Privacy Policy

1. Data Controller

ECAT Electronic Compliance Audit Tools Ltd. (trading as ECAT) is the data controller responsible for the personal data collected through this website (ecat-group.com), our electronic process validation platform, and our business operations.

2. Applicable Data Protection Laws

ECAT is an Irish company serving clients across Europe, the United Kingdom, and the United States. We process personal data in compliance with the following legislation:

2.1 European Union

• EU General Data Protection Regulation (GDPR): Regulation (EU) 2016/679, as applied in Ireland through the Data Protection Act 2018. ECAT is established in Ireland and subject to the supervisory authority of the Irish Data Protection Commission (DPC).

2.2 United Kingdom

• UK General Data Protection Regulation (UK GDPR): The retained EU GDPR, as supplemented by the Data Protection Act 2018 (UK). ECAT serves UK-based enterprise clients and processes personal data of UK residents in accordance with UK data protection law.
• UK Data (Use and Access) Act 2025 (DUAA): The DUAA received Royal Assent on 19 June 2025, with the main data protection provisions in force from 5 February 2026. ECAT complies with the DUAA’s amendments to the UK GDPR, including the new ‘recognised legitimate interests’ lawful basis, enhanced children’s data protections and ‘children’s higher protection matters’, the mandatory data protection complaints procedure (Section 103, in force from 19 June 2026), updated data subject access request (DSAR) handling requirements including the ‘reasonable and proportionate’ search standard and clock-pausing mechanism, revised automated decision-making safeguards, and relaxed cookie consent requirements for non-intrusive analytics cookies.
• ICO Children’s Code: The ICO’s Age Appropriate Design Code applies to online services likely to be accessed by children. While ECAT’s services are B2B, we apply the principles of the Code where relevant and recognise children’s right to enhanced data protection.
• Supervisory Authority: The UK Information Commissioner’s Office (ICO) has supervisory authority for UK data subjects.

2.3 United States

• California Consumer Privacy Act (CCPA/CPRA): Where ECAT processes personal information of California residents, we comply with the CCPA as amended by the California Privacy Rights Act (CPRA). California residents have additional rights described in Section 12.
• Other US State Laws: ECAT monitors and complies with applicable state privacy laws including the Colorado Privacy Act, Connecticut Data Privacy Act, Virginia Consumer Data Protection Act, and other state laws as they come into effect. US-based individuals may exercise their rights as described in Section 12.
• Children’s Online Privacy Protection Act (COPPA): ECAT does not knowingly collect personal data from children under the age of 13 in the United States.

3. What Personal Data We Collect

3.1 Data You Provide Directly

We collect personal data that you voluntarily provide through:

• Contact forms and enquiry submissions on ecat-group.com
• Email, phone, and video meeting correspondence with ECAT staff
• Client onboarding, contract execution, and account management
• Demo requests and product trial registrations
• Job applications and recruitment processes
• Event registrations, webinars, and industry engagement
• Support requests and customer service interactions

This typically includes: name, business email address, phone number, company name, job title, and the content of your communications.

3.2 Data We Collect Automatically

When you visit ecat-group.com, we automatically collect:

• IP address and approximate geographic location (city/country level only — we do not collect precise GPS location)
• Browser type, version, language preference, and operating system
• Device type and screen resolution (desktop, mobile, tablet)
• Referring website URL and search terms that led you to our site
• Pages visited, time spent on each page, scroll depth, and navigation path
• Date, time, and duration of your visit
• Cookie identifiers and session tokens (see Section 10)

This data is collected through cookies, server logs, and similar technologies. No data collected automatically can, on its own, directly identify you by name.

3.3 Data from Third Parties

We may receive personal data from:

• LinkedIn and professional networks — where you engage with ECAT content or connect with our staff
• Business intelligence platforms — publicly available business contact information for B2B marketing
• Our clients — where client employees are provisioned on the ECAT platform (name, business email)
• Referrals — where a colleague, partner, or business contact introduces you to ECAT
• Payment processors — transaction confirmation data for billing purposes

3.4 Special Category Data

ECAT does not intentionally collect special category data (as defined in Article 9 of the GDPR) including data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data for identification, health data, or data concerning sex life or sexual orientation.

If special category data is inadvertently provided (for example, in a support request or job application), we will process it only to the extent necessary and with appropriate safeguards, or securely delete it if processing is not required.

4. How and Why We Use Your Data

We process personal data only where we have a valid legal basis. The following table sets out each purpose of processing, the corresponding legal basis under GDPR Article 6, and the applicable retention period:

Where we rely on legitimate interest as our legal basis, we have conducted a Legitimate Interest Assessment (LIA) to ensure that our interests do not override your rights and freedoms. You may request a copy of our LIA by contacting privacy@ecat-group.com.

Under the DUAA, certain processing activities qualify for the new ‘recognised legitimate interests’ basis, which does not require a balancing assessment. ECAT applies this basis only where permitted by the DUAA’s Annex 1 conditions.

5. Children’s Data

5.1 Age Restrictions

ECAT’s website and services are directed exclusively at businesses and professionals. We do not knowingly collect, process, or store personal data from:

• Children under 16 years of age (Ireland and EU — in accordance with GDPR Article 8)
• Children under 13 years of age (United Kingdom — in accordance with the UK GDPR and the ICO Children’s Code)
• Children under 13 years of age (United States — in accordance with the Children’s Online Privacy Protection Act, COPPA)

5.2 Enhanced Protections

In accordance with the UK Data (Use and Access) Act 2025 (DUAA), ECAT recognises that children merit specific and enhanced protection regarding their personal data. The DUAA introduces ‘children’s higher protection matters’ for online services likely to be accessed by children, including consideration of how best to protect and support children when using the service.

Although ECAT’s services are B2B and not directed at children, we apply the following safeguards:

• We do not use age-targeted advertising, behavioural profiling of minors, or age-based personalisation
• We do not design features intended to attract or engage children
• We apply the ICO’s Children’s Code (Age Appropriate Design Code) principles where relevant to our website
• Our website does not use manipulative design patterns (‘dark patterns’) that could exploit children or vulnerable users

5.3 Discovery and Deletion

If we become aware that we have collected personal data from a child without appropriate parental or guardian consent, we will:

• Immediately cease processing the data
• Securely delete the data within 72 hours of discovery
• Notify the relevant supervisory authority (DPC or ICO) where required under GDPR Article 33
• Notify the parent or guardian where the breach is likely to result in a high risk to the child’s rights

If you believe a child has provided personal data to ECAT, please contact us immediately at privacy@ecat-group.com.

5.4 Client Data Involving Children

Where ECAT clients use our platform to process data that may include children’s personal data (for example, in education, healthcare, or public sector compliance settings), the client is the data controller and is responsible for ensuring lawful processing, obtaining any necessary consent, and conducting a Data Protection Impact Assessment (DPIA) where required. ECAT acts as data processor and provides the technical and organisational controls — including encryption, access controls, audit logging, and data minimisation — to support the client’s compliance obligations.

6. Automated Decision-Making and Profiling

6.1 Current Position

ECAT does not currently use automated decision-making (ADM) that produces legal effects or similarly significant effects on individuals, as described in GDPR Article 22 and UK GDPR Article 22 as amended by the DUAA.

We do not use profiling to make decisions about:

• Access to our services or platform features
• Pricing, credit, or contractual terms
• Recruitment outcomes (all hiring decisions involve human review)
• Any other matter that would significantly affect an individual

6.2 Analytics and Aggregation

We use website analytics tools to understand visitor behaviour in aggregate (for example, most-visited pages, average session duration). This analytics processing does not result in decisions about individual visitors and is not profiling as defined by GDPR Article 4(4).

6.3 DUAA Safeguards

The DUAA creates a more permissive framework for automated decision-making in the UK, while requiring enhanced safeguards. If ECAT introduces any form of ADM in the future, we commit to implementing the following safeguards in accordance with the DUAA:

• Providing clear information to affected individuals about the decision and the logic involved
• Enabling individuals to make representations about and challenge automated decisions
• Enabling individuals to obtain meaningful human intervention in respect of automated decisions
• Conducting a Data Protection Impact Assessment (DPIA) before deploying any ADM system
• Updating this privacy notice to reflect the change

7. Who We Share Your Data With

We share personal data only where necessary and with appropriate contractual and technical safeguards:

We do not sell, rent, trade, or otherwise commercially distribute your personal data to third parties for their own marketing or commercial purposes. This commitment applies regardless of jurisdiction.

In the event of a business sale, merger, or acquisition, personal data may be transferred to the acquiring entity. We would notify affected individuals and ensure the acquiring entity assumes the same data protection obligations.

8. International Data Transfers

8.1 Primary Processing Location

ECAT’s primary data processing occurs within the European Economic Area (EEA), in ISO 27001 and SOC 2 certified cloud data centres located in Ireland and the United Kingdom. The majority of personal data does not leave the EEA.

8.2 Transfers to the United Kingdom

The European Commission has issued an adequacy decision for the United Kingdom (renewed in December 2025, valid until December 2031), confirming that the UK provides an adequate level of data protection. Personal data transfers between ECAT (Ireland) and our UK clients and staff are permitted without additional safeguards under this adequacy decision.

8.3 Transfers to the United States

Where personal data is transferred to the United States (for example, where ECAT has US-based staff or clients), we rely on:

• EU Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c)
• The EU-US Data Privacy Framework (DPF) where the US recipient is certified under the framework
• UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs for UK personal data

We conduct transfer impact assessments where required to evaluate the legal framework in the destination country.

8.4 Sub-processors

ECAT maintains a list of sub-processors who may process personal data on our behalf. This list is available upon request by contacting privacy@ecat-group.com. We will notify clients of any changes to sub-processors in accordance with our data processing agreements.

9. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following retention periods apply:

When retention periods expire, personal data is securely deleted or irreversibly anonymised in accordance with our ISO 27001 information security policies. Secure deletion includes cryptographic erasure for cloud-stored data and secure wipe for device-stored data.

You may request deletion of your personal data at any time (see Section 12 — Your Rights). We will comply unless we have a legal obligation to retain the data.

10. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. You can manage your cookie preferences through the cookie consent banner displayed on your first visit, through your browser settings, or by contacting us.

10.1 Cookie Types

10.2 Managing Cookies

You can control cookies through:

• Our cookie consent banner — adjust your preferences at any time by clicking the cookie settings link in the website footer
• Your browser settings — most browsers allow you to block or delete cookies. Note that blocking all cookies may affect website functionality.
• Opt-out tools — our analytics providers offer browser-based opt-out tools; see our Cookie Policy page for details

10.3 Do Not Track

ECAT respects the ‘Do Not Track’ (DNT) browser signal. If your browser sends a DNT signal, we will not load analytics or marketing cookies for your session.

11. How We Protect Your Data

ECAT is certified to ISO/IEC 27001:2022 (NSAI File No. 27001.81), the international standard for information security management. Our certification is audited annually by NSAI.

We implement appropriate technical and organisational measures including:

• Encryption at rest (AES-256) and in transit (TLS 1.2+) for all personal data
• Multi-factor authentication (MFA) enforced for all system access
• Risk-based access policies controlling access based on identity, device compliance, and location
• Continuous security monitoring through enterprise endpoint detection and response (EDR) and identity threat protection
• Regular vulnerability assessments and security testing
• Defined incident response procedures with breach notification processes
• Staff security awareness training covering phishing, data protection, and secure practices
• Access controls based on the principle of least privilege, with regular access reviews

For more information about our security practices, see our Information Security Policy on this website.

12. Your Rights

12.1 Rights Under EU GDPR and UK GDPR

You have the following rights in relation to your personal data:

• Right of access (Art. 15): Request a copy of the personal data we hold about you, including the purposes of processing, categories of data, recipients, retention periods, and the source of data not collected from you directly. We will provide this in a commonly used electronic format.
• Right to rectification (Art. 16): Request correction of inaccurate personal data or completion of incomplete data without undue delay.
• Right to erasure / ‘right to be forgotten’ (Art. 17): Request deletion of your personal data where there is no compelling reason for continued processing. This applies where the data is no longer necessary, you withdraw consent, you object to processing, or the data was unlawfully processed. This right does not apply where retention is required for legal compliance, public interest, or the exercise of legal claims.
• Right to restrict processing (Art. 18): Request that we temporarily limit processing while the accuracy of data is verified, where processing is unlawful but you prefer restriction over erasure, where we no longer need the data but you need it for legal claims, or where you have objected to processing pending verification of our legitimate grounds.
• Right to data portability (Art. 20): Request your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) for transfer to another controller. This applies to data processed by automated means based on consent or contract.
• Right to object (Art. 21): Object to processing based on legitimate interest or public interest. Where you object to direct marketing, we will stop processing immediately and without exception.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw consent at any time by contacting us or using the unsubscribe link in marketing emails. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decision-making (Art. 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. ECAT does not currently use such processing (see Section 6).

12.2 Additional Rights Under the DUAA (UK)

UK residents benefit from additional rights and clarifications under the Data (Use and Access) Act 2025:

• DSAR searches are limited to ‘reasonable and proportionate’ searches — we will not conduct exhaustive searches where disproportionate but will document our search methodology
• The response clock may be paused where we reasonably require clarification from you to process your request
• Enhanced safeguards for automated decision-making including the right to make representations, challenge decisions, and obtain human intervention

12.3 Additional Rights for US Residents

If you are a resident of California or another US state with applicable privacy legislation:

• Right to know: Request what personal information we collect, the sources, the business purposes, and the categories of third parties with whom we share it.
• Right to delete: Request deletion of your personal information, subject to certain exceptions.
• Right to opt out of sale/sharing: ECAT does not sell personal information. We do not share personal information for cross-context behavioural advertising.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to correct: Request correction of inaccurate personal information.

12.4 How to Exercise Your Rights

To exercise any of these rights:

• Email: privacy@ecat-group.com

Our process:

• We will acknowledge your request within 72 hours
• We will verify your identity before processing your request — this may require you to confirm details we hold about you
• We will respond substantively within 30 days (one calendar month under GDPR). If your request is complex, we may extend by up to two additional months and will notify you of the extension and the reasons
• There is no fee for making a request unless it is manifestly unfounded, repetitive, or excessive, in which case we may charge a reasonable fee or decline the request with reasons
• If we cannot comply with your request, we will explain why within the response timeframe

13. Data Protection Complaints

13.1 Complain to ECAT First

In accordance with the DUAA Section 103 mandatory complaints procedure (in force from 19 June 2026), ECAT has established a clear and effective process for handling data protection complaints. You may complain to us through any channel including email, post, phone, or social media.

To make a complaint: email privacy@ecat-group.com or write to our Data Protection Officer at the address above. We will acknowledge your complaint within 72 hours and provide a substantive response within 30 days. You may also report potential ethics issues or unlawful activity via our confidential whistleblowing service at ecat.speakup.zone.io.

13.2 Supervisory Authorities

You have the right to lodge a complaint with a supervisory authority at any time. You do not need to complain to ECAT first, although we welcome the opportunity to resolve your concern.

Ireland — Data Protection Commission (DPC):

• 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
• Website: dataprotection.ie
• Phone: +353 1 765 0100 / +353 57 868 4800
• Email: info@dataprotection.ie

United Kingdom — Information Commissioner’s Office (ICO):

• Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
• Website: ico.org.uk
• Phone: 0303 123 1113
• Live chat: available on ico.org.uk

United States:

• California residents may contact the California Attorney General: oag.ca.gov/privacy
• Residents of other states may contact their state Attorney General’s office
• ECAT is committed to resolving US privacy complaints directly — contact privacy@ecat-group.com

14. Third-Party Links and Services

Our website may contain links to third-party websites, products, or services that are not operated by ECAT. We are not responsible for the privacy practices, content, or security of these third-party sites.

We encourage you to read the privacy notice of every website you visit. This privacy notice applies only to ecat-group.com and ECAT-operated services.

Where we embed third-party content on our website (such as videos, maps, or social media widgets), those third parties may set cookies or collect data in accordance with their own privacy policies.

15. Marketing and Communications

Where you have consented to receive marketing communications, we will send you information about ECAT products, services, industry updates, and events.

• You can opt out of marketing at any time by clicking the ‘unsubscribe’ link in any marketing email
• You can update your marketing preferences by emailing privacy@ecat-group.com
• Opting out of marketing does not affect service communications (for example, security updates, contract notices, or platform maintenance notifications)

We do not share your contact details with third parties for their marketing purposes.

16. Changes to This Notice

This privacy notice was last updated on 22 June 2026 (version 4.0). We review this notice at least annually, and whenever there are material changes to our data processing activities, applicable legislation, or regulatory guidance.

Material changes will be communicated through:

• A prominent notice on the ecat-group.com homepage
• Direct email communication to affected individuals where appropriate
• An updated ‘last updated’ date at the top of this notice

Previous versions of this notice are available upon request by emailing privacy@ecat-group.com.