Privacy Notice

Last updated: October 2026

StorMagic Limited (“StorMagic”, “we”, “us”) respects your privacy. This notice explains what personal data we collect, why we collect it, what we do with it, and the rights you have over it.

It covers the personal data we handle as a controller — that is, where we decide why and how your data is used. Where we process data on behalf of a customer as part of delivering our products or services, that customer is the controller and their own privacy notice applies; our obligations in that case are set out in our contract with them.

StorMagic Limited is the controller for the personal data described in this notice.

StorMagic Limited is part of a group that also includes StorMagic Inc in the United States and StorMagic Canada Inc. Where we share your data within the group, we say so below.

We collect different data depending on how you deal with us. Everything we collect has a purpose and a lawful basis under UK GDPR.

You can withdraw consent or object to marketing at any time, using the unsubscribe link in any email, the preferences page, or the privacy contact above. Withdrawing consent does not affect anything we did before you withdrew it.

We will tell you at the point of application how long we keep recruitment records.

Most of the personal data we hold comes directly from you. We also receive business contact details from your employer, from our channel partners and resellers, from event organisers where you have agreed to your details being shared, and from public and commercial business information sources and directories.

We share personal data with:

• Other StorMagic group companies — StorMagic Inc and StorMagic Canada Inc — where needed to serve you, support a shared customer relationship or run the business.
• Our service providers, acting on our instructions under contract. These fall into the following categories, and where we name a provider the list is not exhaustive:
  • customer relationship management, including Salesforce
  • email and business productivity, including Microsoft
  • customer support and ticketing, including Zendesk
  • enterprise resource planning and finance, including Oracle Netsuite
  • website analytics, including Google Analytics
  • marketing automation and events, including HubSpot
  • cloud hosting and infrastructure, IT and security services, and professional advisers
  • A current list of the providers we use is available on request from our privacy contact.
• Our channel partners and resellers, where you have been introduced by them or where they support your deployment.
• Regulators, law enforcement, courts, insurers and advisers, where we are required to or where we need to establish, exercise or defend legal claims.
• A buyer or successor, if we sell or reorganise part of our business.

We do not sell personal data.

Because our group operates in the United States and Canada, and some of our service providers do too, your personal data may be transferred outside the United Kingdom.

Where we do this, we rely on one of the following: an adequacy decision covering the destination country; the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment; or another mechanism permitted by UK data protection law. You can ask us for details of the safeguards that apply using the privacy contact above.

We keep personal data only for as long as we need it for the purpose we collected it, or for as long as the law requires. Our retention periods are set in our internal Records Retention Policy. In summary:

When a retention period ends, we securely delete or anonymise the data.

We do not make decisions that produce legal or similarly significant effects about you using automated processing alone. We do use ordinary marketing tools that score or segment business contacts by engagement; this does not have a legal or similarly significant effect, and you can object to it at any time.

Under UK data protection law you have the right to:

• be informed about how we use your data — that is what this notice is for;
• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased in certain circumstances;
• restrict how we use your data in certain circumstances;
• object to processing based on legitimate interests, and to object to direct marketing at any time, with no exceptions;
• data portability — receive certain data in a structured, commonly used, machine-readable format, and have it sent to another controller; and
• withdraw consent at any time, where we rely on consent.

To exercise any of these, contact us using the details above. We will respond within one month. If your request is complex or you have made several, we may extend that by up to two further months and will tell you if we do. We may need to verify your identity first. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your personal data, please tell us first using the privacy contact above so we can put it right.
You also have the right to complain to the UK regulator, the Information Commission (formerly the Information Commissioner’s Office), at ico.org.uk/concerns or on 0303 123 1113. Complaining to us first does not affect that right.

We review this notice at least once a year and whenever our processing changes materially. The date at the top shows when it was last updated. Where a change materially affects you, we will bring it to your attention rather than relying on you to notice it.