Privacy Policy

1. Who we are

Badger Sett is the account, authentication, and billing platform for the Badger Commerce suite of commerce tools. The platform and the tools are operated by Badger Commerce Limited ("Badger Commerce", "we", "us" or "our"), a company registered in England and Wales under company number 11865866, registered office 20-22 Wenlock Road, London, N1 7GU, United Kingdom.

You purchase and are billed for the tools by Kedos Consulting Limited (company number 7005106, VAT number GB 978 0558 71), the authorised reseller of the Badger Commerce suite.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Badger Commerce Limited is the data controller for personal data processed through the platform's account functions. Kedos Consulting Limited is the controller for the billing information it holds as reseller in order to sell to you and meet its own tax and accounting obligations. This policy covers both.

2. Personal data we collect

We collect and process the following categories of personal data.

Account and profile data

• Your name and email address
• Profile image, where you provide one
• Authentication data and session identifiers, managed on our behalf by our authentication provider
• The organisation(s) you belong to and your role within each (owner, admin, or member)

Billing data

• Billing name and billing email address
• Organisation billing details and billing address
• Subscription, invoice, and payment history for the tools you use

We do not store full payment card numbers. Card details are collected and processed directly by Stripe, our payment processor, and never pass through or rest on our systems.

Usage and technical data

• Audit and activity logs recording key actions (for example, signing in to a tool, changing a subscription, or adding a team member)
• Diagnostic and error data, which may include your IP address and technical request metadata, collected when something goes wrong so we can diagnose and fix it
• Strictly necessary cookies — see our Cookie Statement

3. How and why we use your data

We process personal data only where we have a lawful basis to do so under UK GDPR. The table below sets out each purpose and its basis.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can object to this processing at any time — see Your rights.

4. Who we share your data with

We do not sell your personal data. We share it only with the service providers ("sub-processors") that help us operate the platform, and only to the extent needed to provide the service. Each is bound by a data processing agreement.

• Clerk (Clerk.dev, Inc.) — User authentication and identity management (United States)
• Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.) — Subscription billing and payment processing (Ireland and United States)
• Functional Software, Inc. (Sentry) — Application error monitoring and performance diagnostics (United States)
• Hetzner Online GmbH — Cloud hosting, database hosting and encrypted backup storage (European Union (Germany and Finland))

A full, current list with the safeguards that apply to each is published on our Sub-processors page.

We may also disclose personal data where required to do so by law, court order, or a regulator, or to establish, exercise, or defend legal claims. If Badger Commerce is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, and we will notify you before it becomes subject to a different privacy policy.

5. International transfers

Our core infrastructure — including the application, database, and encrypted backups — is hosted with Hetzner Online GmbH within the European Union (Germany and Finland).

Some of our sub-processors are located outside the UK and EEA, notably in the United States. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place — in practice the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum — so that your data receives an equivalent level of protection. The specific safeguard for each sub-processor is listed on our Sub-processors page.

6. How long we keep your data

We keep personal data only for as long as necessary for the purposes set out in this policy.

• Account and profile data is retained for the life of your account and deleted within 90 days of account closure, unless we are required to keep it longer.
• Billing and invoice records are retained for at least six years to meet UK tax and accounting obligations.
• Audit logs are retained for a limited period for security and troubleshooting, then deleted or anonymised.
• Diagnostic and error data is retained on a short, rolling basis by our error-monitoring provider.

7. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including encryption of data in transit, encryption of backups at rest, role-based access controls, and single sign-on. You can read more on our Security page. No system is completely secure, but we work to protect your data and to respond promptly to any incident.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) without undue delay and, where required, within 72 hours, and we will inform affected users where the law requires it.

8. Your rights

Under UK GDPR you have the following rights in relation to your personal data:

• The right to be informed about how we use your data
• The right of access to a copy of your data
• The right to rectification of inaccurate data
• The right to erasure ("the right to be forgotten")
• The right to restrict processing
• The right to data portability
• The right to object to processing based on legitimate interests
• Rights relating to automated decision-making and profiling (we do not carry out automated decision-making that produces legal effects)

To exercise any of these rights, contact us at [email protected]. We will respond within one month. There is normally no charge, and we may ask you to verify your identity first.

Where a Badger tool processes your data on behalf of your organisation, your organisation is the controller for that data and you may need to direct certain requests to it; we will help you identify the right contact.

9. Cookies

The platform uses only strictly necessary cookies, which do not require consent. We do not use advertising or third-party tracking cookies. Full details are in our Cookie Statement.

10. Children

The platform is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "last updated" date above and, where appropriate, notify you by email or through the platform.

12. Contact us and your right to complain

Our Data Protection Officer is Chris Kellet. For any question about this policy or your personal data, contact:

• Email: [email protected]
• Post: Data Protection Officer, Badger Commerce Limited, 20-22 Wenlock Road, London, N1 7GU, United Kingdom

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk. We would appreciate the chance to address your concerns first.