Home›Privacy Policy — portal users
Privacy Policy — portal users
For individuals using a member, supporter, client or customer portal run by an organisation on Intellayer. If your organisation subscribes to Intellayer, read the Intellayer privacy policy instead.
Read this first. Most of the information about you in this portal is controlled by the organisation you deal with — the business, association or supplier you deal with — not by us. We hold it on their instructions. If you want a copy of it, want it corrected, or want it deleted, ask them. This page explains exactly where the line falls, and what we do hold in our own right.
1. The two roles
1.1 The Organisation is the controller. The organisation whose portal you are using (the “Organisation”) decides what to record about you, why, and for how long. Under the GDPR it is the controller of that information. Its own privacy notice — which it should give you — governs it, and it is the party accountable to you for it.
That covers, for example: your membership or client record, contact details, what you have booked or bought, payments and fees, attendance and participation, correspondence, notes its staff make about you, and photographs it holds.
1.2 We are its processor. AS Creative Technologies LTD, trading as Intellayer (“Intellayer”, “we”), supplies the software. We store and process that information on the Organisation’s documented instructions only, under the Data Processing Agreement that every Organisation accepts. We do not decide what is collected or why, and we do not use it for our own purposes.
1.3 We are a controller of a narrow set of data. For a small amount of data we are the controller in our own right — because it exists to keep the platform itself working and secure, not because the Organisation asked for it:
- your login identifier and the salted hash of your password;
- session, sign-in and failed-sign-in records, and the IP address and device information that come with them;
- security and abuse-prevention logs;
- your record of accepting the portal terms;
- any support request you send us directly, and our reply.
Sections 3 onward are about that data.
1.4 We are not joint controllers with the Organisation. Each of us controls what it controls. Clause 3 of the DPA sets this out.
2. Where to send a request
| What you want | Who to ask |
|---|---|
| A copy of your membership, client or participation record; correction; deletion | The Organisation |
| To stop the Organisation contacting you, or to unsubscribe from its messages | The Organisation (or the unsubscribe link) |
| A refund, or a decision the Organisation made about you | The Organisation |
| Your login, session or security data | Us — [email protected] |
| Something wrong with the portal software | Us — [email protected] |
| To complain about how your data has been handled | Either of us, and the Office of the Commissioner for Personal Data Protection |
If a request reaches us that belongs to the Organisation, we will not answer it substantively — we are not entitled to. We will tell you, and pass it to the Organisation’s administrators without undue delay so the clock starts on their side. Clause 7.1 of the DPA obliges us to do exactly that.
3. Who we are
| Controller (for the data in 1.3) | AS Creative Technologies LTD, trading as Intellayer |
| Legal form | Sole proprietorship — a natural person trading under a business name, not a limited company |
| Address | Alamanas 50, Dali, Nicosia 2547, Cyprus |
| Data protection contact | [email protected] |
| Supervisory authority | Office of the Commissioner for Personal Data Protection, 1 Iasonos, 1082 Nicosia, Cyprus — https://www.dataprotection.gov.cy |
Data Protection Officer. We assessed Article 37 and concluded that appointing one is not currently mandatory at our scale. We keep that under review and will publish a DPO’s details here if it changes.
4. What we do with the data we control, and why
| What | Why | Lawful basis |
|---|---|---|
| Authenticate you and keep you signed in | So you can use the portal at all | Contract — Art. 6(1)(b), being these portal terms between you and us |
| Record sign-ins, failures, lockouts and sessions | To protect your account and everyone else’s | Legitimate interests — Art. 6(1)(f) |
| Detect and block abuse, credential stuffing and automated attack | Security of the platform | Legitimate interests — Art. 6(1)(f) |
| Keep a record of your acceptance of the portal terms | To show what you agreed and when | Legitimate interests — Art. 6(1)(f); accountability under Art. 5(2) |
| Answer a support request you send us | To help you | Legitimate interests — Art. 6(1)(f) |
| Comply with a court order or lawful demand | Because we must | Legal obligation — Art. 6(1)(c) |
We do not send you marketing. Any marketing you receive through the portal comes from the Organisation, on its own basis, and its unsubscribe link stops it.
5. Children
Where a portal covers people under 18 — a youth programme, a course, an activity for children — the Organisation is the controller of the child’s data and is responsible for the heightened obligations the GDPR imposes: giving guardians clear information, having a proper lawful basis, restricting who inside the Organisation can see what, and setting a sensible retention period. Cyprus sets the age of consent to an online service at 14 under section 6 of Law 125(I)/2018.
The account itself must be held by a parent or guardian, who is aged 18 or over — clause 4.2 of the portal terms.
Our role is to hold that data securely for the Organisation and to give it the tools it needs. If you are a guardian with a question about what an organisation holds about your child, ask that organisation. If they will not answer, you can complain to the Office of the Commissioner for Personal Data Protection, and you can also tell us — a controller refusing to answer its own data subjects is something we want to know about.
6. Who receives it
Data we control is processed by the sub-processors listed at https://intellayer.app/legal/dpa/subprocessors/ — hosting and database in Germany, edge network, email delivery in the EU, SMS, payments, push notifications. Each is under contract, may not use it for its own purposes, and we remain liable for them.
Data the Organisation controls goes wherever the Organisation directs, plus the same sub-processors. What the Organisation does with it beyond that is set out in its own privacy notice.
We do not sell personal data, do not share it with advertising networks or data brokers, and do not use it to train generalised AI models.
7. International transfers
The platform and its database are in Germany. Where a sub-processor processes outside the EEA we rely on an adequacy decision where one applies and otherwise on the Standard Contractual Clauses (Decision (EU) 2021/914), with a transfer impact assessment where required. Per-provider detail is on the sub-processor page.
8. How long we keep it
For data we control:
| Category | Kept for |
|---|---|
| Login identifier and password hash | While your account exists, then 30 days |
| Sign-in and session records | 12 months |
| Security and abuse-prevention logs | 12 months |
| Record of accepting the portal terms | For as long as we may need to prove it |
| Support requests you send us | 24 months after closure |
| Backups | Overwritten on the ordinary cycle, normally within 35 days of deletion from live systems |
Data the Organisation controls is kept for as long as the Organisation decides, subject to clause 11 of the DPA when its subscription ends.
9. Your rights
Against us, for the data in section 1.3: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where consent is the basis. Email [email protected]; we answer within one month, and will tell you if we need to extend for a complex request.
Against the Organisation, for everything else: the same rights, exercised with them.
Against either: the right to complain to the Office of the Commissioner for Personal Data Protection, or to the supervisory authority where you live. You do not have to complain to us or to the Organisation first.
We may ask you to verify your identity before acting, and will ask for no more than we need.
10. Security
TLS 1.2 or above in transit; encryption at rest for the database and backups; passwords stored only as salted hashes from a deliberately slow hashing function; role-based access; each Organisation’s data logically isolated and the isolation enforced at every API boundary. Annex II of the DPA is the detailed version.
We do not hold ISO 27001, SOC 2 or an equivalent certification and do not currently commission an annual external penetration test.
If a breach affects data we control and is likely to put your rights at high risk, we will tell you without undue delay. If it affects data the Organisation controls, we notify the Organisation without undue delay and the Organisation decides whether and how to tell you — that decision is the controller’s, not ours.
To report a vulnerability, see the legal information page.
11. Cookies
See the cookie and local storage notice.
12. Changes
The version and date at the top change whenever this policy does. For a material change we will tell you in the portal or by email at least 30 days beforehand.
13. Contact
[email protected] — Intellayer, Alamanas 50, Dali, Nicosia 2547, Cyprus.
For anything about your membership, booking or records: contact the Organisation.