Bracketed details and operational commitments require completion and legal review.
1. Who is responsible
Controller for website enquiries and business contacts: [legal entity, address and privacy contact]. For client environment data processed on an MSP’s instructions, Alignr may act as a processor; the final data processing agreement must identify the roles.
2. Information involved
The planned service may handle business contact details, account identifiers, device and configuration records, technician notes, client tickets, risk feedback, roadmap information and activity records. Confirm the actual categories collected, including hosting logs, before publication.
3. Purposes and lawful bases
Proposed purposes include responding to enquiries, delivering and securing the service, managing subscriptions and meeting legal obligations. Map each actual purpose to an appropriate lawful basis before publication. Marketing consent and any legitimate-interest assessment must be documented where applicable.
4. Where information comes from
Information may be provided by you, your employer or IT service provider, manual entry and integrations you authorise. The final notice must identify the relevant sources and whether providing each category is required.
5. Service providers and transfers
Publish the approved subprocessors, hosting locations, relevant recipients and international transfer safeguards before processing begins. These details have not been confirmed in this draft.
6. Retention and deletion
Set and publish retention periods or criteria for enquiry records, service data, logs and backups. Explain the data export and deletion process on account closure. No retention duration is asserted in this draft.
7. AI and automated processing
Confirm the actual AI providers, information shared, model-training restrictions and any automated decision-making with significant effects. The MCP-first product direction does not itself establish a data-sharing or model-training policy.
8. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction or portability, object to processing, and withdraw consent where relied upon. Submit requests to [privacy contact]. Where we process data for your IT provider, we may need to direct the request to that controller.
9. Complaints
Contact [privacy contact] with concerns. Where UK data protection law applies, you can complain to the Information Commissioner’s Office at ico.org.uk. Other jurisdictions may provide rights to contact a local supervisory authority.
10. Cookies and updates
See the draft cookie policy for matters that must be confirmed about site technologies. Add the effective date and explain how material changes will be communicated before this notice is published as final.
Drafting reference: ICO privacy notice guidance ↗