Legal
Privacy Policy
This Privacy Policy explains how Rofterm collects, uses, shares and safeguards personal data when you visit our website, request a demo, or use the Rofterm enterprise risk, controls and compliance platform (the "Service").
1. Scope & our roles
This policy applies to personal data processed by Rofterm ("Rofterm", "we", "us"), the operator of the Rofterm platform.
Rofterm acts in two distinct roles:
- As a controller for personal data relating to our website visitors, prospects, demo requesters, marketing contacts, and the administrators and named users of customer accounts (for example, account login and contact details).
- As a processor for the content our customers load into the Service (risks, controls, evidence, incidents, reports and any personal data contained within them). For that content, the customer is the controller and our handling is governed by our Data Processing Agreement.
2. Data we collect
Information you provide
- Demo & contact requests: name, business email, company, role, company size and any message you submit.
- Account data: name, work email, role and authentication identifiers for users provisioned into the Service.
- Customer content: data you enter into the Service, which may include the names and contact details of risk owners, control owners and other colleagues.
- Support & correspondence: messages you send us and their contents.
Information collected automatically
- Usage & device data: IP address, browser and device type, pages viewed, referring URLs and timestamps.
- Cookies & similar technologies: see Cookies below.
Information from third parties
- Authentication providers (for single sign-on), and business contact data from reputable enrichment or referral sources where permitted by law.
3. How we use personal data
- Provide, operate, secure and improve the Service and our website.
- Respond to demo requests, enquiries and support tickets.
- Authenticate users and manage accounts, billing and subscriptions.
- Send service and transactional communications (for example, security and overdue-item notifications).
- Send marketing communications where permitted, which you can opt out of at any time.
- Monitor for, investigate and prevent fraud, abuse and security incidents.
- Comply with legal, regulatory and contractual obligations.
4. Connected document stores (Google and Microsoft user data)
Rofterm offers optional integrations that let a customer import documents from their own Google Drive or Microsoft 365 (OneDrive and SharePoint) account into the Service as evidence or policy records. These integrations are switched off by default. They operate only after an administrator of the customer account connects them and grants consent on Google’s or Microsoft’s own consent screen, and they can be disconnected at any time.
What we access
When you connect Google Drive, the Rofterm application requests these Google OAuth scopes:
https://www.googleapis.com/auth/drive.readonly— read-only access to the Drive files and folders the signing-in user can already open. We use it to list folders, so an administrator can choose which ones Rofterm may import from, and to download the files inside the folders they select.openidandemail— the email address of the connected Google account, displayed in Rofterm so your administrators can see which account an integration is using.
Access is strictly read-only. Rofterm never creates, modifies, moves, shares or deletes anything in your Google Drive, and does not read files outside the folders you select.
How we use it
- Files in the folders you select are copied into your Rofterm organization as evidence or policy records, so they can be linked to risks and controls, cited in reports and retained as an audit trail.
- Imported documents have their text extracted, split into passages and converted into numerical embeddings, so your users can search them and so the Service can propose links to relevant controls and policies. Such proposals are suggestions only: a person in your organization must approve one before it changes any record.
- The connected account’s email address is shown for account administration.
- A refresh token is kept so scheduled syncs can keep imported evidence current without asking you to sign in again.
We do not use Google user data for any purpose other than providing these features to the customer who connected the account.
How we share it
We do not sell Google or Microsoft user data and we do not use it for advertising or market research. We disclose it only to the subprocessors that operate the Service on our behalf under contract — our cloud hosting and database provider, and the AI provider that performs the text analysis and embedding described above — and to authorities where required by law. Our AI provider processes this content solely to return results to us and is contractually prohibited from using it to train its models.
How we store, retain and delete it
Imported files are held in access-controlled storage that is isolated per customer organization. OAuth access and refresh tokens are encrypted before they are written to our database and are used only to call the provider’s API on your behalf.
Disconnecting an integration in Rofterm deletes the stored tokens and revokes our access grant with the provider, after which no further data is accessed. Documents already imported remain in your Rofterm organization as evidence until you delete them or the subscription ends, when they are handled under Data retention below and our DPA. You can also revoke Rofterm’s access at any time from your Google account at myaccount.google.com/permissions.
Limited Use disclosure
Rofterm’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use data received from Google APIs only to provide and improve the user-facing features described in this section; we do not transfer or sell that data for advertising, market research or any unrelated purpose; we do not allow humans to read it except with your affirmative agreement, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and anonymized for internal operations; and we do not use it to develop, improve or train generalized artificial-intelligence or machine-learning models.
5. Legal bases for processing (EEA/UK)
Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:
- Contract — to provide the Service and account features you request.
- Legitimate interests — to operate, secure and improve our business, and for B2B marketing, balanced against your rights.
- Consent — for non-essential cookies and certain marketing, withdrawable at any time.
- Legal obligation — to meet our compliance, tax and accounting duties.
7. International transfers
We may process personal data in countries other than your own. Where we transfer data outside the UK or EEA, we use an approved transfer mechanism such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, together with supplementary safeguards where needed.
8. Data retention
We keep personal data only as long as necessary for the purposes set out here, then delete or anonymize it. Account and customer content is retained for the life of the subscription and deleted or returned after termination in line with the DPA. Prospect and marketing data is retained until you unsubscribe or it is no longer relevant. Legal, tax and security records are kept for the periods required by law.
9. Security
We maintain technical and organizational measures appropriate to the risk, including encryption in transit, access controls, role-based permissions, tenant isolation, logging and monitoring. No method of transmission or storage is completely secure, but we work to protect personal data and to notify affected parties of breaches as required by law.
10. Your rights
Subject to applicable law, you may have the right to access, correct, delete or port your personal data, to restrict or object to processing, and to withdraw consent. To exercise these rights, contact us using the details below. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office).
If your personal data sits inside a customer's account, please direct your request to that customer (the controller); we will assist them as their processor.
12. Children
The Service is a business product and is not directed to anyone under 16. We do not knowingly collect personal data from children.
13. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above and, where appropriate, communicated to you. Continued use of the Service after an update constitutes acceptance of the revised policy.
14. How to contact us
For privacy questions or to exercise your rights, contact us by email at hey@rofterm.com. We will add a postal address and a named data protection contact once Rofterm is incorporated.