Privacy
Policy

Version 1.0  |  Effective Date: April 2026
IMPORTANT NOTICE: This Privacy Policy explains how Struto Ltd collects, uses, discloses, retains and protects personal data relating to its clients, prospective clients, website visitors, suppliers, business contacts and other individuals. It should be read alongside Struto’s Terms and Conditions and any applicable Statement of Works. Please read it carefully.

1.  INTERPRETATION
1.1 In this Privacy Policy, unless the context otherwise requires, the following expressions shall have the following meanings:
1.2 “Applicable Laws” means all laws, statutes, regulations and codes of practice applicable to the processing of personal data, including (without limitation) the UK GDPR, the DPA 2018, the PECR and the DUAA, together with any guidance or codes of practice issued by the ICO from time to time; 
1.3 “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; 
1.4 “Data Subject” means the identified or identifiable natural person to whom personal data relates; 
1.5 “DPA 2018” means the Data Protection Act 2018; 
1.6 “DUAA” means the Data (Use and Access) Act 2025; 
1.7 “ICO” means the Information Commissioner’s Office, the supervisory authority responsible for data protection in the United Kingdom; 
1.8 “PECR” means the Privacy and Electronic Communications Regulations 2003 (as amended); 
1.9 “Personal Data” means any information relating to an identified or identifiable natural person, as defined in the UK GDPR; 
1.10 “Platforms” means Struto’s proprietary software products and technology services, including strutoIX, strutoUX, strutoCX and strutoAI; 
1.11 “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of a Controller; 
1.12 “Protected Data” means Personal Data processed by Struto in connection with the Services or the Platforms; 
1.13 “Services” means the services provided by Struto to clients as set out in the applicable Statement of Works, including HubSpot implementation, integration services, website development, AI-powered solutions and managed support services; 
1.14 “SoW” means a Statement of Works entered into between Struto and a client under Struto’s Terms and Conditions; 
1.15 “Special Category Data” has the meaning given in Article 9 of the UK GDPR; 
1.16 “Sub-processor” means any third-party processor engaged by Struto to carry out processing activities on its behalf in connection with the Services or the Platforms; 
1.17 “Struto”, “we”, “us” or “our” means Struto Ltd (company number 07587184), whose registered office is at B1 Vantage Point, Old Gloucester Road, Hambrook, Bristol, BS16 1GW; and 
1.18 “UK GDPR” means the retained EU law version of the General Data Protection Regulation (EU) 2016/679, as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018.
1.19 In this Privacy Policy, unless the context requires otherwise: (a) references to any act or regulation shall be construed as referring also to any amendment or re-enactment of that act or regulation;  (b) the singular includes the plural and vice versa;  (c) headings are for convenience only and shall not affect interpretation; and  (d) references to “writing” include email.

2.  IDENTITY OF THE DATA CONTROLLER
2.1 Struto Ltd is the Data Controller in respect of Personal Data collected through its website at www.struto.io and through the operation of its business, except where a SoW or other written agreement expressly provides that Struto acts as Data Processor on behalf of a client.
2.2 Struto is a HubSpot systems integrator and digital customer experience specialist operating an Outcomes-as-a-Service (OaAS) model. Its Platforms and Services include HubSpot implementation, integration engineering, AI-powered workflow automation, website development and managed support.
2.3 Struto has designated a Senior Responsible Individual (SRI) with responsibility for data protection compliance in accordance with the DUAA. Any data protection queries or correspondence should be directed to Struto using the contact details set out in Clause 14 of this Privacy Policy.
2.4 This Privacy Policy should be read alongside Struto’s Terms and Conditions (available at www.struto.io/terms-and-conditions) and any applicable SoW. In the event of conflict between this Privacy Policy and any SoW in respect of data processed by Struto as Processor, the SoW shall prevail.

3.  LEGAL FRAMEWORK AND APPLICABLE LEGISLATION
3.1 This Privacy Policy is drafted to comply with Struto’s obligations under the following legislative and regulatory instruments:
3.2 (a) the UK GDPR, as it forms part of retained EU law under the European Union (Withdrawal) Act 2018;  (b) the DPA 2018;  (c) the PECR;  (d) the DUAA; and  (e) any other applicable privacy, data protection or electronic communications legislation in force from time to time in the jurisdictions in which Struto operates.
3.3 The DUAA represents a significant evolution in the UK’s approach to data regulation and introduces provisions that directly bear on how Struto processes Personal Data. The key provisions of the DUAA relevant to Struto’s processing activities are as follows:
3.4 (a) a statutory framework for “recognised legitimate interests”, providing a clearer basis for certain categories of processing without the need for a full balancing test in every case, which Struto will apply where relevant to its processing activities;  (b) enhanced requirements in relation to automated decision-making that produces legal or similarly significant effects on individuals, including obligations of transparency, the right to human review and the right to contest decisions;  (c) the introduction of the Senior Responsible Individual (SRI) role in place of the mandatory Data Protection Officer requirement for certain organisations, with updated accountability obligations;  (d) amendments to the cookie consent requirements under the PECR framework, moving towards a more permissive approach for certain low-risk analytics and functionality cookies; and  (e) new provisions governing the use of data in connection with digital verification services, data intermediaries and smart data schemes.
3.5 Struto monitors the implementation of the DUAA and updates its policies, procedures and technical controls accordingly as relevant provisions come into force.
3.6 Where Struto operates in connection with clients or integrations in other jurisdictions, it additionally takes into account the requirements of the EU GDPR and other locally applicable legislation to the extent relevant to the specific processing activity concerned.

4.  PERSONAL DATA STRUTO COLLECTS
4.1 Struto may collect and process the following categories of Personal Data, depending on the nature of the individual’s relationship with Struto:
4.2 Identity and Contact Data.  (a) first name, last name and job title;  (b) employer name and, where applicable, the legal entity with which the individual is associated;  (c) business postal address, email address and telephone number(s); and  (d) any personal contact details voluntarily provided to Struto.
4.3 Technical and Usage Data.  When an individual visits www.struto.io, Struto may automatically collect: (a) Internet Protocol (IP) address, browser type and version;  (b) pages visited, time and date of visit, and time spent on each page;  (c) referring URLs and clickstream data; and  (d) device information, including operating system and screen resolution.
4.4 Marketing and Communications Data.  This includes preferences in receiving marketing communications, records of attendance at or registration for Struto events and webinars, and records of communications between the individual and Struto.
4.5 Transaction and Service Data.  Where a client engages Struto for Services, Struto may process data relating to that engagement, including SoW details, billing information, support ticket history, HubSpot portal configuration data, and records of meetings, calls and correspondence relevant to service delivery.
4.6 Platform Integration Data.  In the course of delivering its Platforms — including strutoIX, strutoUX, strutoCX and strutoAI — Struto may process data, which may include Personal Data, that flows between clients’ HubSpot portals and other connected systems such as Microsoft Dynamics 365, SAP, Xero, Azure and Snowflake. In such cases Struto acts as Data Processor on behalf of the relevant client (who is the Data Controller), and processing is governed by the applicable data processing terms in the relevant SoW.
4.7 Special Category Data.  Struto does not intentionally collect Special Category Data in the ordinary course of its business activities. If Struto ever needs to process such data in connection with an employment or supplier relationship, it will do so only with an appropriate lawful basis and in compliance with the additional safeguards required by Applicable Laws.

5.  HOW STRUTO COLLECTS PERSONAL DATA
5.1 Struto collects Personal Data through the following means:
5.2 (a) directly from individuals when they contact Struto via its website, submit an enquiry form, register for a webinar or event, request a demonstration of a Platform, or otherwise engage voluntarily;  (b) through use of Struto’s website, via cookies and similar technologies as further described in Clause 11 of this Privacy Policy;  (c) from the individual’s employer or associated organisation in the context of a commercial relationship between that organisation and Struto;  (d) from third-party sources, including publicly available professional databases, LinkedIn and other professional networking platforms, marketing data providers and industry event organisers, in each case where Struto has a legitimate purpose for doing so; and  (e) through the operation and delivery of Struto’s Platforms and integration services, where data flows across connected systems in the course of service delivery.

6.  LAWFUL BASIS FOR PROCESSING
6.1 Struto will only process Personal Data where it has a lawful basis for doing so. The lawful bases upon which Struto relies are as follows:
6.2 Contract.  Where processing is necessary for the performance of a contract to which the individual or their organisation is a party, or to take steps at their request prior to entering into a contract. This basis applies, for example, to the processing of contact and transactional data in connection with service delivery under a SoW.
6.3 Legitimate Interests.  Where processing is necessary for the purposes of the legitimate interests pursued by Struto or a third party, except where such interests are overridden by the individual’s fundamental rights and freedoms. Struto relies on this basis for: (a) business development and maintaining relationships with existing and prospective clients;  (b) ensuring the security and integrity of its systems and data;  (c) sending direct marketing communications to business contacts where there is an existing professional relationship; and  (d) analysing website usage to improve the performance and content of its digital properties. 
Struto carries out a legitimate interests assessment (LIA) where it relies on this basis and takes into account the DUAA’s statutory framework for recognised legitimate interests where applicable.
6.4 Legal Obligation.  Where processing is necessary for compliance with a legal obligation to which Struto is subject, such as tax and financial reporting obligations, responding to lawful requests from regulatory authorities, and complying with anti-money laundering legislation.
6.5 Consent.  Where the individual has given freely given, specific, informed and unambiguous consent to processing for a particular purpose, such as subscribing to marketing emails or accepting non-essential cookies. The individual has the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

7.  HOW STRUTO USES PERSONAL DATA
7.1 Struto uses the Personal Data it collects for the following purposes:
7.2 (a) to respond to enquiries, provide information about its Platforms and Services and manage its commercial relationship with the individual or their organisation;  (b) to perform and manage contracts for the provision of Services, including HubSpot implementation, integration configuration, website development and ongoing managed support under its OaAS model;  (c) to deliver, maintain, support and improve its Platforms, including strutoIX, strutoUX, strutoCX and strutoAI, and to manage platform integrations with third-party systems on behalf of clients;  (d) to send marketing communications about Struto’s services, events, thought leadership content and industry updates, where the individual has consented or where Struto has a legitimate interest in doing so;  (e) to administer and manage access to client portals, including the Sphere dashboard, and to authenticate users and maintain audit trails;  (f) to conduct market research, business analysis and internal reporting to improve Struto’s service offering and commercial strategy;  (g) to comply with legal and regulatory obligations, including data protection, tax, corporate governance and anti-fraud requirements;  (h) to protect Struto’s legal rights and enforce its Terms and Conditions and SoWs;  (i) to manage and investigate complaints, disputes or claims relating to the Services; and  (j) to carry out automated or AI-assisted processing activities forming part of the strutoAI Platform, where such activities are disclosed to and agreed with the relevant client and where appropriate safeguards are in place as required by the DUAA and UK GDPR.

8.  SHARING AND DISCLOSURE OF PERSONAL DATA
8.1 Struto does not sell Personal Data to third parties. Struto may share Personal Data in the following circumstances:
8.2 Sub-processors and service providers.  Struto engages trusted third-party Sub-processors to assist in delivering its Services and operating its business. These include, without limitation, HubSpot, Inc. (primary CRM and marketing automation platform), cloud hosting and infrastructure providers, payment processors, email delivery services, analytics providers and professional advisers including legal counsel and accountants. All Sub-processors are required to process Personal Data only on Struto’s documented instructions and to implement appropriate technical and organisational measures, in accordance with Struto’s Terms and Conditions.
8.3 Integration partners.  In the course of configuring and managing integrations through strutoIX and related Platforms, Personal Data may be transmitted to or processed by third-party systems designated by clients, such as Microsoft, SAP, Xero, Snowflake or Azure. Such sharing is governed by the relevant client’s instructions and the applicable SoW.
8.4 Legal and regulatory disclosure.  Struto may disclose Personal Data where required to do so by law, court order or the directions of a competent regulatory authority, including the ICO.
8.5 Business transfers.  In the event of a merger, acquisition, reorganisation or sale of all or part of Struto’s business assets, Personal Data may be transferred to the relevant successor entity, subject to appropriate confidentiality arrangements.
8.6 Professional advisers.  Struto may share Personal Data with its solicitors, accountants, insurers and other professional advisers where necessary for them to provide advice in connection with Struto’s business operations, on a confidential basis.

9.  INTERNATIONAL TRANSFERS OF PERSONAL DATA
9.1 Some of Struto’s Sub-processors and integration partners are located outside the United Kingdom. Where Struto transfers Personal Data to countries not providing an equivalent level of data protection to that available in the UK, it will ensure that appropriate safeguards are in place, including:
9.2 (a) relying on an adequacy decision made by the UK Secretary of State in respect of the destination country or territory;  (b) entering into UK International Data Transfer Agreements (IDTAs) or UK Addenda to EU Standard Contractual Clauses as approved by the ICO; or  (c) another lawful transfer mechanism available under the UK GDPR and DPA 2018.
9.3 In particular, transfers to the United States in connection with HubSpot’s data hosting infrastructure are subject to appropriate transfer mechanisms. Individuals may request further information about the specific safeguards applicable to any such transfer by contacting Struto using the details set out in Clause 14.

10.  DATA RETENTION
10.1 Struto retains Personal Data only for as long as is necessary for the purposes for which it was collected, having regard to its legal, regulatory and contractual obligations. The following principles govern Struto’s retention decisions:
10.2 (a) client and contractual data is retained for the duration of the relevant commercial relationship and for a period of six (6) years thereafter, in accordance with obligations under the Limitation Act 1980 and applicable tax legislation;  (b) marketing and communications data is retained until the individual opts out of receiving marketing communications or otherwise requests erasure, subject to any legal obligation to retain records;  (c) website analytics data is retained for a period determined by Struto’s analytics platform configuration, which is typically no longer than twenty-six (26) months;  (d) data processed in the course of delivering integration or Platform services is retained in accordance with the instructions of the relevant client as Data Controller; and  (e) financial and accounting records are retained for a minimum of six (6) years in accordance with HMRC requirements.
10.3 At the end of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with Struto’s internal data disposal procedures.

11.  COOKIES AND SIMILAR TECHNOLOGIES
11.1 Struto’s website at www.struto.io uses cookies and similar tracking technologies to enhance browsing experience, understand how visitors interact with its content and support its marketing activities. Cookies are small text files placed on a device when a website is visited.
11.2 Struto uses the following types of cookies:
11.3 (a) strictly necessary cookies, which are essential for the operation of the website and cannot be disabled without impairing core functionality;  (b) performance and analytics cookies, which help Struto understand how visitors use the website and identify areas for improvement, including cookies associated with HubSpot’s analytics tools;  (c) functionality cookies, which remember preferences and settings to personalise the individual’s experience; and  (d) marketing and targeting cookies, which enable Struto and its marketing partners to show relevant advertisements and measure the effectiveness of campaigns.
11.4 The DUAA introduces amendments to the PECR framework that may, over time, reduce the need for explicit consent in connection with certain low-risk analytics and functionality cookies. Struto will update its cookie practices as and when relevant provisions of the DUAA come into effect. In the meantime, Struto continues to operate its cookie consent mechanism in compliance with current ICO guidance.
11.5 Cookie preferences may be managed at any time via the cookie settings tool available on Struto’s website, or by adjusting browser settings. Disabling certain cookies may affect the functionality of the website.

12.  AUTOMATED DECISION-MAKING AND AI PROCESSING
12.1 As part of its strutoAI Platform and AI Agents capabilities, Struto may deploy automated data processing activities on behalf of clients, including the orchestration of actions across connected systems in response to data signals. In its capacity as Data Processor, such activities are carried out strictly in accordance with the instructions of the relevant client.
12.2 Where automated decision-making with legal or similarly significant effects is involved, Struto ensures that appropriate safeguards are in place in accordance with Article 22 of the UK GDPR and the enhanced provisions introduced by the DUAA. These safeguards include:
12.3 (a) transparency to the affected individual about the existence of automated decision-making and the logic involved;  (b) the right to obtain human review of any automated decision;  (c) the right to contest a decision and to have it reconsidered by a qualified individual; and  (d) appropriate technical and organisational measures to minimise the risk of errors and bias in automated processing.
12.4 Struto does not make automated decisions about individuals that produce legal or similarly significant effects on them in its capacity as Data Controller without human oversight and the availability of a meaningful right of review.

13.  RIGHTS OF DATA SUBJECTS
13.1 Individuals have the following rights in relation to the Personal Data Struto holds about them, subject to the conditions and limitations set out in the UK GDPR, the DPA 2018 and the DUAA:
13.2 Right of access.  The right to request a copy of the Personal Data Struto holds and to receive information about how it is processed (commonly known as a Subject Access Request or SAR).
13.3 Right to rectification.  The right to request that Struto correct any inaccurate or incomplete Personal Data without undue delay.
13.4 Right to erasure.  The right to request deletion of Personal Data where: (a) it is no longer necessary for the purposes for which it was collected;  (b) consent is withdrawn and there is no other lawful basis for processing;  (c) the individual objects to processing and there are no overriding legitimate grounds; or  (d) the data has been unlawfully processed.
13.5 Right to restriction of processing.  The right to request that Struto restrict the processing of Personal Data in certain circumstances, including where the accuracy of the data is contested or where the individual has objected to processing pending the outcome of a legitimate interests assessment.
13.6 Right to data portability.  Where processing is based on consent or the performance of a contract and is carried out by automated means, the right to receive Personal Data in a structured, commonly used and machine-readable format and to transmit it to another controller.
13.7 Right to object.  The right to object at any time to the processing of Personal Data where Struto relies on legitimate interests as its lawful basis, including for the purposes of direct marketing. Where an individual objects to direct marketing, Struto will cease such processing immediately.
13.8 Rights in relation to automated decision-making.  The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects, except in the circumstances permitted by law and subject to the safeguards described in Clause 12.
13.9 Right to withdraw consent.  Where Struto processes Personal Data on the basis of consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
13.10 To exercise any of the above rights, individuals should contact Struto using the details provided in Clause 14. Struto will respond within one (1) calendar month of receipt of a valid request, as required by Applicable Laws, and may extend this period by a further two (2) months in cases of complexity or volume, in which case the individual will be notified accordingly.
13.11 Individuals also have the right to lodge a complaint with the ICO if they believe their Personal Data has been processed in a manner inconsistent with their rights or Applicable Laws. The ICO can be contacted at www.ico.org.uk or by telephone on 0303 123 1113.


14.  HOW TO CONTACT STRUTO
14.1 Any questions about this Privacy Policy, requests to exercise data protection rights, or concerns or complaints about Struto’s processing of Personal Data should be directed to:
Struto Ltd — Data Protection Contact
B1 Vantage Point, Old Gloucester Road, Hambrook, Bristol, BS16 1GW
Email: compliance@struto.io
Website: www.struto.io
14.2 In accordance with the DUAA, Struto has designated a Senior Responsible Individual (SRI) with responsibility for data protection compliance. All correspondence addressed to the Data Protection Contact will be directed to the SRI for review and response.
14.3 Struto endeavours to address all data protection queries and complaints promptly and constructively. Where an individual remains dissatisfied following Struto’s response, they are entitled to escalate the matter to the ICO as described in Clause 13.11.

15.  SECURITY OF PERSONAL DATA
15.1 Struto has implemented appropriate technical and organisational security measures to protect Personal Data against accidental loss, unauthorised access, disclosure, alteration or destruction. These measures include:
15.2 (a) encryption of data in transit and at rest using industry-standard protocols;  (b) access controls and role-based permissions restricting access to Personal Data to authorised personnel only;  (c) regular security assessments, penetration testing and vulnerability management procedures;  (d) staff training on data protection and information security responsibilities;  (e) incident response and breach notification procedures in accordance with obligations under the UK GDPR and DPA 2018; and  (f) contractual obligations on Sub-processors and third-party service providers to implement equivalent security measures.
15.3 In the event of a Personal Data breach that is likely to result in a risk to individuals’ rights and freedoms, Struto will notify the ICO without undue delay and, where required, will also notify affected individuals directly. Struto’s Terms and Conditions further provide that Struto shall implement and maintain appropriate security procedures to prevent the unauthorised disclosure, destruction, damage, loss or alteration of data processed in the course of service delivery.

16.  THIRD-PARTY WEBSITES AND LINKS
16.1 Struto’s website may contain links to third-party websites, services or applications that are not operated or controlled by Struto. This Privacy Policy applies only to Personal Data processed by Struto and does not extend to the practices of any third party.
16.2 Struto encourages individuals to review the privacy policies of any third-party websites they visit via links from www.struto.io. Struto accepts no responsibility or liability for the content or privacy practices of third-party websites.

17.  CHILDREN’S DATA
17.1 Struto’s website, Platforms and Services are directed exclusively at business clients and professional contacts. Struto does not knowingly collect or process Personal Data relating to individuals under the age of eighteen (18).
17.2 If Struto becomes aware that it has inadvertently collected Personal Data from or about a child, it will take prompt steps to delete such data. Any individual who believes that Struto has collected data relating to a child should contact Struto immediately using the details set out in Clause 14.

18.  CHANGES TO THIS PRIVACY POLICY
18.1 Struto reserves the right to amend or update this Privacy Policy at any time to reflect changes in its data processing practices, Applicable Laws (including further provisions of the DUAA as they are brought into force) or regulatory guidance issued by the ICO.
18.2 The version number and effective date shown at the top of this Privacy Policy indicate when it was last updated. Where changes are material, Struto will take reasonable steps to notify affected individuals, which may include posting a prominent notice on its website or sending an email notification to known contacts.
18.3 Struto encourages individuals to review this Privacy Policy periodically to remain informed about how their Personal Data is protected. Continued use of Struto’s website or Services following notification of any material change constitutes acceptance of the revised Privacy Policy.

19.  GOVERNING LAW AND JURISDICTION
19.1 This Privacy Policy and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of England and Wales.
19.2 The parties irrevocably agree that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Privacy Policy, save in respect of any individual’s statutory right to bring proceedings before the ICO or another competent supervisory authority.