FixMargin — Privacy Policy
Version 1.3 · Effective date: 5 September 2026
This policy explains how Quantix Prime Ltd (trading as FixMargin; company number 16680674; registered office Unit 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole, BH16 6FA) collects and uses personal data when you visit fixmargin.com, use the FixMargin application, or deal with us as a customer, supplier or prospect.
We are registered with the Information Commissioner’s Office (ICO) as a data controller (registration number ZC118594). Contact for privacy matters: Nicolae Aldea, Director — support@fixmargin.com, or by post to the registered office.
1. Two roles: controller and processor
We are a controller for: website visitors; people who sign up, log in and administer an account; billing contacts; people we contact for sales and marketing; and usage/analytics data about how the application is used.
We are a processor for: personal data your organisation puts into the application — for example the names of your site operatives on a daily report, supplier contact details on a price list, a signature on a delivery record, or a photograph taken on site. For that data your organisation is the controller, and we act only on its instructions under our Data Processing Addendum. If you are an operative, supplier or client of one of our customers and have questions about that data, please contact the customer organisation first; we will assist them.
2. What we collect and why (as controller)
| Category | Examples | Purpose | Lawful basis |
|---|---|---|---|
| Account data | name, work email, password (hashed), role, organisation, job title | create and secure your account, provide the Service, communicate about it | contract (Art. 6(1)(b)); legitimate interests (security) |
| Billing data | billing contact, company details, VAT number, invoice history; card details are collected by Stripe, not stored by us | take payment, issue invoices, prevent fraud, keep accounts | contract; legal obligation (tax/accounting records) |
| Usage data | pages and features used, actions taken, device/browser type, approximate location from IP, timestamps, error reports | operate, secure and improve the Service; understand activation and funnel; support you | legitimate interests (product improvement, security); consent for optional analytics cookies (see Cookie Policy) |
| Support and correspondence | emails, support requests, feedback, call notes | respond to you, improve the Service, keep records | legitimate interests; contract |
| Prospect / marketing data | name, business email, company, role, LinkedIn profile, notes on our conversations — obtained from you, your company website, Companies House, trade directories (e.g. FIS membership) or professional networks | contact businesses that fit our target market about FixMargin (B2B only) | legitimate interests (Art. 6(1)(f)) — see §5 |
| Security logs | IP address, authentication events, audit log of actions in the application | detect abuse, investigate incidents, meet security obligations | legitimate interests; legal obligation |
We do not collect special-category data as a controller. We do not use automated decision-making that produces legal or similarly significant effects on you.
Is providing data mandatory? Account and billing data are needed to enter into and perform the contract for the Service — without them we cannot open or maintain an account. All other data (support correspondence, optional analytics, marketing contact) is optional, and choosing not to provide it does not affect your use of the Service.
3. Where personal data comes from
Directly from you (sign-up, billing, support); from your organisation’s Admin (when you are invited as a user); automatically from your use of the Service; and, for prospects, from public business sources as described above.
4. AI-assisted features
Some features use a large-language-model service (Anthropic) to read documents you upload. At publication these are: extracting line items from supplier price lists you upload as PDF; extracting line items and totals from supplier invoices; and checking credit notes against the invoices they relate to. Content sent for this purpose is processed under a data-processing agreement; the provider does not use it to train its models and retains it for up to 30 days for safety purposes only. Outputs are suggestions for your review and can be corrected in the application. We will update this section when AI-assisted features are added.
5. B2B marketing and legitimate interests
Where we contact people at companies, LLPs and other corporate subscribers about FixMargin in their business capacity (specialist subcontractors in drylining, ceilings and interiors), we rely on our legitimate interests under UK data-protection law, having assessed that: the contact is business-to-business and relevant to your role; we use only professional contact details obtained from you or from public business sources; we send no more than a short sequence of messages; and every message identifies us and includes a simple way to opt out, which we honour immediately and permanently.
Different rules under the Privacy and Electronic Communications Regulations (PECR) apply to sole traders and certain partnerships (“individual subscribers”). We do not send unsolicited electronic direct marketing — by email, SMS or direct message on professional networks — to an individual subscriber unless we have their consent or another basis permitted by PECR.
You can object to marketing at any time by replying “unsubscribe” or emailing support@fixmargin.com.
6. Who we share personal data with (sub-processors and recipients)
We use carefully selected service providers who process personal data on our behalf under written contracts:
| Provider | Purpose | Location / transfer safeguard |
|---|---|---|
| Supabase Pte. Ltd | Database and file storage for the application (PostgreSQL, document/photo storage) | Data hosted in AWS eu-west-2 (London, UK) at our instruction; the contracting entity is established in Singapore, so the contract is a restricted transfer covered by the UK International Data Transfer Addendum (B.1.0) to the EU Standard Contractual Clauses (Modules 2 and 3), incorporated in Supabase’s Data Processing Addendum (Schedule 2) |
| Vercel Inc. | Application hosting, content delivery and edge network | Application code runs in Vercel’s London (lhr1) region; static content is served from a global edge network; the contracting entity is established in the USA, so the contract is a restricted transfer covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, incorporated in Vercel’s Data Processing Addendum (Schedule 3 §2 and Schedule 5) |
| Anthropic Ireland, Limited | AI-assisted document extraction (§4), only when the feature is used | Contracting entity established in Ireland (EEA, covered by the UK adequacy regulations); processing infrastructure primarily in the USA, covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (Modules 2 and 3) incorporated in Anthropic’s Data Processing Addendum (Schedule 3 §B); content retained up to 30 days for safety purposes only; not used to train models |
| PostHog Inc. | Product analytics — feature usage and funnel events (only with your consent). We do not use session recording or heatmaps. | Hosted on PostHog EU Cloud (Frankfurt); DPA signed 2 Sep 2026 incorporating the UK International Data Transfer Addendum to the EU SCCs; PostHog also participates in the EU-US Data Privacy Framework and its UK Extension |
| Amazon Web Services EMEA SARL (Amazon SES) | Outbound transactional email (account verification, password reset, invitations, privacy-request acknowledgements) | Sent from AWS eu-west-2 (London, UK); contracting entity established in Luxembourg (EEA, covered by the UK adequacy regulations); AWS GDPR Data Processing Addendum incorporating the UK International Data Transfer Addendum for any onward access |
| Google Cloud EMEA Ltd (Google Workspace) | Support mailbox (support@) and internal business administration | Ireland/EU (covered by the UK adequacy regulations); Google Cloud Data Processing Addendum incorporating the UK International Data Transfer Addendum for any onward access |
Independent controller: Stripe Payments UK Ltd processes payment-card data and billing transactions as an independent controller under its own privacy policy (stripe.com/privacy); we receive only billing-contact and transaction metadata.
We may also disclose personal data to professional advisers (accountants, solicitors, insurers), to a buyer or successor in a business sale (subject to this policy), and to regulators, courts or law enforcement where required by law.
We do not sell personal data, and we do not share it with advertisers.
7. International transfers
Our application data is stored in the UK. Several of our providers are companies established outside the UK (see §6), so contracting with them is a restricted transfer under UK GDPR Chapter V even where the data itself stays in the UK. For each such transfer we rely on UK adequacy regulations where they apply or, otherwise, on an appropriate safeguard — the UK International Data Transfer Agreement (IDTA) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as stated for each provider — and we carry out a transfer risk assessment applying the statutory data-protection test. You can request a copy of the relevant safeguard by emailing us.
8. Retention
| Data | Retention |
|---|---|
| Account and organisation data | for the life of the account, then deleted or de-identified within 90 days of closure (30-day export window + 60-day deletion) |
| Customer Data (where we act as processor) | retained and deleted in accordance with DPA §9 — ordinarily a 30-day export period after the contract ends, followed by deletion within a further 60 days, subject to the backup and legal-retention exceptions described there |
| Billing and tax records | 6 years after the end of the financial year (HMRC requirement) |
| Support correspondence | 3 years after the ticket is closed |
| Prospect/marketing data | until you opt out or 24 months after our last meaningful contact, whichever is sooner; opt-out records kept indefinitely to honour them |
| Security and audit logs | 12 months (audit log entries inside the application persist with the Customer Data they relate to) |
| Analytics events | 12 months, then aggregated |
9. Security
We use HTTPS everywhere, encryption at rest for database and file storage, hashed passwords, role-based access control, organisation-scoped data isolation, signed time-limited links for file access, audit logging, and regular automated backups. Access to production systems is restricted to authorised personnel with multi-factor authentication. No system is perfectly secure. If we suffer a personal data breach involving personal data for which we are controller, we will make the notifications required by Data Protection Law. For Customer Data that we process on behalf of a customer, we notify and assist the relevant customer in accordance with the DPA; that customer decides on any regulatory or data-subject notifications as controller.
10. Your rights
Under UK GDPR you can ask us to: access the personal data we hold about you; correct inaccurate data; erase data (where we have no overriding reason to keep it); restrict or object to processing (including objecting to direct marketing at any time); receive data you provided in a portable format; and withdraw consent where processing is based on consent (this does not affect processing before withdrawal).
To exercise a right, email support@fixmargin.com with “Data request” in the subject. We will respond within one month (extendable by two months for complex requests, with notice). We may need to verify your identity. If you are a user of a customer organisation and the request concerns data inside that organisation’s account, we will refer the request to that organisation as controller and assist them.
Data-protection complaints. You have the right to complain to us if you think we have handled your personal data in breach of data-protection law (section 164A, Data Protection Act 2018). You can do so through the complaints form at fixmargin.com/privacy#complaint, by emailing support@fixmargin.com with “Data protection complaint” in the subject line, or by post to our registered office. We will acknowledge your complaint within 30 days, investigate it appropriately, keep you informed where necessary and tell you the outcome without undue delay.
You can also complain to the Information Commissioner’s Office (ico.org.uk · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow SK9 5AF).
11. Cookies
See our separate Cookie Policy for the cookies and similar technologies we use, and how to manage optional analytics.
12. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.
13. Changes
We will post changes here with a new effective date and, for material changes affecting account holders, notify you by email or in-app at least 14 days in advance.