Privacy Policy

Blok Software Limited ("we", "us", "our") is the data controller responsible for the personal data described in this policy. We are a company registered in England and Wales under company number 16896983. Our website at bloksoftware.com, the Blok Founding Pilot Partner Programme, and any future Blok platform accounts are operated from the United Kingdom. The website and the services we provide are intended primarily for businesses and the people who represent them. They are not directed at children, and we do not knowingly seek or collect personal data from children under 18 years of age.

We may collect the following categories of personal data about you:

• Contact and identity data: your name, email address, telephone number, company name, job title and the name of the team or department you work in.
• Business context data: the number of employees at your organisation, your business sector or operational type, the software systems you currently use, and free-text descriptions of your operational challenges and business requirements.
• Marketing and feedback data: any information you provide about your willingness to participate in feedback sessions, user research or to provide a testimonial.
• Form submissions: information submitted through our contact form or pilot programme application form, including the message or application text you write.
• Technical data: your IP address, device type, operating system, browser type and version, and the pages of the site you visit.
• Analytics data: where you have consented to analytics cookies, anonymised usage data captured by Google Analytics 4.
• Communications: if you email or otherwise contact us directly, we keep a record of that correspondence.

We collect personal data in the following ways:

• Directly from you when you submit our contact form, pilot programme application form, or any other form on the site.
• When you create a Blok account once account registration becomes available on the Blok platform.
• When you communicate with us directly by email, phone or through any other channel we publish.
• Automatically through cookies and similar technologies, where you have given consent where it is required. This includes the analytics data described below.
• From your device and browser as you use the site, via server access logs and standard web technologies.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we need a lawful basis for each way we use your data. The table below summarises the main purposes and the corresponding lawful basis.

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of any processing carried out before withdrawal. Where we rely on legitimate interests, you have the right to object — see the "Your rights" section below.

Information you submit through our pilot programme application form is used to assess your suitability for the programme, to understand your operational requirements, and — if your application is successful — to support onboarding, configuration and implementation of the Blok platform at your organisation. We use the business context data you provide (sector, employee count, current systems, biggest operational challenge) to prepare a relevant demonstration and to match the right team member to your enquiry. We may also use the willingness-to-participate flags you provide to invite you to feedback sessions, surveys or case-study opportunities. You can opt out of these at any time by emailing support@bloksoftware.com.

We use Google Analytics 4 to understand how visitors use bloksoftware.com and to improve our website and services. Where you consent to analytics cookies, Google Analytics 4 may collect: IP address (truncated where configured), device and browser information, pages viewed, session duration, referral source, and approximate location (country or city). Analytics data is processed by Google LLC on our behalf. Google may process data outside the United Kingdom; the safeguards we apply to such transfers are set out in the "International transfers" section below. You can withdraw your consent at any time by revisiting the cookie banner or following the "Cookie settings" link in the footer.

Cookies are small text files placed on your device when you visit a website. We use cookies for the following purposes:

• Website functionality: to remember your preferences and keep core site behaviour working.
• Security: to help protect the site against abuse and unauthorised access.
• Analytics: to understand how the site is used (only with your consent).
• User preferences: to remember choices you have made, such as your cookie banner choice.

You can control cookies through your browser settings, including blocking or deleting cookies. Most browsers also allow you to set rules for when cookies may be set. Please note that disabling certain cookies may affect how the site works. Our cookie banner lets you accept or reject non-essential cookies and change your mind at any time.

When access to the Blok platform becomes available, we will collect and process account information such as your name, email address, authentication credentials, role, organisation, and activity logs. This information will be used for authentication, account administration, security, providing the features of the platform, and meeting our contractual obligations to you. We will publish an updated version of this policy before account registration opens, so the specific data we collect and how we use it is always clear at the point you sign up.

Where a customer uses the Blok platform to store or process personal data of their own workforce, customers or suppliers, Blok Software Limited will typically act as a Data Processor on behalf of the customer organisation (the Data Controller). Our standard processing terms will set out the specific data, purposes and obligations applicable to that arrangement.

Blok Software Limited is the data controller for the personal data described in this policy. For any privacy-related question, including requests to exercise your rights, please use the contact details shown below. We aim to respond to all enquiries within one calendar month.

We do not sell your personal data. We share it only with trusted third parties who process data on our behalf, including:

• Hostinger — provides our website hosting and email services.
• Google LLC — provides Google Analytics 4 where you have consented to analytics cookies.
• Cloudflare — used where appropriate for performance, security and traffic protection.
• Future software and infrastructure providers that support delivery of our services, including cloud hosting, transactional email, customer support tooling and analytics.

Each provider processes personal data only on our documented instructions and under a written agreement that includes appropriate confidentiality, security and data-protection commitments. A current list of our sub-processors is available on request.

Some of our third-party providers are based outside the United Kingdom, and they may process personal data outside the UK in the course of providing their services. Where personal data is transferred outside the UK, we use appropriate safeguards as required by the UK GDPR. These may include the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, transfers under a UK adequacy regulation, or another lawful transfer mechanism. If you would like more information about the specific safeguards in place for a particular provider, please contact us at support@bloksoftware.com.

We keep personal data only for as long as we need it for the purposes set out in this policy, after which we securely delete or anonymise it. Our current retention periods are:

• Enquiry data submitted through our contact form — up to 36 months from the date of submission.
• Pilot programme application data — up to 36 months from the date of submission, or for the duration of the pilot relationship and a reasonable period afterwards if you become a customer.
• Customer account data — for the duration of our relationship and up to six years thereafter where necessary to establish, exercise or defend legal claims, deal with any queries, complaints or legal obligations.
• Analytics data — retained according to the provider's settings and our business requirements (typically 14 months for Google Analytics 4 data).
• Cookie consent records — for 180 days from your last choice.

We may also retain personal data for longer where we are required to do so by law, regulatory obligation or by a court or regulator.

Blok Software Limited takes the security of your personal data seriously. We use a combination of appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include: encryption of data in transit (and at rest where appropriate); access controls and least-privilege principles for our team and any third-party providers; secure hosting infrastructure provided by reputable suppliers; ongoing monitoring, logging and security practices designed to detect and prevent unauthorised access; and staff training on data protection. While no system can be 100% secure, we continually review and improve our safeguards.

Under the UK GDPR you have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct information that is wrong or incomplete.
• Right to erasure — ask us to delete your personal data (the "right to be forgotten"), where applicable.
• Right to restrict processing — ask us to pause processing while a concern is investigated.
• Right to object — object to processing based on legitimate interests, including profiling.
• Right to data portability — receive your data in a structured, commonly used, machine-readable format.
• Right to withdraw consent — where we rely on consent (such as analytics cookies), you can withdraw it at any time without affecting earlier processing.

To exercise any of these rights, email us at support@bloksoftware.com. We will respond within one calendar month. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

The website and the services we provide are intended primarily for businesses and are not directed at children under 18 years of age. We do not knowingly seek or collect personal data from children under 18. If you believe we have collected information about a child, please contact us at support@bloksoftware.com and we will delete it.

We may update this privacy policy from time to time to reflect changes to our services, the technologies we use, or the law. The latest version will always be published on this page, with an updated "Last updated" date at the top. If a change is material, we will draw attention to it on the homepage or by other reasonable means. We encourage you to review this page periodically.