We do not sell personal information for monetary or other valuable considerations. To the extent that any sharing of personal information may be characterized as "sharing" under the CCPA/CPRA (for example, sharing for purposes of cross-context behavioral advertising), we will handle it in accordance with the requirements of applicable state law.
You can opt out of this sharing at any time using the Your Privacy Choices link in our website footer, through your Plumsail account at Account → Privacy Settings (if you have an account), or by sending a Global Privacy Control (GPC) signal through your browser, which we honor automatically.

How to exercise your rights

To submit a request, please contact us by email at privacy@plumsail.com. We may need to verify your identity before processing your request. We will respond within the timeframe required by your applicable state law.

How to appeal a decision

If we decline your request, in whole or in part, you may appeal that decision by contacting us at privacy@plumsail.com with the subject line "Rights Request Appeal." We will review your appeal and respond within the timeframe required by your applicable state law. If your appeal is unsuccessful, you may have the right to submit a complaint to your state's data protection authority.

15. Children’s Data

Our websites, products, and services are not directed at children under the age of 18, and we do not knowingly collect personal information from anyone under 18.
Where we become aware that personal information has been collected from an individual under the age of 13 without verifiable parental consent, we will take appropriate steps to address this in accordance with applicable law, which may include deletion of the relevant information.

16. Social Media Pages

We maintain pages on social media platforms to present our organization and services. When you visit or interact with our pages, the platform operators process your personal information for their own purposes, including creating user profiles from your online behavior, displaying interest-based advertising on and off the platform, and storing information in cookies on your device. It cannot be ruled out that platform operators merge this information with other data they hold about you. Users wishing to object to this processing should use the settings available within each platform. It is also possible that some platform operators or their servers are located in jurisdictions outside your own, which may affect the ease with which you can enforce your privacy rights. Where you contact us directly via our social media pages, we process the personal information you provide in order to respond to your inquiry. Plumsail maintains pages on the following platforms: Facebook (Meta), YouTube, X (formerly Twitter), and LinkedIn.

We maintain a page on Facebook, operated by Meta Platforms Ireland Limited. Plumsail and Meta Platforms Ireland Limited share joint responsibility for the processing of personal information collected through visits to our Facebook page. The terms of this arrangement are set out in Meta's Page Controller Addendum, available at: www.facebook.com/legal/terms/page_controller_addendum.

You may direct any privacy rights request to either Plumsail or Meta. However, under our arrangement with Meta, we are required to forward any such requests to Meta, so you will generally receive a faster response by contacting Meta directly.

For EEA and UK users: this joint controller arrangement is established in accordance with the Court of Justice of the EU ruling in Case C-210/16 (Wirtschaftsakademie Schleswig-Holstein) and Article 26 of the GDPR. The legal basis for our processing of personal information received via social media pages is our legitimate interest in responding to communications directed to us (Article 6(1)(f) GDPR).

We may receive aggregated or anonymized insights about activity on our social media pages from the platform operators. Where we receive information that relates to an identifiable individual (for example, if you contact us via a social media page) we will use that information only to respond to your message and to manage our relationship with you.

X Corp Data Processing Settings: You can opt-out of data processing for advertising purposes via X's advertising settings.

LinkedIn Data Processing Settings: You can opt-out of data processing for advertising purposes via LinkedIn's advertising settings.

You can review each platform’s privacy practices here:

Meta Privacy policy: Meta Platforms Ireland Limited — Privacy Policy
YouTube Privacy policy: Google Ireland Limited — Privacy Policy
X Corp Privacy policy: X Corp. — Privacy Policy
LinkedIn Privacy policy: LinkedIn Ireland Unlimited Company — Privacy Policy

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the updated date at the top of this Policy. Where appropriate, we will notify you of changes by email or by posting a notice on our website. We encourage you to review this Policy periodically.

Where a material change affects customers who have entered into a Data Processing Agreement with Plumsail, we will provide notice in accordance with the terms of that agreement. Customers should ensure they review any such notifications and assess the impact on their own compliance obligations.

18. Contact Details

Our contact details are set out in Section 1 of this Policy. The preferred channel for all privacy and data subject rights requests is email: privacy@plumsail.com