How Requests360 handles personal information

1. Who we are

Forge4Biz is a trading name of Flevanta Origins Ltd, registered in England and Wales under company number 17519128. Registered office: 67 Tower Road, Felixstowe, England, IP11 7PR. Flevanta Origins Ltd is registered with the Information Commissioner's Office under reference ZC276310. Contact: [email protected].

2. Our data protection roles

For customer workspace content, the customer organisation normally decides why its staff, request, approval and external-case information is processed. The customer is therefore normally the controller and Flevanta Origins Ltd acts as its processor. Our Data Processing Agreement governs that processing.

Flevanta Origins Ltd acts as controller for its own account administration, subscription and billing records, service security, support communications, legal compliance, business enquiries and the operation of public or private demonstration accounts.

3. Information we handle

Depending on how you use the service, this may include your name, business email address, authentication identifiers, organisation and team memberships, roles, request and approval records, comments, audit events, External case contact details, support messages, security logs and basic technical information such as timestamps and IP or request metadata generated by our hosting providers.

Requests360 is not intended for passwords, payment-card numbers, health information, biometric data, criminal-offence data or other special-category information unless we have separately agreed suitable safeguards in writing.

4. Where information comes from and what is required

We receive information directly from you when you sign in, contact us or use the service. A customer organisation may also provide or create your business account, team membership, role or request information, and authorised users may enter information about business contacts as part of a request or External case. Basic account and security information is required to provide a secure authenticated service; if it is not provided, we may be unable to create or operate the relevant account or workspace.

5. Why we use information

Where Flevanta acts as controller, each purpose below is tied to its lawful basis. The legitimate interests are named in the same item.

• Creating and administering your account and workspace, and providing support: performance of a contract with you or your organisation, or legitimate interests in providing the service your employer has subscribed to, where you are not the contracting party.
• Keeping the service, accounts and systems secure, preventing misuse and investigating incidents (including security logs): legitimate interests in protecting our service, our customers and their users.
• Responding to business enquiries: legitimate interests in replying to and following up enquiries about our services.
• Invoices, accounting and tax records: legal obligation (Companies Act 2006 and HMRC record-keeping).
• Handling legal claims: legitimate interests in establishing, exercising or defending legal claims.
• Running demonstration accounts: legitimate interests in showing prospective customers how the service works.

We do not treat acceptance of this notice as consent to marketing. Requests360 currently does not use advertising trackers or behavioural advertising.

6. Browser storage

The application uses browser storage that is needed to keep you signed in and to remember the company workspace you selected. The selected workspace value is only a preference and never grants access; server-side membership checks and database row-level security control permissions. We do not intentionally use advertising cookies, session-replay tools or behavioural analytics in Requests360.

We use only storage that is strictly necessary: (1) a sign-in session token stored in your browser's local storage by the sign-in software, which connects only to our own UK server; it is not shared with any third party, (2) your selected workspace (forge4biz:active-workspace and forge4biz:membership-revision), (3) the navigation area you chose (requests360-selected-area in session storage, cleared when the tab closes), and (4) security cookies Cloudflare may set to protect the site from bots and attacks (for example __cf_bm, about 30 minutes). Because these are essential, we do not ask for consent and we do not show a cookie banner. If we ever add analytics or other non-essential cookies, we will ask first.

7. Service providers and international processing

The application, database and sign-in run on Flevanta Origins Ltd's own server in the United Kingdom. No outside database provider receives the data. All traffic goes through the Cloudflare, Inc. network and tunnel for CDN, TLS, DDoS protection and routing. Netlify, Inc. is a former host and is being removed after the DNS move. Our current subprocessor list is published on the Requests360 subprocessor page.

Where personal information goes outside the UK, the safeguard is named for that provider. A copy is available on request from [email protected].

• Cloudflare, Inc. (USA). Customer traffic uses Cloudflare's network by design. Transfers to Cloudflare, Inc. in the US rely on the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), under which Cloudflare states it is certified; if that certification lapses, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in Cloudflare's DPA applies.
• Hosting in the United Kingdom on Flevanta Origins Ltd's own server is not a restricted transfer.
• Database and sign-in. These run only on Flevanta Origins Ltd's own UK server; no outside database provider receives the data. This is not a restricted transfer. Supabase Pte. Ltd. is not a subprocessor.

We may also share personal information with our professional advisers (accountant and solicitor), with HMRC and other authorities where the law requires, and with a buyer of the business if it is sold.

Resend will only be added to the live Requests360 processing chain if the inbound email feature is activated. Stripe will only be added to the Requests360 customer billing flow when self-service billing is enabled. We update the subprocessor page before materially expanding production processing.

8. Retention

Customer workspace content is retained for the duration of the customer relationship and according to the customer's instructions. At the end of the service, we will return or delete customer personal data as set out in the Data Processing Agreement, subject to lawful retention. Residual copies in our own encrypted backups on Flevanta's server are kept for 30 days and then deleted automatically.

Flevanta's own business enquiry records are normally reviewed for deletion after 24 months without meaningful contact. Contract, invoice and accounting records may be retained for six years from the end of the financial year they relate to. Security logs are kept for 90 days. Support emails are kept for 24 months after the last contact.

9. Your rights

You have the right to access your personal information, and to ask us to correct, erase or restrict it, or to receive a portable copy. You have the right to object at any time to processing we carry out on the basis of legitimate interests; we will stop unless we have compelling legitimate grounds or need it for legal claims. Where we rely on your consent, you can withdraw it at any time without affecting earlier processing. To exercise a right, email [email protected]. We will normally respond within one month. If your request concerns information in your employer's or another customer's workspace, that customer is normally the controller; we will pass your request to them and assist them as required.

10. Automated decision-making

Requests360 does not currently make decisions about individuals solely by automated means that produce legal or similarly significant effects. Current case routing is deterministic workflow support and remains subject to human administration. Any future AI or high-impact automated decision feature will be separately assessed before activation.

11. Complaints

You can make a data protection complaint by emailing [email protected]. We will acknowledge a data protection complaint within 30 days, investigate it without undue delay, keep you appropriately informed and communicate the outcome. You also have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, at ico.org.uk/make-a-complaint or on 0303 123 1113.

12. Security and breaches

We use role-based access, row-level database controls, least-privilege application functions, encrypted transport, private secrets, backups and recovery testing appropriate to the service. No internet service can be guaranteed completely secure. We maintain an incident and breach process and will notify affected customers and regulators where the law requires.

13. Changes

We review this notice when the service, providers or law changes. Material changes that introduce a new use of personal information will be brought to affected users' or customers' attention before that new processing begins where required.