Privacy notice.

01Who is responsible for your data

APISMA SOLUTIONS LIMITED is the controller of personal data used for this website, business enquiries and API access qualification. We are registered in England and Wales, company number 13447411, with our registered office at Trafalgar House 712 London Road, West Thurrock, Grays, England, RM20 3JT.

For privacy questions or rights requests, email [email protected] or write to that office. You do not need an APISMA account. You can verify our identity in the Companies House record.

This notice covers the public website and related correspondence. Processing under a separately agreed partner service must also be described in the relevant service terms and any required data-processing agreement.

02The information we collect

• Business enquiries: your name, work email, company, role, integration categories and expected monthly volume.
• Correspondence: messages you send us, our replies and the information needed to review or follow up your request.
• Technical and anti-abuse data: IP address, browser or device information, request timing, verification results and information used to protect the form and website.

The form does not ask for payment details, identity documents, passwords, API keys or your customers’ personal data. Please do not send them. Our partnership application is intended for adult business representatives, not children. Tell us if a child has submitted personal information so we can remove it where appropriate.

03Why we use it and our legal bases

• To assess and answer an enquiry: our legitimate interests in responding to business contacts and evaluating a possible partnership. Where you are personally entering a contract, steps taken at your request before that contract may also apply.
• To deliver an acknowledgement and follow up: the same enquiry-handling purpose, not permission to add you to a marketing list.
• To prevent abuse and keep the site working: our legitimate interests in protecting visitors, staff and systems, balanced against your privacy.
• To handle legal obligations and rights requests: compliance with applicable law. Limited records may also be needed to establish, exercise or defend a legal claim.

Providing business details is voluntary, but without enough information we may be unable to evaluate or answer a request. If we rely on legitimate interests, you may object. We will consider your circumstances and explain any compelling reason for continuing.

04What happens when you submit

The access-request process validates the submission and its Cloudflare Turnstile check. Resend delivers an acknowledgement to your email, and a Telegram notification gives the operator the submitted business details for manual review.

Submission does not create a partner account or issue credentials. Qualification is reviewed by a person; we do not make a solely automated approval decision with legal or similarly significant effects. You may ask for a person to reconsider a decision.

The public form handler does not create a separate customer-database entry for the application. The enquiry and related correspondence are handled through the notification and communication services described below.

05Who receives information

• APISMA staff: people who need the information to review, respond to or administer your enquiry.
• Hosting and infrastructure providers: services that host the website and process requests, operational records and security data.
• Cloudflare Turnstile: technical and verification information needed for the anti-abuse check. See Cloudflare’s Privacy Policy.
• Resend: your email address, the name used in the acknowledgement, message content and delivery information. See Resend’s Privacy Policy.
• Telegram: the name, email, company, role, selected categories and expected volume included in the operator notification. See Telegram’s Privacy Policy.

We may share necessary information with professional advisers or competent authorities when required by law or necessary for a legal claim. We do not sell enquiry data, use it for cross-context behavioural advertising, publish your application or give suppliers a marketing list of applicants.

Providers may also process some technical or account information for their own purposes under their own policies. Their notices do not replace our responsibility for the processing we decide on.

06Processing outside the UK

Our communication and infrastructure providers operate internationally, so information may be processed outside the UK. A country may provide a different level of data protection from your home country.

For a restricted transfer, we require a lawful transfer mechanism, such as UK adequacy regulations or suitable contractual safeguards, and any assessment required by law. Submitting a form is not treated as blanket consent to an overseas transfer.

Contact [email protected] to ask where your enquiry data is handled and request information about the safeguards applicable to it. We will explain any lawful reason why a document must be partly redacted.

07Retention limits

We keep information only for a defined purpose. Our limits for records under APISMA’s control are:

• Withdrawn or declined applications: delete the enquiry and ordinary follow-up copies within 30 days after withdrawal or the decision, unless you ask us to reconsider it.
• Other inactive applications: delete within 90 days of the last meaningful exchange if no partnership proceeds. An automatic email or an internal note does not restart that period.
• Other routine business correspondence: delete within 12 months after the matter closes, unless a shorter application limit above applies.
• Routine website security records: retain for up to 30 days unless a specific incident needs further investigation. Short-lived anti-abuse records may expire sooner.

If a partnership proceeds, we keep only the information needed for that relationship under its separate retention arrangements. We do not retain every unsuccessful application for a standard six-year period.

A legal duty, active dispute or documented security incident may require a limited exception. We restrict the retained data to what is necessary, record the reason and review it when that reason ends. We will explain an exception affecting your deletion request unless the law prevents us from doing so.

Deletion covers our working copies, including operator notifications and correspondence. Providers may keep restricted security or backup records under their own schedules; we do not promise instant erasure from systems outside our control. Where a provider acts on our instructions, we require the applicable deletion process and will explain any remaining restricted retention on request.

08Withdrawing an enquiry or asking for deletion

Email [email protected], preferably from the address used for your enquiry. Say whether you want to withdraw the application, correct information, receive a copy or request deletion. A short message is enough; no special form, account or legal wording is required.

We may ask for the minimum information needed to verify that we are responding to the right person. We do not routinely require a passport or other identity document for a simple enquiry request.

We will explain what we have deleted or corrected, what remains, why it remains and the applicable retention criteria. Where required, we will notify recipients of a correction or deletion. You can withdraw an application without giving up other privacy rights.

09Your rights and response times

Depending on the applicable law and circumstances, you may request access, correction, erasure, restriction or portability of your personal data, object to processing, or withdraw consent where processing relies on consent. Withdrawing consent does not affect the lawfulness of earlier processing.

We respond without undue delay and normally within one calendar month. If the law permits extra time for a complex request or several requests, we will explain the reason and revised deadline within the initial month. Rights requests are normally free; we will explain any lawful exception before charging a fee.

We do not penalise you for exercising a privacy right. You may use an authorised representative, subject to proportionate checks of their authority. If we cannot fully comply, we will explain the reason and how to challenge it.

10Cookies, analytics and security

The public marketing site does not use advertising cookies or audience-analytics trackers. The request form uses a technical anti-abuse check. Cloudflare may process browser and device signals for that check; see its policy linked above. Private partner services, if separately agreed, may have different essential-session requirements.

We will update this notice and provide any required choice before adding optional tracking. Refusing optional tracking must not prevent a person from reading the public site or raising a privacy request.

We use access restrictions, server-side validation and other proportionate measures to protect enquiry information. No website or communication service can guarantee absolute security. Do not send secrets or sensitive records through the public form or ordinary email.

11Privacy complaints

Tell us about a concern at [email protected] so we can investigate. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or a competent data-protection authority in your jurisdiction.

You do not have to finish our internal process before contacting a regulator. Nothing in this notice limits a right to seek a remedy in court or another mandatory protection under applicable law.

12Updates and contact

We will show the date of a revision at the top of this notice. If a material change affects an ongoing enquiry, we will take reasonable steps to notify you using the contact details we hold. We will not silently repurpose an old enquiry for unrelated marketing.

Controller and contact: APISMA SOLUTIONS LIMITED, Trafalgar House 712 London Road, West Thurrock, Grays, England, RM20 3JT; [email protected]. The Website Terms explain the scope of the public site and access-request process.