Privacy notice
Draft status: awaiting legal review
This draft sets out the topics that Ivy’s privacy notice will cover, including information used by the website and product, the purposes for that use, and the choices available to people who interact with Ivy. The final notice is still being prepared.
The sections below are for review and do not represent a final statement of Ivy’s data practices. The responsible entity, contact details and applicable terms must be confirmed before this draft is published as an approved privacy notice.
Reading this notice and its terms
How to read this draft
The terms below give context to the subjects covered by this draft. They help readers distinguish the website, the product and the people involved. Their final wording and application will be checked against the actual service before publication.
Terms used here
The following descriptions are included for review:
- Account describes a profile used to access Ivy or manage a team’s work within the product.
- Connected business describes an organisation linked to an account or using Ivy alongside another organisation. The final notice should explain when those organisations have separate responsibilities and how people can identify the organisation responsible for their information.
- Product describes Ivy’s email marketing software and the features included within the reviewed service.
- Responsible entity will identify the organisation operating Ivy, its registered address and the appropriate privacy contact. These details are awaiting confirmation and must be supplied in the approved version of this notice.
- Jurisdiction will identify the locations and legal requirements relevant to the reviewed activities.
- Device describes the computer, phone, tablet or other equipment someone uses to access Ivy.
- Personal information describes information associated with an identifiable person, subject to the applicable rules.
- Service describes the website and the Ivy product within the scope of the final notice.
- Service provider describes an external organisation that may support the operation of the website or product. The approved notice should identify the relevant categories of providers, explain which activities they support, and describe the circumstances in which they handle information. Those details will be checked against the actual arrangements with each provider.
- Activity information describes records relating to interactions with a website or product, such as page visits or feature use. The specific records, collection methods and purposes relevant to Ivy remain subject to review.
- You describes a person reading this notice, visiting the website or using the product on their own behalf or on behalf of an organisation. The final notice should explain any differences between these situations.
Information handled through Ivy
Categories of information
Contact and account details
The approved notice will describe which details are requested when someone contacts Ivy, books a demonstration or creates an account. The review should confirm which of the following categories apply, how they are provided and why they are needed:
- Email contact details
- Name and account profile
- Telephone contact details
- Business address and organisation details
- Account preferences and activity records
Website and product activity
This section is awaiting a verified inventory of the records generated when people visit the website or use Ivy. That inventory should distinguish information needed to deliver a requested feature from information used for other purposes.
The review should cover browser and device details, connection records, page visits, feature interactions and diagnostic events where relevant. The final notice must explain which records are actually collected, whether they relate to an account, and the purpose associated with each category.
Any differences between mobile and desktop access should also be described. This draft does not assert that a particular device identifier, location signal or diagnostic field is collected.
Brand materials and connected accounts
Ivy’s final notice should explain the handling of brand materials, campaign briefs, email examples and information made available through connected services. The scope of any connected Klaviyo account access must be checked against the permissions implemented in the product.
- Materials supplied by an account holder or their team: categories and purposes awaiting confirmation.
For each connection, the review should identify the information received, the operation requested by the user and the available controls for changing or removing access. The approved notice should distinguish user instructions from any other processing.
Purposes for handling information
Each purpose described in the final notice must be matched to actual product behaviour and an appropriate legal basis. The following topics are included as review headings, rather than statements that every activity occurs:
- Website enquiries. Explain what happens to information provided when someone asks a question, requests a demonstration or otherwise contacts the team.
- Account administration. Describe the information needed to create and manage an account, identify members of a team and maintain the permissions associated with their roles.
- Requested product features. Explain how information is used to carry out a user’s instructions, prepare email content and make drafts available for review within the services they connect.
- Support and troubleshooting. Identify the records used to investigate a reported problem, the people who may access those records and the safeguards that actually apply to that access.
- Communications. Distinguish messages about a requested service from promotional communications. Describe the relevant preferences and how a person can change them.
- Product development. Confirm whether and how information informs changes to the product, and explain any choices or restrictions that apply to those uses.
- Security and reliability. Describe verified activities relating to account protection, detection of misuse and the operation of the service without promising controls that have not been confirmed.
- Legal obligations. Explain the circumstances in which information may be required for an applicable obligation and identify any limitations relevant to that purpose.
How long information is kept
Retention periods are awaiting review. The approved notice should give the relevant periods or the criteria used to determine them, distinguishing active account information, support records, operational logs and backup copies.
The review should explain what changes when an account is closed or a connection is removed, including any information retained for a separate purpose. No deletion deadline or retention period is promised by this draft.
Providers and processing locations
The final notice will describe the providers involved in delivering Ivy and the locations relevant to their handling of information. Provider names, categories, contractual arrangements and processing locations must be verified against the actual service.
Where information moves between jurisdictions, the approved notice should explain the applicable arrangements and any available way to obtain further details. This draft does not state that a particular transfer mechanism has been adopted.
Removing information and connections
This section will explain the available account controls and the process for requesting deletion. The review must distinguish disconnecting a service, removing individual materials and closing an account, since those actions may affect different records.
The approved process should explain how a request is received, what information is needed to verify it and how the outcome is communicated. Contact details and response procedures remain to be confirmed.
When information is shared
Working with service providers
Describe the categories of providers involved in the reviewed activities, the information made available to them and the reasons for that access. The description should reflect the arrangements actually in place.
Changes to the business
Any wording about a business transfer must be reviewed for the relevant entity and circumstances. This placeholder does not establish a right to transfer information or describe a planned transaction.
Requests and legal requirements
The approved notice should describe the circumstances in which a request or obligation may require disclosure, together with the process used to assess it. Applicable rules and responsibilities require legal review.
Protecting personal information
A verified description of the relevant safeguards will be added here. The separate draft security overview lists subjects for review; neither draft asserts an audit result, certification, encryption standard or guarantee of security.
Age and eligibility
The intended audience, eligibility requirements and process for handling information relating to children must be confirmed for the service. The final notice should explain any applicable restrictions and the contact route for raising a concern.
Links and connected services
The website and product may refer people to separate services. The final notice should explain the scope of Ivy’s responsibility and help people identify the information provided by the operators of those services. Specific integrations remain subject to review.
Updates to this notice
The approved notice will carry a confirmed date and explain how material changes are communicated. This draft has no effective date and should not be treated as a final description of the service’s practices.
Cookies and browser preferences
The website’s use of cookies and similar storage must be checked against the implemented behaviour. The final description should distinguish essential preferences from optional analytics or marketing technologies.
Storage used by the website
For every relevant item, the review should record its name or category, purpose, provider and duration. The approved notice should explain whether the information remains in the browser or is also communicated to another service.
Preference categories
- Essential functions. Identify the storage needed for requested website functions and explain its purpose and duration.
- Usage measurement. Confirm whether optional measurement is implemented, what it records and when consent is requested.
- Marketing technologies. Confirm whether any such technology is active and describe the available choices before including it in the final notice.
Changing a browser preference
The approved notice should explain how the website’s preference controls work, how a previous choice can be changed and the effect of browser settings. The wording must be checked against the available interface.
Privacy requests and choices
The rights and choices relevant to an individual depend on the reviewed activities and applicable requirements. The final notice must explain the process for making a request without promising rights, exceptions or time limits that have not been confirmed.
Making a request
- Provide the approved contact route and the information needed to identify the relevant account or interaction.
- Explain the verification process and any support available to someone acting through an authorised representative.
- Describe how a response is delivered and how a person can raise a question about the outcome.
Contact details
The responsible organisation, postal address and privacy contact are awaiting confirmation. This draft intentionally does not provide an unverified contact address. Those details must be completed before the notice is approved.