Data controller and contact
Privacy Operator at Oxiti Ltd
Oxiti Ltd, 5 Canon Court, Institute Street, Bolton, England, BL1 1PZ
privacy@ita.to
ITA.TO is a product and brand of OXITI LTD (UK company number 15228422). Verify the listed contact mailbox and all other legal details before publication. Companies House record.
Categories and purposes
| Information | Purpose | Typical retention / status |
|---|---|---|
| Name, email, password hash, verification status, timezone | Account and authentication | While account active; reviewed upon erasure |
| Member display name, job title, organisations and roles | Workspace collaboration | While needed for team |
| Created link destination, title, slug and QR references | Deliver customer link and QR services | While workspace assets are active |
| Clicks/QR fetch times, device class, referrer hostname, country when trusted, UTM labels | Campaign analytics and troubleshooting | Raw visit events: 90 days by default |
| Login outcomes, devices and timestamps | Account security and fraud prevention | 180 days by default |
| Turnstile challenge tokens and verification status; Cloudflare may process browser/network signals | Prevent automated registration, sign-in and form abuse | ITA.TO validates tokens and does not intentionally retain challenge tokens; review Cloudflare's applicable processing and retention |
| Hashed IP-derived network tokens and rule codes | Abuse prevention and incident diagnosis | 30 days by default for incident events |
| Stripe subscription, invoice, payment and refund references | Billing, records and compliance | Retention determined by statutory/accounting duties |
| Email address and delivery queue content | Transactional notifications | Sent email queue removed after 30 days by default |
| Privacy request metadata and explanation | Evidence of statutory response | 365 days by default, subject to lawful holds |
Lawful basis and third parties
Contract may support account/service processing; legitimate interests may apply to security, fraud prevention and proportionate analytics, subject to an assessment; legal obligations apply to required billing records. Separate consent may be required for optional tracking or marketing. Processor details must be verified: Plesk hosting provider, Cloudflare (proxy and Turnstile form protection), Stripe for billing, and MXroute or Plesk mail.
Rights and requests
You may request access, rectification, erasure, restriction, objection or portability as applicable. You can start an authenticated request from the Privacy Centre or contact the address above without an account. We will identify exemptions, legal retention and identity verification requirements case by case. If dissatisfied, you may complain to the UK Information Commissioner's Office (ICO).
Cookies and visitors
An essential first-party PHP session cookie supports account authentication and CSRF defence. This starter does not set advertising cookies or create visitor fingerprints in its own PHP code. Cloudflare Turnstile may process device/browser or network signals on protected forms; its data processing and legal disclosures must be reviewed separately. Web-server and Cloudflare access logs, DNS proxy analytics and backup systems may hold further information; document those separately and verify whether optional technologies require consent.
International transfers, security and retention
The operator must document host and service-provider locations, any restricted international transfers and applicable safeguards. Backups and hosting logs follow their configured lifecycle; user-interface erasure does not instantly delete immutable backups. This notice is a configurable template and not proof of compliance.