1. Introduction
1.1 This Privacy Policy explains how Furious Fox Limited, a company registered in England and Wales under company number 10443248, with its registered office at 21 East Street, Bromley, England, BR1 1QE ("Furious Fox", "we", "us" or "our"), collects, uses, and protects personal data in connection with the dharas.io website and the Dharas software-as-a-service platform (together, the "Services").
1.2 Furious Fox is the data controller for the personal data described in this Policy, except where stated otherwise in clause 2.
1.3 This Policy should be read alongside our Website Terms of Use and Dharas Terms of Service. Where there is a conflict between this Policy and a separately signed Data Processing Agreement or Master Subscription Agreement, the signed agreement prevails.
2. Scope: what this Policy does not cover
2.1 Dharas is used by three types of user: Tenants (organisations that subscribe to and administer the platform), Buyer Users (individuals invited by a Tenant to use the platform on its behalf), and Suppliers and their Supplier Users (organisations and individuals that register for a free account through the Portal to interact with Tenants).
2.2 Where Furious Fox processes Customer Data on behalf of a Tenant, or Supplier Content on behalf of a Supplier, as a data processor (for example, content that a Tenant's Buyer Users upload into the Dharas platform, or pricing and tender documents a Supplier submits to a Tenant), that processing is governed by the Data Processing Agreement, Master Subscription Agreement, or these Terms of Service between Furious Fox and the relevant Tenant or Supplier, not by this Policy. The Tenant or Supplier, as data controller for that data, is responsible for providing its own privacy notice to its own personnel where relevant.
2.3 This Policy covers personal data where Furious Fox determines the purposes and means of processing, including data about website visitors, prospective customers, and the individuals who hold or use a Dharas Account, namely Tenant account holders and their Buyer Users, and Supplier account holders and their Supplier Users, each in their capacity as such (for example, their name, contact details, and login and usage data, as distinct from the Customer Data or Supplier Content they submit through the platform).
3. Personal data we collect
3.1 Information you provide directly. This includes your name, email address, job title, organisation, phone number, and any other information you submit through contact forms, demo requests, sign-up forms, support requests, or correspondence with us.
3.2 Account and billing information. When a Tenant registers for a Dharas Account, we collect account credentials and billing address for that Tenant. We do not use a third-party payment processor; Tenant fees are invoiced directly and paid by bank transfer, and we do not collect or store card payment details. Suppliers register for a free Account through the Portal at no charge; we collect Supplier account credentials and organisation details, but no billing information, since Suppliers are not charged fees.
3.3 Usage data. We automatically collect information about how you interact with the Services, including IP address, browser type, device information, pages visited, features used, timestamps, and log data.
3.4 Cookies and similar technologies. We use cookies and similar technologies as described in our Cookie Policy, available at [COOKIE POLICY URL].
3.5 Information from third parties. We may receive information about you from business partners, publicly available sources, or our analytics provider, Google Analytics.
4. How we use personal data
We use personal data for the following purposes:
(a) to provide, maintain, and improve the Services;
(b) to create and administer Accounts, including authentication and billing;
(c) to respond to enquiries, support requests, and correspondence;
(d) to send service communications, including updates to policies, security notices, and changes to the Services;
(e) to send marketing communications where you have consented or where we have a legitimate interest to do so, and you may opt out at any time;
(f) to monitor, analyse, and improve the performance, security, and usability of the Services;
(g) to detect, investigate, and prevent fraud, abuse, or security incidents;
(h) to comply with legal obligations, including tax, accounting, and regulatory requirements; and
(i) to establish, exercise, or defend legal claims.
5. Legal basis for processing
Under the UK GDPR, we rely on the following legal bases:
(a) Contract - processing necessary to perform our contract with you, such as providing the Services and billing;
(b) Legitimate interests - processing necessary for our legitimate interests, such as improving the Services, preventing fraud, and direct marketing to existing customers, provided this is not overridden by your interests or rights;
(c) Consent - where you have given consent, such as for certain cookies or marketing communications, which you may withdraw at any time; and
(d) Legal obligation - processing necessary to comply with a legal or regulatory requirement.
6. Sharing personal data
6.1 We may share personal data with:
(a) service providers who process data on our behalf, namely: Hostinger, which hosts the dharas.io website; Hetzner, which hosts the Dharas application; Cloudflare, which provides content delivery network and security services; and Google Analytics, which provides usage analytics; each bound by contractual obligations to protect personal data;
(b) professional advisers, including lawyers, auditors, and insurers;
(c) regulators, law enforcement, or other third parties where required by law or to protect our rights, property, or safety, or that of others; and
(d) a buyer or successor in the event of a merger, acquisition, restructuring, or sale of assets, subject to appropriate safeguards.
6.2 We do not sell personal data to third parties.
7. International transfers
Where personal data is transferred outside the United Kingdom, we ensure an adequate level of protection through mechanisms recognised under UK data protection law, such as the UK's International Data Transfer Agreement, the EU Standard Contractual Clauses (as adopted for UK transfers), or a recognised adequacy decision.
8. Data retention
We retain personal data only for as long as necessary for the purposes described in this Policy, including to satisfy legal, accounting, or reporting requirements. Account data is generally retained for the duration of the Account plus 6 months afterwards, unless a longer period is required by law or you request earlier deletion in accordance with clause 9.
9. Your rights
9.1 Under UK data protection law, you have the right to:
(a) request access to your personal data;
(b) request correction of inaccurate or incomplete data;
(c) request erasure of your data, subject to certain exemptions;
(d) request restriction of processing;
(e) object to processing based on legitimate interests or for direct marketing;
(f) request data portability, where technically feasible; and
(g) withdraw consent at any time, where processing is based on consent.
9.2 To exercise any of these rights, contact us at hello@dharas.io. We may need to verify your identity before responding.
9.3 You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, or the data protection authority in your country of residence, if you believe your data protection rights have been infringed.
10. Security
We maintain reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Children's privacy
The Services are not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.
12. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified by email or through a notice on the Services at least 30 days before they take effect. The "Last updated" date at the top of this Policy indicates when it was last revised.
13. Contact us
If you have questions about this Policy or how we handle personal data, contact us at:
Furious Fox Limited
21 East Street, Bromley, England, BR1 1QE
Company number: 10443248
Email: hello@dharas.io