1. Introduction
This policy explains how Footer365 ("we", "us", "our") collects, uses and protects personal data when you visit our website, sign up for a trial, use the Footer365 service, or receive email from an organisation that uses it. We are committed to processing personal data in accordance with the UK GDPR and the Data Protection Act 2018.
2. Who we are
Footer365 is a product of Chillishot Limited, a company registered in England and Wales under company number 06493118, whose registered office is 144 Evesham Street, Redditch, England, B97 4HP. Chillishot Limited is the entity behind this policy, and references to "we" and "us" mean Chillishot Limited trading as Footer365. For the personal data in a customer's directory, and the other personal data we process to deliver the service to a customer, the customer is the data controller and we act as a data processor: see our data processing terms. For website visitors, account contacts and the other purposes described as ours below, we act as the controller.
3. Data we collect
- Account and contact data - names, work email addresses, phone numbers, job titles and roles for the owner, accounts and technical contacts you provide at signup.
- Organisation and billing data - company name, domain, address, VAT number and payment details (card details are handled by our payment provider; we store only a token, the card's brand, its last four digits and its expiry). If your organisation applies for our discount for charities, education and the public sector, we also keep the registration number it gives and any document it uploads to show it, which our staff check against the public register for that kind of organisation. If your organisation claims our switching offer, we keep the invoice or renewal notice from its current supplier that it uploads, which may name the people on it, to check the claim; it is kept for as long as the account exists and is never at a public address.
- Organisation group data - if your organisation heads or joins an organisation group, we record who is in the group, when each organisation joined and left and why, that a Global Administrator accepted for it and when, and the sessions the group's administrators open in a member's portal. The head is shown each member's name, seats, billing option and committed term and when it joined, but not who accepted for it or who asked to leave. A member is shown the head's name, the name, email address and telephone number of the head's accounts contact, or its account owner if it has none, and the names of the group's administrators.
- Sign-in data - when you sign in to a Footer365 portal, your name and work email address from Microsoft, the IP address and browser details of the sign-in, and how you authenticated, used to keep your account secure. Actions taken in the portals are recorded in an audit log with who took them. The audit log is our own record, as a controller.
- Records we keep to protect the service - as a controller, to enforce our acceptable use policy: the name and email address of whoever added a link to a campaign that was found to be unsafe, and of whoever tried to import HTML into the signature editor that is not allowed.
- Acceptance records - when someone accepts our agreements for an organisation, we record their name, work email address, Microsoft identity (the object and tenant identifiers Microsoft gives us), their role or what showed they could accept, the IP address and browser details of the acceptance, the wording they accepted and the exact versions of the documents. With each acceptance, and whenever they change, we also record the organisation's legal name, company and VAT numbers, registered and billing addresses and contacts. When we tell an organisation of a change to our agreements, we record each email we sent about it and, when someone opens the link in it, the time, IP address and browser details of the opening.
- Public register data - to confirm an organisation's VAT number and company status, we check the VAT number against the European Commission's VIES service, and may look the company up by its company number in its country's official company register, such as Companies House, or in the public Legal Entity Identifier index run by GLEIF. We record what they say, including whether the company has been dissolved or has entered an insolvency procedure. Only the VAT or company number is sent to them.
- Referral data - if an organisation signs up through another organisation's referral link, we record which organisation referred which, when the referred organisation signed up, how its subscription stands and the credit each was given. The referring organisation can see the name, signup date and status of each organisation it referred. If the referring organisation chooses, the organisation it referred sees its name when signing up.
- Directory data - as a processor, the user and group attributes we sync from your organisation's directory to build signatures (for example display name, job title, phone numbers, address, manager, preferred language and photo), and the details your organisation adds itself: values its administrators enter or import, values read from a source it names, photos uploaded in Footer365, and changes staff make to their own details where it allows them to.
- Mail processing data - as a processor, for each message we add a signature to: the sending address, which rule and template applied, and any message keyword the sender typed in the subject and what it did. For a message signed as it left the organisation, also the IP address of the sending mail server and how many recipients it had; for one our Outlook add-in handled, the kind of Outlook and the add-in's version; whether the sender deleted the add-in's signature before sending; and, for a reply or forward, how many of the organisation's earlier signatures and banners were tidied from the quoted part. Where an organisation uses the Outlook add-in alone, we also record each message the add-in sent without a signature, and why. We never store recipient addresses, the rest of a subject or message content. For messages carrying a campaign banner we also record the domains of the outside organisations it reached.
- Campaign click data - as a processor, when someone clicks a tracked link in a signature or campaign banner: the time, the country the click came from, and the IP address and browser details of the click, which are cleared after 90 days unless the organisation chooses another period. We work out the country ourselves, from a file of address ranges we hold, and send the IP address to no one. Separately, as a controller, we use the IP address of each request to our click tracking service to protect it from abuse: it limits how many requests one address can make in a minute, a count held only in memory, and, with the browser details, it is recorded in our audit log with any request the service fails to handle or any malformed form it rejects.
- Survey, image load and contact card data - as a processor, for organisations that use these features: answers to surveys in their messages, with any comment the person typed; when a campaign image first loaded in a message, where the organisation has turned on counting image loads; and how many times each contact card page was opened, scanned or saved each day. Section 4A explains each.
- Data sent to services an organisation connects - as a processor, only when an organisation connects a service of its own, such as its CRM: what that organisation tells us to send, such as a note of each click on its campaign links with the domain of the organisation its message went to, but never a recipient's email address, IP address or browser details.
- Usage and technical data - server log data and the device and browser information a request carries, used to keep the service running and secure. We do not run third-party analytics or tracking on the website.
- Support and contact data - the content of messages you send us. When you use the contact form on our website, we also record the IP address and browser details of the request, to investigate abuse.
- Status update subscriptions - if you subscribe on our status page to be emailed about incidents and planned maintenance, the email address you enter, what you chose to hear about, when you asked and when you confirmed, and which of our status emails were sent to it. We do not record the IP address or browser details of the request, and the subscription is not linked to any Footer365 account.
We do not read or retain the body of your email messages beyond adding the configured signature and, in a reply or forward, tidying the signatures and banners we added to your organisation's earlier messages in the quoted part, as your organisation's settings say. Our Outlook add-in reads the body of a message being written only on the sender's device, as section 4 explains, and never sends it to us.
4. The Outlook add-in
Footer365 Signatures is a Microsoft Outlook add-in, deployed centrally by your administrator rather than installed by you. It puts your signature into a message while you write it, and lets you see it and choose another one you are allowed to use. Where your organisation also uses Footer365's mail flow, signatures are added as email leaves the organisation as well, so a message the add-in does not sign is signed then. Where your organisation uses the add-in alone, a message the add-in does not sign is sent without a signature.
When it runs, the add-in:
- Signs you in with your existing Microsoft 365 identity using single sign-on. It receives your name, work email address and organisation identifier from Microsoft. It never sees or stores your password.
- Reads your directory details and the signatures your administrator has configured, so that the correct signature can be built for you and placed in the message.
- Reads the recipients of the message you are composing, to work out whether your internal or external signature applies. Only the domain part of those addresses is sent to us, for example example.com, and never the addresses themselves. It also sends the address you are sending from, so that the right mailbox's signature is returned, and whether the message is new, a reply or a forward.
- Writes the signature into the message you are composing, with an invisible marker so it can tell when you send whether the signature is still there, invisible marks around the signature, any banner and any disclaimer so that Footer365 can recognise them when the message is quoted in a later reply, and a message header that tells Footer365's mail flow the message is already signed. Where your administrator places a campaign banner above the message, the add-in hands it to Outlook, which adds it when the message is sent.
- Checks the message when you send it. It reads the body on your device, only to find its own marker and, in a reply or forward, the marks of signatures Footer365 added to the earlier messages it quotes, and never sends the body to us. Where your organisation has Footer365 tidy long conversations and a reply quotes such a signature, the add-in changes the message header so that the reply passes through Footer365's mail flow, which tidies your organisation's earlier signatures and banners in the quoted part. It reads the subject, and if the subject contains words starting with #, such as #nosig, it sends us those words alone, at most five, so that a message keyword your organisation has set up can be applied and taken out of the subject. The rest of the subject never leaves your device.
- Records each message it signed, so your administrator can see coverage and diagnose a signature that did not appear. That record holds the sending address, which template and rule applied, any message keyword used, which kind of Outlook you were using and the add-in's version, whether you deleted the signature before sending, and for a reply passed to Footer365's mail flow to be tidied, how many earlier signatures and banners were tidied. For a message carrying a campaign banner it also records the domains of the outside organisations the message reached. Where your organisation uses the add-in alone, it also records a message it sent without a signature, and why. It never records recipient addresses, the message body or the rest of the subject.
- Keeps the choices you make in it where your organisation allows them: your own default signature for new mail and for replies, and the campaign banner you chose from those it offers. We store which you chose, when, and whether you chose it in Outlook or on your My signature page.
- Offers your organisation's snippets where it uses them: ready-written text that the add-in puts into your message only when you select Insert, or copies for you when you select Copy. Each use is counted for your organisation, by snippet and day only, never with who used it, the message or its recipients.
- Shows a My details tab where your organisation has turned on staff self-service. Changes you make there to your own details, and a photo you upload, are sent to us; your organisation decides whether they need approving and whether they are also written back to its Microsoft 365 directory.
- Shows its own words in your language where Footer365 offers it, following Outlook's display language.
The add-in does not read your mailbox, other messages, attachments or message history. It never prevents a message from being sent: if it cannot run or cannot reach us, the message is sent, and where your organisation uses Footer365's mail flow the signature is added as it leaves instead.
On Microsoft 365 the add-in is governed by the permissions your administrator consented to, and your administrator can remove it at any time from the Microsoft 365 admin centre.
4A. If you receive email from an organisation that uses Footer365
The organisation that sent you the email decides what its signatures and banners contain and which of the features below it uses. It is the controller of what they record, and we process it for that organisation. To exercise your rights, contact that organisation; if you contact us, we pass your request to it.
- Tracked links. A link in a signature or banner may lead through our click tracking service, which records the click as section 3 describes, including the country it came from, and then takes you on to the page. It identifies nobody by name, and never records your email address.
- Counting image loads. Only where the organisation has turned it on for a campaign, the banner image is fetched from an address made for each message, and we record when it first loaded in that message. We keep no IP address or browser details with it. Your email program may fetch images automatically, or not at all.
- Surveys. If you answer a survey in an email, we record your answer and any comment you type, with the message it came from. We keep no email address, IP address or browser details with it.
- Contact cards and QR codes. A contact card is a page showing the details an organisation chose for one of its people. When you open one, scan a QR code that leads to one, or save its contact file, we count it once a day. To do so we hold a one-way code made from your IP address and browser details in memory for about a day, and never store it.
- Stopping banners. If you follow the opt-out link under a banner in an email from one of our customers, we act for that customer. If you press Stop these banners, we keep a one-way code made from your email address with a key held for that customer, when you asked, and which campaign the banner belonged to. We cannot read your address back from it, and we use it only to leave that customer's banners off email sent to you. It is kept until you or the customer ask for banners to be shown again, or the customer's account is deleted. The page sets one cookie, a security check for its form that ends when you close your browser, and we use your IP address briefly to limit how often the form can be sent, to protect the service from abuse.
5. How we use it
We use personal data to provide and secure the service, create and bill accounts, run the referral scheme and the discounts organisations apply for, send transactional messages (setup links, invoices, renewal and card-expiry notices, and notices of changes to our agreements), provide support, improve the product, and meet legal obligations.
6. Legal bases
We rely on: performance of a contract (to deliver the service you sign up for, and the offers and schemes your organisation takes part in); legitimate interests (to run, secure and improve our business, to keep evidence of what was agreed, and for limited marketing to business contacts); consent (where required, for example certain cookies, including the referral cookie described in our cookie policy, and status update emails, which you consent to by confirming the link we send and can withdraw with the link in every one); and legal obligation (for example accounting records).
7. Sharing
We share personal data with vetted sub-processors that help us run the service (hosting, email delivery, server monitoring and security, and checking the web addresses in campaigns, and in signature links whose clicks are counted, including a person's own profile or messaging link, against Google's lists of unsafe sites), and with the suppliers that hold our own records (payments, accounting and our own email), all listed on our sub-processors page. Our accounting records, which hold the billing details and contacts of the customers we invoice directly and of our resellers and distributors, are kept in Xero, our accounting software. Where an organisation connects a service of its own, such as its CRM, we send that service what the organisation tells us to; that service is the organisation's own supplier, not ours. We may disclose data where required by law. We do not sell personal data.
8. International transfers
Our servers are in the United Kingdom, and that is where your mail is processed and your directory and account data are stored. Some of the providers we rely on work outside the UK, as shown on our sub-processors page. Where data is transferred outside the UK, we use appropriate safeguards such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge) for a provider certified to it, the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses. A service an organisation connects processes data where that organisation's own agreement with it says.
9. Retention
We keep personal data only as long as needed for the purposes above and to meet legal, accounting or reporting requirements.
When a subscription ends, signatures stop and we stop collecting data from the organisation's directory. The organisation can export its data for 30 days, and its account and data are then deleted within a further 30 days, or sooner if its own administrator asks. If removing what Footer365 created in its Microsoft 365 tenant is not finished by then, the data is deleted as soon as that is finished or found impossible. Copies in our backups are deleted as those backups expire, within one month, and are never restored to the service. The deletion removes the directory data, signature content, mail processing and campaign click records, survey answers, image loads and contact card counts, the records of services it connected, its referral and discount records, portal users and sign-in sessions, and the account and its contacts. These records are kept after it, for the periods below, and then deleted:
- Invoices and related financial records, including the credits and discounts shown on them - 6 years from the end of the financial year they relate to, as the law requires.
- Acceptance records, the organisation details recorded with them, notices of change, the record of each notice email and its opening, and objections, and the record of the deletion - 7 years after the agreement they relate to ends, including after the account has been deleted or the person who accepted has left the organisation, so that either party can rely on them in a dispute.
- The audit log - entries are kept for 90 days, 180 days or 1 year depending on their severity, and for 30 days where they record the health of the service itself rather than an organisation's account. Once an account is deleted, its entries about security, consent, the agreements and billing are kept for those periods, and the rest are deleted 30 days after the deletion.
- Flagged campaign link findings - where an organisation's campaign links were ever flagged as unsafe, the findings behind that decision are kept for 1 year after its account is deleted.
- Sign-in sessions - deleted with the account, and otherwise 90 days after the session expired or was signed out.
While an account is open: the record of each message is kept for at most 90 days, after which only the number of messages handled each day is kept; the IP address and browser details of a campaign click are cleared after 90 days, or the period the organisation sets, and the click itself is deleted after at most 12 months; image loads are kept for the same period; and the record of each event we send to an address an organisation gave us is kept for 30 days.
We also keep the organisation's Microsoft tenant identifier and the date its trial started, with no name, address, user or mail data, so that a free trial cannot be taken twice.
A message sent through the contact form on our website, with the IP address and browser details recorded with it, is deleted 2 years after it arrives.
A request to subscribe to status updates that is not confirmed is deleted within a day of its link expiring, 48 hours after it was sent. A confirmed subscription is kept until you unsubscribe, which deletes it with the record of what was sent to it, and the record of which status emails were sent to an address is deleted after 30 days. Our audit log notes each change to a subscription with the address shortened to its first letter and its domain.
10. Your rights
Subject to conditions, you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent. To exercise a right, contact us using the details below. Where an organisation that uses Footer365 is the controller of your data, as section 4A describes, we pass your request to it. You may also complain to the UK Information Commissioner's Office (ICO).
11. Cookies
We use cookies and similar technologies as described in our cookie policy.
12. Security
We apply technical and organisational measures to protect personal data, including encryption in transit, application-level encryption at rest of the access tokens and credentials we hold for each organisation and for the services we connect to on its behalf, least-privilege access and audit logging. See our security page.
13. Changes
We may update this policy from time to time. Material changes will be notified through the service or on this page, with the "last updated" date revised.
For any privacy question or to exercise a right, email [email protected] or use our contact page.
