1. SCOPE

This Policy applies globally to individuals who interact with Swarmic as:

• website visitors;
• prospective customers;
• Customer representatives;
• Account administrators;
• authorised users;
• billing contacts;
• support contacts; or
• individuals whose personal data is processed through a Customer Workspace.

Swarmic primarily provides B2B software infrastructure.

2. CONTROLLER AND PROCESSOR ROLES

2.1 Swarmic as Controller

Swarmic acts as an independent Data Controller for personal data relating to:

• Account registration;
• Customer and business contacts;
• billing contacts;
• account administrators;
• website interactions;
• customer support communications;
• billing and transaction administration;
• security and fraud prevention; and
• direct communications with Swarmic.

2.2 Swarmic as Processor

Where a Customer uploads or otherwise submits personal data into a Workspace for processing through the Services, Swarmic may act as a Data Processor on behalf of that Customer.

In such circumstances, the Customer generally determines the purposes and means of the processing and acts as Data Controller.

That processing is governed by the applicable Data Processing Addendum and the Customer's documented instructions.

Swarmic does not assume responsibility for the Customer's independent legal obligations as Data Controller.

3. INFORMATION WE COLLECT

Depending on how the Services are used, Swarmic may process:

Account and professional information

• name;
• business name;
• job title;
• corporate email address;
• business address;
• business telephone number;
• account credentials;
• corporate registration information; and
• tax or VAT identification information where required.

Billing information

• transaction records;
• subscription status;
• purchase history;
• invoice information;
• billing address;
• payment status; and
• limited payment metadata.

Full payment-card details are generally processed directly by the applicable payment infrastructure and are not intentionally stored in Swarmic's core application database.

Technical and security information

• IP address;
• browser type;
• device information;
• session information;
• timestamps;
• authentication events;
• security logs;
• infrastructure performance information;
• execution duration;
• Credit consumption and metering data; and
• error and diagnostic information.

Communications

We may process information voluntarily provided through support requests, emails, technical reports, sales communications or other correspondence.

4. PURPOSES OF PROCESSING

Swarmic may process Controller-level personal data for:

• providing and administering the Services;
• creating and maintaining Accounts;
• processing subscriptions and billing;
• customer support;
• security and fraud prevention;
• preventing abuse and unauthorised use;
• infrastructure monitoring;
• service reliability;
• enforcing the Terms and Fair Use requirements;
• complying with legal obligations;
• maintaining commercial records;
• resolving disputes; and
• protecting Swarmic's rights and infrastructure.

5. EU/EEA AND UK LEGAL BASES

Where applicable under EU/EEA or UK data-protection law, Swarmic relies on appropriate legal bases, which may include:

Performance of a contract

For account administration, Service delivery, billing and other processing necessary to perform the Customer relationship.

Legitimate interests

For security, fraud prevention, abuse prevention, infrastructure stability, service improvement, network protection and enforcement of contractual terms, where those interests are not overridden by applicable rights and freedoms.

Legal obligations

Where processing is necessary to comply with applicable law, taxation, accounting, regulatory requirements or lawful governmental requests.

Consent

Where applicable law requires consent for a particular processing activity, Swarmic will seek that consent before undertaking the activity.

6. DATA RETENTION

Swarmic retains personal data only for as long as reasonably necessary for the purposes described in this Policy, contractual administration, security, legal compliance, accounting requirements, dispute resolution and establishment or defence of legal claims.

Different categories of information may therefore have different retention periods.

Where technical data is genuinely transient and no longer required, it may be deleted or anonymised according to applicable operational retention schedules.

Swarmic does not guarantee that every category of technical data is permanently deleted within a fixed 48-hour period unless a particular Service or written agreement expressly provides such a commitment.

7. CUSTOMER DATA

Customer Data processed in a Customer Workspace is handled according to the Customer's instructions and the applicable DPA where Swarmic acts as Processor.

Swarmic does not sell Customer Data.

Swarmic does not use Customer Data processed solely in its capacity as Processor for independent advertising purposes.

Where Swarmic processes information as an independent Controller, the purposes are governed by this Policy.

8. SUBPROCESSORS AND SERVICE PROVIDERS

Swarmic may use third-party service providers and subprocessors necessary to operate the Services.

Categories may include:

• cloud infrastructure providers;
• hosting and edge-network providers;
• security and fraud-prevention providers;
• email and communications infrastructure;
• payment and billing providers;
• tax and business verification providers;
• analytics or operational monitoring providers where applicable; and
• AI or computational service providers required for particular workloads.

Where Swarmic acts as Processor, applicable subprocessors are governed by the DPA and applicable data-protection requirements.

Swarmic will maintain appropriate contractual protections for relevant subprocessors.

9. INTERNATIONAL DATA TRANSFERS

Swarmic is incorporated in the United States.

Infrastructure may be deployed in the European Economic Area, including EU-based cloud regions, depending on the Service architecture and Customer configuration.

Certain support functions, subprocessors, infrastructure providers or technical dependencies may involve access to or processing of personal data outside the EEA or United Kingdom.

Where a restricted transfer occurs, Swarmic will implement an appropriate transfer mechanism required by applicable law, which may include:

• an applicable adequacy decision;
• EU Standard Contractual Clauses;
• the UK International Data Transfer Addendum to the EU SCCs;
• the UK International Data Transfer Agreement; or
• another legally recognised transfer mechanism.

Where required, Swarmic will implement appropriate supplementary safeguards based on the circumstances of the transfer.

10. COOKIES AND TRACKING

The website and Services may use strictly necessary and functional cookies or similar technologies required to:

• maintain secure sessions;
• authenticate users;
• protect Accounts;
• remember essential interface settings;
• operate billing or account functionality; and
• prevent abuse or security attacks.

Swarmic does not intentionally deploy non-essential behavioural advertising or cross-site marketing trackers without providing any consent or choice mechanism required by applicable law.

Where applicable law requires consent for a particular cookie or tracking technology, the relevant consent mechanism will be provided.

11. DATA SUBJECT RIGHTS

Depending on applicable law, individuals may have rights including:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• data portability;
• withdrawal of consent where processing relies on consent; and
• rights concerning certain automated decision-making or profiling.

Requests concerning Controller-level processing by Swarmic may be submitted to:

contact@swarmicsubstrate.com

Where personal data exists within a Customer Workspace and Swarmic acts solely as Processor, the relevant request should generally be directed to the Customer as Data Controller.

Swarmic will provide reasonable assistance to Customers where required under the applicable DPA.

12. EU/EEA RIGHTS

Individuals in the EU/EEA may lodge a complaint with the competent supervisory authority in accordance with applicable GDPR requirements.

Nothing in this Policy limits any mandatory right available under the GDPR.

13. UNITED KINGDOM RIGHTS

Individuals in the United Kingdom may exercise rights under the UK GDPR and Data Protection Act 2018, subject to applicable statutory limitations and exemptions.

Individuals may also lodge a complaint with the UK Information Commissioner's Office where applicable.

14. UNITED STATES PRIVACY RIGHTS

Swarmic does not sell or rent personal information for monetary consideration.

Where applicable state privacy laws provide rights concerning access, correction, deletion, portability, opt-out or other privacy choices, Swarmic will process valid requests in accordance with the applicable law and any applicable exemptions.

Certain business-to-business, employment-related, security, fraud-prevention and other statutory exemptions may apply depending on the jurisdiction.

15. CHILDREN

The Services are intended for businesses, professionals and adult users.

Swarmic does not knowingly request or intentionally collect personal information from children in violation of applicable law.

If Swarmic becomes aware that personal data has been collected from a child in circumstances where such collection is prohibited, Swarmic will take reasonable steps to address the situation.

16. SECURITY

Swarmic maintains reasonable technical and organisational security measures appropriate to the nature and risk of processing.

Measures may include:

• encryption in transit;
• encryption at rest where supported by the applicable infrastructure;
• access controls;
• authentication controls;
• logging and monitoring;
• infrastructure segmentation;
• security incident procedures; and
• least-privilege access principles.

No method of transmission or storage can be guaranteed to be completely secure.

17. DATA BREACHES

Where Swarmic acts as Processor, Swarmic will notify the Customer of a qualifying personal-data breach in accordance with the applicable DPA.

Where Swarmic acts as Controller, Swarmic will handle personal-data incidents in accordance with applicable law.

18. AUTOMATED PROCESSING AND AI

Swarmic may use automated processing and AI-assisted functionality to provide requested Services.

Swarmic does not represent that all automated outputs are accurate or suitable for high-impact decisions.

Customers remain responsible for reviewing outputs and ensuring lawful use.

19. CHANGES TO THIS POLICY

Swarmic may update this Policy to reflect changes in the Services, infrastructure, legal requirements or privacy practices.

Material changes will be communicated through reasonable means where required.

The "Last Updated" date identifies the current version.

20. CONTACT