Privacy notice

This notice describes how Runciter processes personal data about the people who hold Prudence accounts. It does not describe how a customer organisation processes personal data. The register inside Prudence serves that purpose.

Account data: name, email address and organisation memberships. Authentication data: sign-in method and session records. Usage data: the records created or changed by the account, captured in the audit trail, together with the service logs required to operate and secure Prudence.

Provision of the service under the subscription contract, relying on Article 6(1)(b). Security of the service and maintenance of the audit trail that gives the product evidential value, relying on the legitimate interests in Article 6(1)(f). Legal and accounting obligations of Runciter, relying on Article 6(1)(c).

Runciter does not use account data for advertising and does not sell it.

For the content of a register, Runciter acts as a processor on the documented instructions of the customer organisation, as required by Article 28(3)(a). That content is processed to provide the service and for no other purpose.

Account data is retained while the account remains active. Audit trail entries are retained for the life of the register, because their evidential value depends on being complete. When a subscription ends, the data is deleted after a defined wind-down period.

Prudence is hosted in the European Union and personal data is stored there. No transfer to a third country is required to provide the service.

Account holders may exercise the rights of access, rectification, erasure, restriction, portability and objection under Articles 15 to 21, and may lodge a complaint with a supervisory authority under Article 77. Requests sent to Runciter receive a response within the one month period set by Article 12(3).