1. Who we are

Obiter ("we", "us") is the trading name of the operator of this website and the Obiter platform. Company registration details: [company registration pending]. Registered address: [registered address pending]. We are the data controller for personal data collected through this website and the Obiter platform.

ICO registration: [ICO registration pending]. This policy will be updated with our company number, registered address, and ICO registration number before the platform accepts customer sign-ups.

2. What data we collect

We collect the following categories of personal data:

Account data: name, email address, firm name, job title, phone number.
Usage data: log files, feature usage, browser type, device identifiers, IP address.
Payment data: processed by Stripe. We do not store card details on our servers.
Client data: data you upload or create within the Obiter platform (matters, contacts, emails). You are the data controller for this data; we are the data processor.
Communications: emails and support messages you send to us.

3. Legal basis for processing

We process your data under the following legal bases:

Contract performance — to provide the Obiter service under our Terms of Service.
Legitimate interests — to improve our product, prevent fraud, and communicate with you about the service.
Legal obligation — to comply with applicable laws including HMRC tax obligations and the UK GDPR.
Consent — for marketing communications (you may withdraw at any time).

4. How we use your data

We use your personal data to:

Provide, maintain, and improve the Obiter platform
Send transactional communications (onboarding, billing, security alerts)
Send marketing communications (with your consent)
Comply with legal and regulatory obligations
Prevent fraud and ensure platform security
Provide customer support

5. Where we store your data

All data is stored within AWS EU-West-2 (London). We do not transfer personal data outside the UK or EEA without adequate safeguards in place.

6. How long we keep your data

We retain account data for as long as your account is active plus 90 days. Client matter data is retained for 7 years to comply with legal sector obligations, then securely deleted unless you request earlier deletion. You may request deletion of your account data at any time.

7. Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Rectify inaccurate data
Request erasure ("right to be forgotten")
Restrict or object to processing
Data portability
Withdraw consent for marketing at any time

To exercise any right, email privacy@obiteros.com. We will respond within 30 days.

8. Cookies

This marketing website does not set any analytics or tracking cookies. The Obiter platform itself uses essential cookies only (for example, to keep you signed in). See our Cookie Policy for full details.

9. Third-party processors

We share data with a small number of sub-processors, including: AWS (hosting) and Stripe (payments), together with the AI providers used for language processing. A complete, current sub-processor list is maintained in our Data Processing Agreement, available on request. All sub-processors are bound by Data Processing Agreements consistent with UK GDPR.

10. Contact us

For privacy questions, email privacy@obiteros.com. Postal address: [registered address pending].

If you are unsatisfied with our response, you have the right to lodge a complaint with the ICO at ico.org.uk.

Privacy Policy