Privacy Policy
Last updated: 2026-05-08
This Privacy Policy explains how Silux Connect ("Silux", "we", "us") collects, uses, discloses, and safeguards information when you use Silux Connect (the "Service") and related websites at siluxconnect.com.
This policy is written to satisfy the UK GDPR, the EU GDPR (Regulation 2016/679), the UK Data Protection Act 2018, the California Consumer Privacy Act (CCPA/CPRA), and the Brazilian LGPD. Where a stricter rule applies in your jurisdiction, that stricter rule controls.
1. Who is the controller
Silux Connect, 10 Finsbury Square, London, EC2A 1AF, United Kingdom, acts as the controller of personal data we collect about you when you visit our marketing site, sign up for an account, or interact with us as a prospect.
When you operate Silux Connect under a customer subscription, your employer (the "Customer") is the controller of any personal data processed through the Service, and Silux acts as the processor under the Data Processing Agreement at /dpa.
Our Data Protection Officer is contactable at dpo@siluxconnect.com (PGP key at /.well-known/openpgpkey/dpo).
Our EU representative under Art. 27 GDPR is appointed in Ireland; details are available on request.
2. Personal data we collect
Account and identity data
Name, work email address, organisation, role, country, password hash, multi-factor enrolment metadata, OAuth identity provider linkage.
Service-use data
Login times, IP address, browser user-agent, device fingerprint hashes used for anomaly detection, audit-log entries describing actions you take inside your tenant.
Customer-controlled data
Session metadata (start, end, participants), recordings (only when your administrator has enabled recording), files transferred during a session, tickets and notes you author, and configuration data for devices you manage. The Customer determines retention and access for this data.
Billing data
Stripe customer ID, billing address, VAT number, last four digits of payment instrument, invoice history. Full card numbers are processed by Stripe and never stored on Silux systems.
Support and communications
Email correspondence, support-ticket transcripts, voluntary feedback you submit through the AI assistant.
Marketing data
Email address, content preferences, and (with consent) interaction events from our marketing emails.
3. Sources
We collect data directly from you, from your administrator when they invite you, from your single-sign-on identity provider when you authenticate, and from third-party processors such as Stripe and Cloudflare in the course of normal Service operation.
4. Lawful basis for processing (UK / EU)
| Processing | Lawful basis (Art. 6 GDPR) |
|---|---|
| Providing the Service to you under a contract | Art. 6(1)(b) — performance of a contract |
| Account security and abuse prevention | Art. 6(1)(f) — legitimate interests |
| Billing and invoicing | Art. 6(1)(b) and (1)(c) — contract and legal obligation |
| Audit-log retention for security and compliance | Art. 6(1)(f) and Art. 6(1)(c) |
| Marketing emails to existing customers | Art. 6(1)(f) — soft opt-in, with one-click unsubscribe |
| Marketing emails to prospects | Art. 6(1)(a) — consent |
| Cookie analytics | Art. 6(1)(a) — consent (see /cookies) |
| Responding to a legal request | Art. 6(1)(c) — legal obligation |
For special-category data (Art. 9), we rely on Art. 9(2)(a) explicit consent or Art. 9(2)(g) substantial public interest. We do not knowingly collect special-category data through the marketing site.
5. Purposes
We process your personal data to:
- Operate, maintain, secure, and improve Silux Connect.
- Authenticate you and detect anomalous logins or compromise.
- Provide customer support and respond to your requests.
- Send service-related notices (security advisories, billing, downtime).
- Send marketing communications you have consented to.
- Comply with our legal, accounting, and tax obligations.
- Defend our legal rights and investigate suspected violations of our Acceptable Use Policy.
6. How long we keep it
| Category | Retention |
|---|---|
| Account profile | Lifetime of account, plus 30 days after deletion request |
| Authentication logs | 12 months |
| Audit log (tenant-controlled) | Per Customer policy; default 7 years for ADMIN+ actions |
| Session recordings | Per Customer policy; default 30 days |
| Billing records | 7 years (UK statutory requirement) |
| Support tickets | 3 years after closure |
| Marketing email opt-in records | 3 years after last engagement |
| Web-server access logs | 90 days |
| Backups | 35 days, then automatically purged |
When a Customer terminates their subscription, we delete tenant data within 30 days unless contractually required to retain it longer. Backups containing residual copies expire on the rolling 35-day cycle.
7. Recipients and sub-processors
We share personal data only with sub-processors who help us deliver the Service. The current list is at /subprocessors and is also published as an RSS feed so you can subscribe to changes. Each sub-processor is bound by a written agreement that meets Art. 28 GDPR requirements.
We never sell personal data and we never share personal data with advertising networks. We do not engage in profiling that has legal or similarly significant effects on you.
We may disclose personal data to law enforcement only when compelled by a valid legal process and after exhausting reasonable challenges. We publish an annual transparency report with aggregate counts.
8. International transfers
Silux Connect operates in three regions (US, EU, APAC). When you are an EU/UK data subject and your tenant is pinned to a non-EU region, or when our sub-processors are located outside the UK/EEA, we rely on the following safeguards:
- The European Commission's Standard Contractual Clauses 2021/914, Module 2 (controller-to-processor) or Module 3 (processor-to-processor).
- The UK Information Commissioner's International Data Transfer Addendum.
- The Swiss Federal Data Protection and Information Commissioner's adapted SCCs.
- Supplementary measures including AES-256-GCM at rest, TLS 1.3 in transit, customer-managed KMS keys where elected, and a documented procedure for handling government access requests.
You can pin your tenant to the EU region at any time from Settings → Region.
9. Your rights
If UK or EU data-protection law applies to you, you have the right to:
- Request access to your personal data.
- Request rectification of inaccurate data.
- Request erasure ("right to be forgotten").
- Request restriction of processing.
- Object to processing based on legitimate interests.
- Request portability of data you have provided to us in a structured, machine-readable format.
- Withdraw consent at any time, without affecting the lawfulness of prior processing.
- Lodge a complaint with a supervisory authority. The UK authority is the Information Commissioner's Office (ico.org.uk). The Irish authority for our EU representative is dataprotection.ie.
If California law applies to you, you have the right to know, delete, correct, and limit the use of sensitive personal information; you also have the right not to be discriminated against for exercising those rights. We do not sell personal information.
To exercise any right, submit a request at /account-deletion-request, email dpo@siluxconnect.com, or write to the postal address above. We respond within one calendar month (we may extend by two further months for complex requests, with notice). We will verify your identity proportionately to the sensitivity of the request.
10. Cookies and similar technologies
See /cookies for the full cookie register, the categories of cookies we use, and how to change your preferences.
11. Security
We protect personal data with the technical and organisational measures described in our Trust Center at /security and in our internal security policy. Highlights: TLS 1.3 in transit, AES-256-GCM at rest with envelope encryption, per-session key derivation for relayed traffic, MFA mandatory for admin roles, 24x7 monitoring, annual third-party penetration testing.
12. Children
Silux Connect is not directed to children under 16 (or the higher age of digital consent that applies in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact dpo@siluxconnect.com and we will delete it.
13. Automated decision-making
We do not subject you to decisions based solely on automated processing that produce legal or similarly significant effects on you. The AI assistant provides recommendations to humans; humans take the action.
14. Changes
We will post material changes to this policy on this page with an updated "Last updated" date. For changes affecting how we process personal data on which we rely on consent, we will obtain fresh consent before the change takes effect.
15. Contact
- DPO: dpo@siluxconnect.com
- Privacy team: privacy@siluxconnect.com
- Postal: Silux Connect, 10 Finsbury Square, London EC2A 1AF, United Kingdom
We aim to respond within five business days.