Who we are
This notice explains how Ashmere Software (“we”, “us”) handles personal data collected through this website, its forms and our client portal. We are a UK software company: we build our own platforms — including Vultex, Velkia and Ashmere GP — and bespoke software for other organisations.
For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), the data controller is:
- Legal name: [To be confirmed: legal entity name]
- Company number: [To be confirmed: company number]
- Registered office: [To be confirmed: registered office address]
- Privacy contact: [To be confirmed: privacy contact email]
This notice covers our public website only. Where we provide software or services to an organisation under contract, the personal data processed within that software is governed by the agreement with that organisation and its own privacy information.
What we collect
Information you give us
- Software requests (/request-software): your organisation, name, business email address, phone number (optional), sector, region, a description of your project and any scope documents you choose to upload.
- Contact enquiries (/contact): your name, email address, the type of enquiry and your message.
- Client portal (invitation only): your name, email address and organisation, plus the messages, files and project information you or we add to your workspace.
Please do not use our general enquiry forms for patient-identifiable information, clinical records, passwords, API keys or other credentials. We do not need them to respond, and the forms are not designed to hold them. If you have sent something like this by mistake, tell us and we will delete it.
Information collected automatically
- Abuse prevention: when you submit a form we record a keyed hash of your IP address — not the address itself — so we can limit spam and repeated abuse.
- Anti-bot checks: where enabled, forms may use Cloudflare Turnstile to check that a submission comes from a person rather than an automated script.
- Cookies: strictly necessary cookies remember your cookie choice and keep you signed in to the portal. See our cookie policy.
- Analytics (only with your consent): if you opt in, a privacy-friendly analytics tool records aggregate usage such as pages visited and referring sites. It does not load unless you agree, and the contents of our forms are never sent to it.
- Security logs: for the client portal and staff administration, we keep audit records of sign-ins and significant actions.
Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to software requests and enquiries, and following up on them | Legitimate interests — answering people who contact us and developing our business |
| Preparing proposals and taking steps at your request before entering into a contract | Contract (steps prior to entering a contract) |
| Providing the client portal and delivering agreed work | Contract, or legitimate interests where the contract is with your organisation rather than with you |
| Keeping the website, forms and portal secure, and preventing spam and abuse | Legitimate interests — protecting our systems and the people who use them |
| Website analytics | Consent, which you can withdraw at any time |
| Marketing updates (only if you have opted in) | Consent, which you can withdraw at any time |
| Meeting legal, accounting and regulatory obligations | Legal obligation |
Where we rely on legitimate interests, we have considered your interests and rights and believe the processing is proportionate. You can ask us for more detail.
Who we share it with
We do not sell personal data. We share it only with service providers (processors) who help us run the website and our business, under contracts that require them to protect it. These fall into the following categories:
- Hosting and infrastructure — the servers and database that run this website and store your submissions.
- Email delivery — the provider that sends notification and sign-in emails.
- Anti-bot protection — where enabled, Cloudflare Turnstile.
- Analytics — a privacy-friendly analytics provider, only if you have consented.
We maintain an internal inventory of the specific processors we use, and we will provide it on request. We may also disclose information where required by law or to protect our rights, or to professional advisers and, in the event of a business reorganisation, to a successor organisation.
International transfers
Some service providers may process data outside the UK. We will describe any such transfers, and the safeguards that protect them, here. [To be confirmed: international transfers and safeguards]
How long we keep it
- Software requests and enquiries: by default, 24 months from receipt. After that, personal details are anonymised so that only non-identifying records remain.
- Client portal accounts and project records: for as long as the engagement continues and afterwards for as long as needed to meet our contractual and legal obligations.
- Abuse-prevention hashes and security logs: only as long as needed for security purposes.
- Cookie choice: 6 months, after which we ask again.
If you ask us to delete your data sooner, we will do so unless we need to keep it for a legal reason, which we will explain.
How we protect it
We use encrypted connections, access controls based on least privilege, multi-factor authentication for staff and separation between client workspaces. You can read more in our security overview. No system is perfectly secure, so please do not send us information we do not need.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- rectification — have inaccurate data corrected or incomplete data completed;
- erasure — ask us to delete your data in certain circumstances;
- restriction — ask us to limit how we use your data;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability — receive data you provided in a commonly used, machine-readable format, where processing is based on consent or contract;
- withdraw consent at any time, where we rely on it. This does not affect processing that took place before you withdrew.
Some rights apply only in certain circumstances. We will tell you if an exemption applies.
How to exercise your rights
Email us at [To be confirmed: privacy contact email], or use our contact form and tell us which right you wish to exercise. We may need to confirm your identity before acting on a request. There is normally no charge, and we will respond within the time limits set by law.
To change your analytics choice, use the cookie settings link in the footer or visit our cookie policy.
Complaints
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk.
Changes to this notice
We will update this notice when our practices change. The date at the top of the page shows when it was last revised. Where a change is significant, we will take reasonable steps to let affected people know.