Privacy
Policy

1. Who We Are and How to Contact Us

Gosen Group Limited (11425704) trading as Maplify Land Intelligence ("Maplify", "we", "us", "our") is a company registered in England and Wales (Company No. 11425704), with its registered office at [Registered Address], London.

We are the data controller responsible for the personal data we collect through the Maplify platform. This means we determine the purposes and means of processing your personal data.

Our Data Protection Officer can be contacted at: privacy@maplify.co.uk

For general enquiries: support@maplify.co.uk

We are registered with the Information Commissioner's Office (ICO) under registration number [ICO Registration Number]. You have the right to lodge a complaint with the ICO at any time (ico.org.uk).

2. What Personal Data We Collect

We collect and process the following categories of personal data:

Account & Identity Data: • Full name, email address, and password (hashed and salted) • Company name, job title, and industry sector (optional) • Phone number (optional, for enterprise accounts) • Profile photograph (optional)

Billing & Payment Data: • Billing address and payment method details (card processing handled exclusively by Stripe, Inc.; we do not store raw card numbers) • Subscription history and invoice records • Stripe customer ID and subscription ID

Usage & Technical Data: • IP address, browser type, device type, and operating system • Pages visited, features used, session duration, and click patterns • Search queries (postcodes, addresses, coordinates) entered into the platform • Map layers activated, sites saved, and reports generated • Cookies and similar tracking technologies (see our Cookie Policy)

Communications Data: • Support tickets, live chat transcripts, and email correspondence with our team • Feedback and survey responses you voluntarily provide • Marketing preferences and email engagement data

Location Data: • Approximate geographic location derived from IP address (country/city level) • Any property location or coordinate data you manually enter into the platform

We do not intentionally collect special category personal data (health, race, religion, biometric data, etc.). Please do not submit such data through the Service.

3. How We Collect Your Personal Data

We collect personal data through the following means:

Direct Collection: When you create an account, complete your profile, make a payment, contact support, submit a feedback form, or otherwise interact with the Service.

Automated Collection: Through cookies, web beacons, and server logs as you use the platform. See our Cookie Policy for full details.

Third Parties: We may receive data about you from payment processors (Stripe), analytics providers (Google Analytics, Microsoft Clarity), and authentication services where you choose to sign in via a third-party identity provider.

Publicly Available Sources: We may supplement your account data with publicly available professional information (e.g., LinkedIn profile data) where you have made this publicly available.

4. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

Contract Performance (Article 6(1)(b)): Processing necessary to provide the Service to you under our Terms of Service — including account creation, payment processing, and delivering map data.

Legitimate Interests (Article 6(1)(f)): Processing for our legitimate business interests, including platform security and fraud prevention, product analytics and improvement, customer support, and direct marketing to existing customers (subject to your right to opt out).

Legal Obligation (Article 6(1)(c)): Processing required to comply with applicable law, including financial record-keeping, tax reporting, and responding to lawful requests from regulatory or law enforcement authorities.

Consent (Article 6(1)(a)): Where we rely on your consent — for example, for non-essential cookies or marketing emails to prospective customers — you may withdraw consent at any time without affecting the lawfulness of prior processing.

5. How We Use Your Personal Data

We use your personal data for the following purposes:

Service Delivery: To create and manage your account, process payments, provide access to the platform, and deliver the features you use.

Communication: To send transactional emails (account confirmation, password reset, payment receipts), service notifications, and product updates. We may also contact you about your support requests.

Platform Improvement: To analyse usage patterns, diagnose technical issues, test new features, and improve the overall user experience through aggregated and de-identified analytics.

Security and Fraud Prevention: To monitor for suspicious activity, prevent unauthorised access, and protect the integrity of the platform and user accounts.

Legal Compliance: To meet our obligations under UK law, including financial reporting, responding to court orders or regulatory requests, and resolving disputes.

Marketing: To send newsletters, product announcements, and relevant industry updates to users who have opted in or are existing customers (with a right to opt out at any time).

6. Data Sharing and Third-Party Processors

We do not sell or rent your personal data to any third party. We share data only in the following circumstances:

Service Providers (Data Processors): We engage trusted third-party processors to support the operation of the Service. These include: • Stripe, Inc. — payment processing (stripe.com/privacy) • Google LLC — analytics (Google Analytics) and cloud infrastructure • Microsoft Corporation — analytics (Microsoft Clarity) and cloud services • Resend — transactional email delivery • Base44 — platform infrastructure and database hosting

All processors are bound by data processing agreements that restrict how they may use your data.

Legal Requirements: We may disclose personal data to law enforcement, regulators, or courts where required by law, court order, or to protect our legal rights or the safety of others.

Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred as part of that transaction. We will notify affected users in advance.

Aggregated or Anonymised Data: We may share aggregated, anonymised statistics about platform usage with partners or in public reports. This data cannot be used to identify individual users.

7. International Data Transfers

Some of our third-party processors are located outside the UK and European Economic Area (EEA). Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK ICO or the European Commission • Adequacy decisions recognising the destination country's data protection standards • The UK International Data Transfer Agreement (IDTA) where applicable

Transfers to the United States are covered by SCCs and, where applicable, the EU-US Data Privacy Framework or equivalent mechanisms.

8. Data Retention

We retain personal data for the following periods:

Account Data: For the duration of your account plus 3 years after closure, to comply with legal obligations and resolve disputes.

Payment & Financial Records: 7 years from the date of the transaction, as required by UK financial regulations (HMRC).

Usage Logs and Analytics: Aggregated analytics data retained indefinitely; individual session logs retained for 12 months.

Support Correspondence: 3 years from the date of last contact.

Marketing Data: Until you opt out or withdraw consent, after which we will suppress (not delete) your email to prevent re-addition.

Where we no longer have a lawful basis to retain personal data, we will securely delete or anonymise it.

9. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

Right of Access (Article 15): You have the right to request a copy of the personal data we hold about you, along with information about how and why we process it.

Right to Rectification (Article 16): You have the right to request correction of inaccurate or incomplete personal data.

Right to Erasure (Article 17): You have the right to request deletion of your personal data in certain circumstances, including where the data is no longer necessary, you withdraw consent, or you object to processing.

Right to Restriction of Processing (Article 18): You may request that we limit how we use your personal data in certain circumstances.

Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, machine-readable format and to transfer it to another data controller.

Right to Object (Article 21): You have the right to object to processing based on legitimate interests, including direct marketing (which you can opt out of at any time with immediate effect).

Rights Related to Automated Decision-Making (Article 22): We do not make purely automated decisions with legal or significant effects. If this changes, we will update this policy and provide appropriate opt-out mechanisms.

To exercise any of these rights, please contact privacy@maplify.co.uk. We will respond within 30 days. Identity verification may be required. There is no charge for exercising these rights, except in cases of manifestly unfounded or excessive requests.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Service. Full details are set out in our Cookie Policy, including the types of cookies we use, their purposes, and how to manage your preferences.

In summary: • Essential cookies are necessary for the platform to function and cannot be disabled • Analytics cookies (Google Analytics, Microsoft Clarity) help us understand usage patterns • Marketing cookies may be set by third-party advertising partners where you have consented

You may update your cookie preferences at any time via the cookie settings link in the website footer.

11. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures, including:

• TLS/SSL encryption for all data in transit • Hashed and salted password storage (bcrypt) • Role-based access controls limiting internal access to personal data • Regular security assessments and penetration testing • Automated monitoring for anomalous access patterns • Incident response procedures compliant with ICO breach notification requirements (72-hour notification)

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay and report to the ICO within 72 hours, as required by UK GDPR.

Despite our measures, no security system is impenetrable. You are responsible for keeping your account credentials secure.

12. Children's Privacy

The Service is not directed at children under the age of 18, and we do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will delete that data as quickly as practicable.

If you believe we may have inadvertently collected data from a child, please contact us at privacy@maplify.co.uk.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by email (to the address on your account) and/or by displaying a prominent notice on the platform at least 14 days before the changes take effect.

The "Last Updated" date at the top of this policy reflects when the most recent changes were made. We encourage you to review this policy periodically.

14. How to Contact Us and Raise a Complaint

For any privacy-related queries, to exercise your data rights, or to raise a concern:

Data Protection Officer Gosen Group Limited (11425704) trading as Maplify Land Intelligence Email: privacy@maplify.co.uk

If you are not satisfied with how we handle your complaint, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Telephone: 0303 123 1113 Website: ico.org.uk