Privacy Notice

Last updated: September 2026

NetNodes Limited (“NetNodes,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Notice explains how we collect, use, share, and protect your personal data when you visit our corporate websites, interact with our services, or contact us.

We aim to be clear, simple, and transparent. This notice also explains your rights under UK data protection law.

NetNodes Limited is the data controller for the personal data described in this notice - data we collect through our own websites, and in the course of dealing with customers, suppliers and enquiries.

Where we hold personal data inside DoorFlow or PassFlow on a customer’s behalf, we act as a data processor and the customer is the controller. That relationship is governed by our Data Processing Agreement, and each product has its own privacy notice: DoorFlow and PassFlow.

1. Information We Collect

We collect information to provide you with our services, communicate with you, and improve our business. Types of information may include:

a. Personal Information You Provide:

Name, email, phone number, company, job title.
Information submitted via forms, emails, or when contacting support.

b. Technical Information:

IP address, browser type, device information, operating system.
Cookies and similar tracking technologies (see our Cookie Policy).

c. Usage Information:

Pages visited, links clicked, time spent on site.
Interactions with emails, downloads, or newsletters.

d. Information from Third Parties:

Publicly available sources, such as company websites and registers.
Business contact information from partners, resellers and referrals.
Where we receive personal data about you from a third party, we tell you so within a month of obtaining it, or at the point we first contact you, whichever comes first.

2. How We Use Your Information

We use your data to:

Provide and improve our websites and services.
Respond to inquiries and support requests.
Communicate important updates or service changes.
Send marketing communications, where you have opted in.
Comply with legal obligations and enforce our agreements.
Conduct research and analysis in anonymised form to improve our services.

We will not sell your personal data.

3. Measurement of Our Websites

We measure how our websites are used, so that we can see what is working and improve them.

We treat this at the level of the organisation, not the individual. In particular, we may use the IP address a request came from, on its own or matched against a list of address ranges we associate with customers and prospective customers, to record that an organisation visited - never to identify a person. Any such match is treated as an indication rather than a fact, because shared offices, mobile networks and VPNs all place many people behind one address.

Where we use analytics cookies for this, they are set only after you have consented, and are described in our Cookie Policy.

We rely on legitimate interest for this measurement. You can object at any time using the contact details in section 13, and you can decline analytics cookies without affecting your use of our websites.

4. Legal Basis for Processing

Under UK GDPR, we process your data based on one of the following legal bases:

Consent: when you opt in to marketing or newsletters.
Contract: to provide services or fulfil agreements.
Legal obligation: to comply with laws and regulations.
Legitimate interest: to improve our services, maintain security, measure use of our websites as described in section 3, and communicate with you in a professional context.

We may share your information with:

Service providers for hosting, analytics, or communication purposes.
Professional advisors such as auditors, legal counsel, or accountants.
Law enforcement or regulators when required by law.
Business transfers in the event of a merger or sale of assets.

Our sub-processors are published in full, and our Data Processing Agreement governs our role where we process personal data on a customer’s behalf.

6. International Data Transfers

Where personal data is transferred outside the UK or European Economic Area, we ensure appropriate safeguards such as the International Data Transfer Agreement, UK Addendum to the EU standard contractual clauses, encryption, or other legally recognised measures. You can request a copy of the safeguards that apply to a particular transfer by emailing privacy@netnodes.net.

7. Security of Your Information

We implement technical and organisational measures to protect your information, including:

Encryption of data in transit and at rest.
Access controls and monitoring.
Regular security reviews and audits.

While we take every reasonable step, no system is completely secure.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this notice, or as required by law:

Account or contact information: retained while the relationship is active, and for two years after our last meaningful contact with you, unless you ask us to delete it sooner.
Legal or financial records: retained for statutory periods (usually 6 to 7 years).
Analytics and anonymised data: retained indefinitely in anonymised form.

9. Your Rights

You have rights under UK data protection law:

Access: request a copy of your personal data.
Correction: correct inaccurate or incomplete data.
Deletion: request deletion of your data where legally allowed.
Portability: receive your data in a structured format.
Restriction or objection: restrict processing or object to certain uses.
Withdraw consent: for marketing communications.

To exercise these rights, contact privacy@netnodes.net.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint. We would ask you to raise it with us first, so that we have the chance to put it right.

Automated decision-making. We do not make decisions about you by automated means that produce legal effects or similarly significant effects, and we do not carry out profiling of that kind. The measurement described in section 3 records that an organisation visited our websites; it makes no decision about any individual.

10. Cookies and Tracking

We use cookies and similar technologies to improve your experience and understand site usage. You can manage your cookie preferences via our Cookie Policy.

11. Children

Our services are not intended for children under 16, or under the local minimum age where that is higher. We do not knowingly collect personal data from children.

12. Updates to This Notice

We may update this Privacy Notice from time to time. The latest version will always be available at policy.netnodes.net, and significant changes will be communicated where required by law.

13. Contact Us

If you have questions about this notice or your personal data, please contact us at privacy@netnodes.net