formatCTA Privacy Notice

UK & EEA Legally Compliant Data Protection Policy for Email Design Solutions

Contents

1. Introduction & Data Controller Information

Welcome to formatCTA. We are committed to respecting your privacy, protecting your personal data, and maintaining complete transparency regarding our data handling practices. This Privacy Notice explains how formatCTA Limited collects, processes, stores and safeguards personal data when you visit our websites, register for an account or utilise our email design platform and collaboration features.

This Privacy Notice applies strictly to all digital properties owned and operated by formatCTA Limited, including but not limited to:

• formatcta.com – Our main corporate website, product information hub, and public documentation portal.

• app.formatcta.com – The core web application, email template editor, brand asset manager, team user management system, and platform workflow engine.

• assets.formatcta.com – Our dedicated content delivery network (CDN) and secure asset hosting server for images, custom brand media and rendered email template graphics.

1.1 Data Controller Contact Details

For the purposes of the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the UK Data Protection Act 2018, formatCTA Limited acts as the Data Controller for the personal data processed in connection with user accounts and platform operations. If you have any inquiries, requests to exercise statutory data protection rights, or concerns regarding this policy, please contact our Data Protection Officer:

2. Personal Data We Collect & Sources of Data

To deliver an advanced email design solution – including custom brand areas, asset management and multi-user team collaboration – formatCTA collects information directly from you, automatically through your platform usage and from trusted third-party partners.

2.1 Information Provided Directly by You

• Account Registration & Profile Data: When you create an account as a Registered User or Customer, we collect your first name, last name, business email address, password hash, company name, job title, industry and country location.

• Team & Workspace Management Data: When team administrators invite colleagues to collaborate within brand areas, we collect the email addresses, assigned user roles (e.g., Administrator, Editor, Viewer), permission levels and workspace activity logs of invited team members.

• Brand Customisation & Asset Content: We collect and store digital assets uploaded to asset management, including logos, custom colour palettes, font specifications, HTML email template code, media files and design project files created or edited within the platform.

2.2 Information Collected Automatically

When you navigate or interact with our websites and editor, our servers automatically record log telemetry and technical metrics. This technical data includes your Internet Protocol (IP) address, browser type and version, operating system, device hardware identifiers, language preferences, referring URLs, timestamps of visits, pages viewed, time spent per feature and interaction logs within the email template editor.

2.3 Data Received from Third Parties

We receive personal information about you from external third parties in specific operational scenarios:

• Single Sign-On (SSO) & Authentication Providers: If you register or log in using third-party single sign-on services such as Google Authentication, we receive your authenticated profile details (name, email address, profile picture and account ID) as permitted by your third-party privacy settings.

• Payment Service Providers: When you subscribe to paid plans, our payment processor, Stripe, provides us with transaction verification metadata, including payment status, subscription tier, billing country, transaction ID and the last four digits of your payment card. (Full card credentials are collected directly by Stripe).

• Social Media & Marketing Platforms: We receive professional background information (such as company size, industry category and public business profiles) from third-party marketing, lead qualification and social media platforms (e.g. LinkedIn, Google) to tailor our commercial offerings.

2.4 Special Category / Sensitive Data Exclusion

formatCTA does not intentionally request or collect special category sensitive personal data (such as health information, racial or ethnic origin, political opinions, religious beliefs, biometrics, or trade union membership). Users are explicitly instructed not to upload or submit sensitive personal data through our platform or AI features.

3. Lawful Bases & Purposes of Processing (UK & EEA GDPR)

Under Article 6 of the UK GDPR and EU GDPR, formatCTA processes personal data only where a valid legal basis exists. The legal bases we rely upon include:

• Performance of a Contract: Processing necessary to execute our Terms of Service, provide platform access, manage team user roles, host brand assets, restore saved templates and deliver customer support.

• Legitimate Interests: Processing necessary for our legitimate business interests in securing our infrastructure, detecting fraudulent activity, performing system debugging and analysing user activity for analytics and forecasting.

• Compliance with Legal Obligations: Processing required to comply with UK statutory accounting, corporate tax, statutory auditing and law enforcement obligations.

• Consent: Processing based on freely given, explicit consent for opt-in direct marketing communications and non-essential website tracking cookies.

3.1 Mapping of Processing Purposes & Legal Bases

4. Analytics, Forecasting & Content Analysis

formatCTA utilises personal data and platform telemetry for internal data analysis, operational forecasting and service optimisation. This processing is essential to maintain a high-performing email editor and anticipate system resource demands.

4.1 Platform Content & Activity Analysis

We analyse user activity and the contents uploaded to accounts – including template design structures, search terms within our asset manager, media file upload frequencies and interaction patterns with editing tools. This analysis enables us to:

• Build intelligent search algorithms to deliver highly relevant design assets and email layout suggestions.

• Forecast cloud infrastructure capacity, storage bandwidth and server load across formatcta.com and assets.formatcta.com.

• Identify platform usability bottlenecks, refine editing workflow performance and optimise design features.

Where analytical evaluations are conducted for broad product research, data is aggregated and anonymised so that individual real persons cannot be identified.

5. Artificial Intelligence (AI) Features & Subprocessors

formatCTA offers optional AI-assisted features within the platform (such as AI text generation, subject line optimisation and automated layout suggestions). These features are powered exclusively via integrations with specialised third-party AI technology providers.

5.1 AI Data Handling & Model Training Exclusion

• Sole Purpose Processing: When you choose to activate an AI tool, your input prompt and relevant design context are transmitted to our third-party AI providers solely for the purpose of generating the requested output.

• No Model Training Guarantee: Neither formatCTA nor our third-party AI providers use your uploaded brand content, prompts, or AI-generated outputs to train, retrain, or improve generalized public AI or machine learning models.

• User Control & Approval: AI features are entirely optional and require explicit user action. Generated content is never published or distributed automatically without your prior review, editing and manual confirmation.

6. Payment Processing & Payment Data Security

Financial transactions and subscription billing for formatCTA services are collected securely by Stripe, Inc., a leading international payment service provider.

6.1 Stripe Direct Collection & Security Standards

Customers explicitly understand and agree that full payment card credentials (including 16-digit primary account numbers, card verification values, and expiration dates) are collected directly by Stripe through secure modal interfaces (Stripe Checkout). Payment data is never collected, processed, or stored on formatCTA servers.

Stripe operates as an independent Data Controller for payment processing activities and maintains certified compliance with Level 1 Payment Card Industry Data Security Standards (PCI DSS) – the highest security standard in the payment industry. Stripe manages payment data in accordance with its own privacy documentation, accessible at https://stripe.com/privacy.

7. Cookies, Tracking Technologies & Advertising

formatCTA uses cookies, web beacons, and local browser storage technologies across formatcta.com and app.formatcta.com in strict accordance with the UK Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy Directive.

7.1 Essential vs. Non-Essential Tracking

• Strictly Necessary Cookies: Essential functional cookies required to maintain authenticated user sessions, enable account security, and ensure core website operation. These do not require opt-in consent under UK PECR law.

• Consent-Based Tracking (Analytics & Advertising): Non-essential analytics, preference and marketing cookies are deployed only after obtaining explicit consent via our cookie consent banner. These technologies help us measure campaign effectiveness and display relevant promotional advertisements.

Cookie management controls, retention periods and third-party tracking vendor lists are governed under our dedicated, standalone formatCTA Cookie Policy.

8. Marketing Communications & Opt-Out Preferences

We respect your inbox and handle commercial communications with complete transparency.

8.1 Freely Given Consent & Instant Opt-Out

Promotional marketing emails are sent only where customers have freely provided explicit consent. You may withdraw consent and opt out of marketing communications at any time by clicking the 'Unsubscribe' link located in the footer of any promotional message or by updating your account settings.

8.2 Transactional Email Exception

The only exception to marketing opt-out choices relates to essential transactional and service-critical communications. Regardless of promotional opt-out preferences, formatCTA will continue to send non-commercial messages required for service delivery, including account activation links, password resets, payment receipts, security vulnerability alerts and statutory updates to our legal terms.

9. Disclosures & Third-Party Sharing

formatCTA does not sell, rent, or trade personal data to third parties. We share personal information strictly under the following controlled circumstances:

• Legal & Regulatory Requirements: When required by applicable law, court orders, or valid law enforcement requests to comply with legal investigations or protect against legal liability.

• Service Management & Platform Subprocessors: We engage vetted third-party service providers under formal Data Processing Agreements (DPAs) to support platform infrastructure, security and messaging.

9.1 Authorised Third-Party Subprocessors Table

10. International Transfers & Data Location

formatCTA maintains primary data hosting infrastructure located strictly within secure data centers inside the United Kingdom and the European Union.

10.1 International Transfer Safeguards

Where personal data is accessed or processed by third-party subprocessors outside the UK or EEA, formatCTA ensures adequate transfer safeguards under Article 46 of the UK GDPR / EU GDPR. These safeguards include the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses (SCCs), and certifications under the EU-U.S. Data Privacy Framework and UK Extension.

11. Data Retention & Security Measures

We apply strict data lifecycle policies and robust technical protections.

11.1 Retention Schedule & Account Inactivity

Personal data and stored brand assets are retained for the duration of your active account subscription. Inactive accounts are subject to staged deletion: after 12 months of continuous inactivity, temporary access restriction is applied, followed by final hard deletion after 30 days unless statutory legal retention (e.g. 6-year tax record retention) applies.

11.2 Technical & Organisational Security

formatCTA enforces end-to-end security measures, including Transport Layer Security (TLS 1.3) encryption in transit, AES-256 encryption at rest, strict role-based access control (RBAC) and hosting within ISO/IEC 27001 and SOC 2 Type II certified data center facilities.

12. Your Data Subject Rights (UK & EEA)

Under the UK GDPR, EU GDPR and Data Protection Act 2018, individual data subjects resident in the UK or EEA possess the following statutory rights:

• Right of Access (SAR): Request confirmation of data processing and obtain a copy of your personal data.

• Right to Rectification: Request correction of inaccurate or incomplete personal information.

• Right to Erasure ('Right to be Forgotten'): Request deletion of your data where processing is no longer necessary.

• Right to Restrict Processing: Request temporary suspension of data processing in disputed scenarios.

• Right to Data Portability: Receive your data in a structured, machine-readable JSON/CSV format.

• Right to Object: Object at any time to processing based on legitimate interests or direct marketing.

To exercise any right, email privacy@formatcta.com. You also have the statutory right to lodge a complaint with the UK supervisory authority: Information Commissioner's Office (ICO) (Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF / www.ico.org.uk).

13. Governing Law, Jurisdiction & Policy Updates

This Privacy Notice, its interpretation, and any legal disputes or claims arising out of or in connection with it shall be governed by and construed strictly in accordance with the laws of England and Wales. You irrevocably agree that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising under this policy.

13.1 Notice Updates & Amendments

formatCTA reserves the right to amend this Privacy Notice periodically. Material modifications will be communicated via email or prominent platform notices prior to taking effect.