Privacy Policy – SysTec Analytics Ltd
Version: November 2026 • SysTec Analytics Ltd (Company Number 16804698)
Article 1 Purpose of this Privacy Policy
(1) This Privacy Policy explains how SysTec Analytics Ltd, Company Number 16804698, processes your personal data in connection with the use of our digital products and services.
(2) It applies in particular to the use of our website, web applications, mobile applications and all current and future digital products and modules developed and provided by SysTec Analytics Ltd (hereinafter collectively the "Services").
Article 2 Important notes and scope
(1) Our Services are primarily directed at businesses (B2B customers), e.g. property managers, investors, owners and professional users. Nevertheless, this policy may also apply to data subjects whose data are processed in the course of using our Services (e.g. tenants, contact persons, app users).
(2) The website and the Services are not directed at children and we do not knowingly collect data from children.
(3) For certain processing activities, additional agreements apply (e.g. a data processing agreement / Data Processing Agreement) that form an integral part of the contractual relationship.
Article 3 Terms and definitions
(1) "Personal data" means any information relating to an identified or identifiable natural person.
(2) "Processing" means any operation in connection with personal data, e.g. collection, storage, transmission, erasure.
(3) "Controller" means the entity that determines the purposes and means of the processing.
(4) "Processor" means an entity that processes personal data on behalf of the controller.
(5) "Special categories of personal data" include, among others, data concerning health, biometrics, religion, political opinions or sexual orientation.
Article 4 Controller
(1) The controller within the meaning of data-protection laws (including the UK GDPR and the GDPR) is:
SysTec Analytics Ltd
71–75 Shelton Street
Covent Garden, London
WC2H 9JQ, United Kingdom
(2) SysTec Analytics Ltd may also be controller for personal data of other persons that are transmitted to us by our customers (e.g. users, contact persons or tenants in the systems).
Article 5 Our obligations under data-protection law
We process personal data in particular under the following legal frameworks:
(1) UK GDPR (United Kingdom General Data Protection Regulation) and the Data Protection Act 2018, where processing takes place in Great Britain.
(2) GDPR (General Data Protection Regulation) and the respective national data-protection laws, where processing relates to data subjects in the EU, in particular Germany, Austria and Switzerland.
(3) We ensure that personal data are:
• processed lawfully, fairly and transparently,
• used only for specified, explicit purposes,
• limited to what is necessary,
• accurate and kept up to date,
• not stored longer than necessary, and
• protected by appropriate technical and organisational measures.
Article 6 Which personal data we process
Depending on the use of our Services, we may process, among others, the following categories of personal data:
• Contact and master data (name, address, e-mail, telephone number, position, company)
• Account data (login, username, roles and permissions)
• Contract and billing data (booked modules, tariffs, invoices, payment history)
• Usage data (log data, access times, functions used, interaction histories within the platform)
• Technical data (IP address, browser type, operating system, device information)
• Communication data (support requests, e-mails, chat logs)
• Publicly available data (e.g. from commercial registers)
As a rule we do not process special categories of personal data; where this is required in an individual case, it is done exclusively in strict compliance with the statutory requirements.
Article 7 Origin of the data
We collect personal data in particular:
• directly from you (e.g. upon registration, conclusion of a contract, support contact),
• from our business customers who use our platform to manage their data,
• via automated technologies (e.g. cookies, log files),
• from publicly accessible sources (e.g. company registers),
• from service providers and partners (e.g. payment providers, hosting providers, analytics tools).
Article 8 Legal bases for processing
We base the processing of personal data on the following legal bases:
(1) Performance of a contract (Art. 6(1)(b) GDPR / Art. 6 UK GDPR): where processing is necessary to perform a contract with you or to take steps prior to entering into a contract.
(2) Legal obligation (Art. 6(1)(c) GDPR / UK GDPR): e.g. tax retention obligations.
(3) Legitimate interest (Art. 6(1)(f) GDPR / UK GDPR): e.g. IT security, optimisation of the Services, prevention of abuse, enforcement of legal claims.
(4) Consent (Art. 6(1)(a) GDPR / UK GDPR): e.g. for certain marketing measures or disclosure to certain partners. You may withdraw consent at any time with effect for the future.
Article 9 Purposes for which we use your data
We use personal data in particular for the following purposes:
• registration and administration of customer accounts,
• provision, operation and improvement of the Services,
• processing of payments and billing,
• technical support and customer service,
• security and abuse monitoring,
• analysis and further development of our platform and modules,
• compliance with legal obligations,
• communication about product updates, system notices and relevant changes.
Article 10 Direct marketing and communication
(1) We may use your contact details to send you information about similar products and services of SysTec Analytics Ltd where this is legally permitted and you have not objected.
(2) You may unsubscribe from direct marketing at any time (e.g. via an unsubscribe link in e-mails or by message to support@systecanalytics-ltd.com).
(3) Even where you object to marketing communications, business-necessary messages (e.g. invoices, security-related notices) may still be sent.
Article 11 Disclosure of personal data
(1) We disclose personal data to third parties only where this is legally permitted or you have consented.
(2) Typical recipients include, for example:
• hosting and IT service providers,
• payment service providers,
• providers of support, ticketing or communication systems,
• analytics and monitoring service providers,
• lawyers, tax advisers and other professionals bound by secrecy,
• authorities, courts and supervisory bodies where legally required.
(3) Service providers are carefully selected and contractually obliged to confidentiality and compliance with data-protection requirements (e.g. through data processing agreements).
Article 12 International data transfers
(1) Where personal data are transferred to countries outside the United Kingdom or the European Economic Area, we ensure that an adequate level of data protection exists (e.g. through adequacy decisions or standard contractual clauses).
(2) Further information on the specific safeguards may be requested at any time from support@systecanalytics-ltd.com.
Article 13 Retention period
(1) We store personal data only for as long as required for the respective purposes or as required by statutory retention obligations.
(2) After the purposes cease to apply or statutory retention periods expire, data are deleted or anonymised.
Article 14 Data security
(1) SysTec Analytics Ltd implements technical and organisational security measures to protect personal data against loss, destruction, access, alteration or dissemination by unauthorised persons.
(2) In the event of a personal-data breach we will — where legally required — inform the competent supervisory authority and affected persons.
Article 15 Your data-protection rights
Under the GDPR and the UK GDPR you have, among others, the following rights:
• right of access,
• right to rectification,
• right to erasure ("right to be forgotten"),
• right to restriction of processing,
• right to data portability,
• right to object to certain processing,
• right to withdraw consent with effect for the future.
To exercise your rights you may contact support@systecanalytics-ltd.com at any time. We will handle requests within the framework of the statutory requirements.
Article 16 Contact, complaints and supervisory authorities
(1) For questions, concerns or to exercise your rights, please contact us at:
SysTec Analytics Ltd
Privacy
71–75 Shelton Street, Covent Garden
London, WC2H 9JQ, United Kingdom
E-mail: support@systecanalytics-ltd.com
(2) You also have the right to lodge a complaint with a competent data-protection supervisory authority, e.g.:
• in the United Kingdom with the Information Commissioner's Office (ICO) at www.ico.org.uk
• in Germany with the data-protection authority competent for your federal state.
Article 17 Changes to this Privacy Policy
(1) We may update this Privacy Policy as needed, for example where our Services or the legal situation change.
(2) The current version is always available in our online offerings. Continued use of the Services after an update constitutes acceptance of the amended Privacy Policy.
Article 18 Anonymous usage metrics (SystPectra)
(1) What we do. If you have given your consent, a script in your browser reads which parts of a page are visible, how far you scroll, how long a page stays open, how often you click, and your progress in multi-step flows. It stores no information on your device (no cookies, no local storage).
(2) What is stored. For each page view, one record without personal reference: platform, page path, visible time, scroll depth, page sections, progress and number of clicks, version of the measurement definition and a time rounded to the hour or day. Not stored: IP address, name, e-mail, user ID, device ID or exact time. Analysis is only carried out in aggregated form; reports are only shown once a minimum number of similar events is reached (k-anonymity).
(3) Purposes. (a) Insight into how CausaX is used in order to improve it; (b) training of SysTec Analytics Ltd's own AI models. Only metrics from users who have consented are used for training.
(4) Legal basis. For access to information on your device: your consent under Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act). Insofar as personal data should be involved: Art. 6(1)(a) GDPR. The stored metrics have no personal reference. Storing your decision (yes/no, day, text version) in your user account serves as proof of consent: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.
(5) Voluntary. Consent is voluntary. CausaX can be used in full without consent.
(6) Withdrawal. At any time with effect for the future under Account → Privacy (Art. 7(3) GDPR). The lawfulness of processing carried out until then remains unaffected. In addition, no measurement takes place while "Do Not Track" or "Global Privacy Control" is active.
(7) Retention. At most 90 days, then automatic deletion.
(8) Controller, storage location, recipients. The controller is SysTec Analytics Ltd, United Kingdom (see legal notice). The data is stored on servers in Germany; Hetzner Online GmbH acts as processor (Art. 28 GDPR). Transfer to the United Kingdom is based on the European Commission's adequacy decision under Art. 45 GDPR (renewed on 19 December 2025, valid until 27 December 2031). No disclosure to third parties, no use for advertising.