1. Who we are
Denwen RMM is provided by Denwen Ltd, a company registered in England and Wales (company number 12725457), whose registered office is at [TO CONFIRM: registered office address]. We are registered with the Information Commissioner’s Office under registration number [TO CONFIRM: ICO registration number].
In this policy “Denwen”, “we” and “us” mean Denwen Ltd. Questions about this policy or about your personal data can be sent to hello@denwen.co.uk [TO CONFIRM: dedicated privacy / data protection contact, if different].
2. Controller and processor
UK GDPR and EU GDPR distinguish between a controller, who decides why and how personal data is used, and a processor, who uses it only on a controller’s instructions. We act in both roles, for different data:
- Denwen as controller — for the personal data we collect to run our own business: visitors to our website, people who sign up for a trial or buy a subscription, users of the console as account holders, billing contacts, and anyone who emails us. This policy is our privacy notice for that data.
- Denwen as processor — for the data that Denwen RMM collects from the computers our customers enrol and manage (described in section 5). Our customer — the organisation that enrolled those devices — is the controller. Where that customer is a managed service provider acting for its own clients, the client is usually the controller, the managed service provider is its processor, and we are a sub-processor. Our obligations for this data are set out in our Data Processing Agreement.
If you use a computer that is managed with Denwen RMM — for example, at work — the organisation that manages it is responsible for telling you how your data is used, and for answering requests about it. We will help them do so, and we will pass on any request we receive.
3. What we collect as controller
Account and contact data
When you sign up, start a trial or are invited to the console: your name, work email address, organisation name, role, and the authentication data needed to sign you in (a password hash — never the password itself — multi-factor authentication enrolment, and, if your organisation uses single sign-on, the identifiers your identity provider sends us).
Billing data
Your organisation’s billing contact and billing address, subscription plan, invoices and payment status. Payments are taken by Stripe. Card details are entered into Stripe’s own payment pages and are never sent to, or stored by, Denwen.
Usage and security data about console users
When you use the console we record sign-ins, failed sign-in attempts, the IP address a request came from, and the actions you take, in an audit log. This is needed to keep the service secure and to let your organisation see who did what.
Website data
Our web server records standard request logs — IP address, time, the page requested and the browser’s user-agent string — to operate and protect the service. Our website does not use advertising or analytics trackers and sets no cookies (see section 11).
Correspondence
If you email us — for support, a sales enquiry or a security report — we keep the correspondence and the contact details in it.
4. Why we use it, and our lawful bases
| Purpose | Data | Lawful basis |
|---|---|---|
| Providing the service you or your organisation signed up for, including creating and securing accounts | Account data, usage and security data | Contract (Art. 6(1)(b)); where the account holder is an employee of our customer, our legitimate interest in providing the service the customer has bought (Art. 6(1)(f)) |
| Taking payment, invoicing, and keeping accounting records | Billing data | Contract (Art. 6(1)(b)); legal obligation for tax and accounting records (Art. 6(1)(c)) |
| Keeping the service and our customers secure: detecting abuse, investigating incidents, maintaining audit logs | Usage and security data, website logs | Legitimate interests (Art. 6(1)(f)) — protecting our customers and our platform |
| Answering enquiries, support requests and security reports | Correspondence | Legitimate interests (Art. 6(1)(f)); contract where it concerns an existing subscription |
| Telling customers about changes to the service, these terms, or security matters | Account and contact data | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Complying with law, responding to lawful requests, and establishing or defending legal claims | Any of the above, as needed | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
We do not sell personal data, and we do not use it for advertising. We do not make decisions about people based solely on automated processing that have legal or similarly significant effects.
5. Data we process for customers
When a customer enrols computers in Denwen RMM, the service processes the following on that customer’s behalf and on its documented instructions:
- Device inventory and telemetry: hardware, operating system, installed software, patch state and performance measurements, which may include the names of signed-in users
- Event log entries that the customer’s operators query
- Remote desktop sessions, and — where the customer turns recording on — recordings of those sessions
- Files transferred to or from managed devices
- Scripts the customer runs on its devices, and their output
- Alerts, and logs of notifications delivered to the customer’s chosen channels
- Mappings between alerts and tickets in the customer’s own professional services automation (PSA) system
- The audit trail of what the customer’s operators — and, where the customer has authorised it, Denwen staff — did
We use this data only to provide the service to that customer. Denwen staff have no standing access to it; see our Terms of Service (Provider access to your data) and the security questionnaire for how support access is granted and recorded.
7. International transfers
Denwen RMM runs on servers in the United Kingdom, and customer endpoint data is stored there. Some of our service providers (for example, Stripe) may process data outside the UK. Where personal data is transferred outside the UK or the European Economic Area to a country without an adequacy decision, we rely on the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, as applicable, together with any supplementary measures needed. The safeguard used for each provider is shown on the sub-processors page.
8. How long we keep it
| Data | How long |
|---|---|
| Account data | For as long as the account exists, then deleted or anonymised once the customer’s subscription ends and any return or deletion period has passed |
| Billing records | Six years from the end of the financial year they relate to, as required for UK tax and company records |
| Audit and security logs about console users | For the life of the customer’s tenant, as part of that customer’s audit trail, subject to the customer’s retention settings |
| Web server request logs | [TO CONFIRM: web server log retention period] |
| Correspondence | For as long as needed to deal with the matter and any follow-up, then for up to six years where it relates to a contract |
| Customer endpoint data (processed for customers) | According to the customer’s retention policy, which each tenant sets; session recordings are kept for at most 90 days. See the Data Processing Agreement for deletion at the end of the service |
9. How we protect it
All traffic to the service is encrypted with TLS. Console accounts can be protected with multi-factor authentication, which is mandatory for Denwen’s own staff. Session recordings are encrypted at rest. Access within a customer’s tenant is governed by roles the customer controls, and every action is written to an audit log that cannot be edited. Our security page and security questionnaire describe these measures in detail, including the limits.
10. Your rights
Under UK GDPR and EU GDPR you have the right to:
- be told how your personal data is used (this policy);
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased in certain circumstances;
- restrict or object to processing in certain circumstances, including processing based on legitimate interests;
- receive data you provided to us in a portable format, where processing is based on contract or consent; and
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email hello@denwen.co.uk. We will respond within one month, and may need to confirm your identity first. If your request concerns data held on a managed device — data for which our customer is the controller — we will pass it to that customer and help them respond.
12. Complaints
If you are unhappy with how we have handled your personal data, please contact us first and we will try to put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ico.org.uk, telephone 0303 123 1113), or, if you are in the European Economic Area, to the data protection authority in your country.
13. Changes to this policy
We will update this policy when how we handle personal data changes. The date at the top shows when it was last changed. Where a change is significant we will tell customers by email or in the console before it takes effect.
14. Contact
Denwen Ltd, [TO CONFIRM: registered office address]. Email: hello@denwen.co.uk. Security reports: security@denwen.co.uk.