Weave Data Privacy Policy

1. Introduction

1.1 Our Commitment to Privacy

At Weave Data Limited ("Weave", "we", "our" or "us"), we are committed to protecting the privacy, confidentiality and security of the personal information entrusted to us.

We understand that individuals and organisations rely on Weave to process and manage valuable information as part of their everyday work. Protecting that information is fundamental to the way we design, build and operate our platform.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you:

• visit our website at https://weavedata.co.uk;
• create or use a Weave account;
• access or use any Weave products, applications or services;
• communicate with us;
• participate in demonstrations, trials, research or events; or
• otherwise interact with Weave.

Our goal is to be transparent about the information we collect, why we collect it, how we use it, and the choices and rights available to you.

1.2 Our Privacy Principles

We believe that privacy should be built into every stage of our products and services. We are committed to the following principles:

• Transparency – We explain what information we collect and why.
• Purpose Limitation – We only collect information for legitimate business purposes.
• Data Minimisation – We aim to collect only the information necessary to provide and improve our services.
• Security by Design – We implement technical and organisational safeguards designed to protect personal information.
• User Control – Where appropriate, we provide users with choices over how their information is used.
• Continuous Improvement – We regularly review and improve our privacy, security and governance practices.

1.3 Our Approach to Data

Weave is a cloud-based software platform designed to help organisations manage, transform and gain insight from their data.

To provide these services, we process different categories of information depending on how our platform is used. This may include:

• information required to create and manage user accounts;
• information generated through use of the platform;
• information that customers choose to upload or connect to Weave;
• technical information required to secure and operate our services; and
• website usage and product analytics that help us improve the platform.

Where possible, we design our systems to minimise the collection of personal information and to protect customer information through appropriate security controls.

1.4 Product Analytics and Improvement

As part of operating and improving Weave, we collect information about how our website and platform are used, including pages viewed, features used, navigation paths, button clicks, search activity, workflow progress, session duration, performance metrics, error information and interactions with product features.

This information helps us improve usability and accessibility, identify defects and performance issues, understand which features provide the greatest value, improve onboarding and customer success, develop new functionality, and maintain the reliability and security of our platform.

Where required by applicable law, we obtain consent before collecting analytics information through cookies or similar technologies.

1.5 Artificial Intelligence Features

Certain Weave features may use artificial intelligence ("AI") to assist users in analysing information, generating content, automating workflows or providing recommendations. Where AI functionality is used:

• it is provided to deliver the services requested by users;
• user prompts and inputs are processed only for the purpose of providing those services;
• customer content is not intentionally used to train publicly available AI models unless we clearly inform customers and obtain any permissions required by law or contract; and
• AI-generated outputs should be reviewed by users before being relied upon for business, legal or regulatory purposes.

1.6 Your Privacy Rights

Depending on where you are located, you may have legal rights regarding your personal information, including the right to access, correct, delete or restrict certain processing activities. Further information about these rights and how to exercise them is provided in the Your Rights section of this Privacy Policy.

1.7 Changes to this Privacy Policy

As Weave continues to evolve, we may update this Privacy Policy to reflect changes to our products, services, legal obligations or data processing practices. The version number and effective date shown at the beginning of this Privacy Policy indicate the latest published version.

2. Who We Are

2.1 About Weave

This Privacy Policy is issued by Weave Data Limited ("Weave", "we", "our" or "us"). Weave develops and operates a cloud-based software platform that enables organisations to connect, manage, analyse and automate data from a wide range of business systems and data sources.

As part of providing these services, we process personal information in accordance with applicable data protection laws, including the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation ("EU GDPR").

2.2 Data Controller

For the purposes of data protection legislation, Weave Data Limited is the Data Controller for personal information collected through the Weave website, when you create or manage your account, when you communicate directly with us, when you register for demonstrations, webinars, newsletters or marketing communications, when you submit enquiries or support requests, when you participate in surveys, research or feedback programmes, and where we otherwise determine the purposes and means of processing your personal information.

2.3 When Weave Acts as a Data Processor

Where our customers upload, connect or process information within the Weave platform on behalf of their own organisation, Weave generally acts as a Data Processor, while the customer remains the Data Controller. The customer determines why and which information is processed and controls access to their workspace; Weave processes information only in accordance with the customer's documented instructions and applicable contractual terms.

2.4 Registered Office

Weave Data Limited
Registered in England and Wales
Registered Office: Thornfield House, Sandtoft Road, Belton, Doncaster, DN9 1PH
Company Number: 17381046

2.5 Contacting Us

Privacy Team, Weave Data Limited
Email: [email protected]
Website: https://weavedata.co.uk

Where appropriate, we may ask you to verify your identity before responding to requests relating to your personal information.

2.6 Data Protection Officer

At the time of publication, Weave has not appointed a statutory Data Protection Officer (DPO) because we do not currently fall within the circumstances requiring mandatory appointment under Article 37 of the UK GDPR. Responsibility for data protection governance rests with our management team.

2.7 Supervisory Authority

If you are located in the United Kingdom and believe your personal information has been processed in a manner that does not comply with applicable data protection law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk. We encourage you to contact us first so we can investigate and resolve your concerns.

3. Scope of this Privacy Notice

3.1 Purpose of this Privacy Notice

This Privacy Policy explains how Weave collects, uses, stores, shares and protects personal information when individuals interact with our website, products and services, and explains the rights available under applicable data protection legislation.

3.2 Who This Privacy Policy Applies To

This Privacy Policy applies to visitors to the Weave website, prospective customers, individuals creating or managing a Weave account, authorised users of customer workspaces, administrators, customers, individuals who contact our sales, customer success or support teams, attendees of webinars or events, research participants, and any other individual whose personal information Weave processes directly.

3.3 Services Covered

This Privacy Policy applies to personal information collected through the Weave website, the Weave SaaS platform, customer portals, product demonstrations and trials, customer support, email and marketing communications, documentation and knowledge base services, APIs, integrations, and any future products or services that reference this Privacy Policy.

3.4 Customer Data Processed on Behalf of Customers

Where personal information is uploaded, imported, synchronised or otherwise processed within a customer's Weave workspace, Weave generally processes that information solely on behalf of the customer and in accordance with the applicable customer agreement, including the data processing provisions contained within our Terms of Service. Individuals wishing to exercise data protection rights relating to customer-controlled information should normally contact the relevant organisation rather than Weave directly.

3.5 Information Not Covered by this Privacy Policy

This Privacy Policy does not apply to information processed by organisations that use Weave as independent Data Controllers, third-party websites or services not owned by Weave, third-party integrations connected by customers, or products or services that publish their own separate privacy notice.

3.6 Third-Party Services

The Weave platform may integrate with, or provide links to, third-party products and services. Those third parties operate under their own privacy policies and terms, and Weave is not responsible for their privacy practices, security or content.

3.7 Geographic Scope

This Privacy Policy applies regardless of the country from which you access the Weave website or platform. Weave is established in the United Kingdom and processes personal information in accordance with applicable UK data protection legislation, and complies with applicable obligations in other jurisdictions where required.

3.8 Relationship with Other Legal Documents

This Privacy Policy should be read together with our Terms of Service (including our data processing provisions), Cookie Policy, Acceptable Use Policy (where applicable), and any additional privacy notices published by Weave.

3.9 Updates to Scope

As Weave introduces new products, features, integrations or services, the scope of this Privacy Policy may be updated to reflect changes in our processing activities.

4. Definitions

• Account means an account created by or on behalf of an individual or organisation to access and use the Services.
• Authorised User means an individual who has been granted permission by a Customer to access a Workspace or otherwise use the Services.
• Controller means the natural or legal person that determines the purposes and means of processing Personal Data.
• Cookies means small text files and similar technologies stored on a user's device, including pixels, local storage, SDKs and tracking technologies.
• Customer means any organisation, business, public authority or other legal entity that purchases, subscribes to or otherwise uses the Services.
• Customer Data means any information, including Personal Data, uploaded, imported, generated, stored, transmitted or otherwise processed by or on behalf of a Customer through the Services.
• Data Protection Law means the UK GDPR, the Data Protection Act 2018, PECR, the EU GDPR and any legislation that replaces, supplements or amends the above.
• Personal Data means any information relating to an identified or identifiable natural person.
• Processing means any operation performed on Personal Data, including collection, storage, use, disclosure, transmission and deletion.
• Processor means a person that processes Personal Data on behalf of a Controller.
• Services means the websites, software, applications, APIs, AI features, integrations, documentation, support services and other products provided by Weave.
• Subprocessor means a third-party service provider engaged by Weave to process Personal Data on behalf of Customers.
• User means any individual who accesses or interacts with the Services.
• Website means the websites owned or operated by Weave, including https://weavedata.co.uk.
• Workspace means an environment within the Services created for a Customer in which Customer Data, users, configurations, workflows and reports are managed.
• Weave, we, our, us means Weave Data Limited, a company registered in England and Wales.
• You, your means any individual who accesses, uses or otherwise interacts with the Services or whose Personal Data is processed under this Privacy Policy.
• Usage Data means information generated through use of the Services, including technical information, diagnostic information, telemetry, feature usage, navigation behaviour, event logs and performance metrics.

5. Our Role (Controller vs Processor)

5.1 Our Responsibilities

Depending on the circumstances in which Personal Data is processed, Weave acts either as a Data Controller or a Data Processor. Our role depends on the purpose of processing, who determines the purposes and means, the nature of the Services, and the contractual relationship involved.

5.2 When Weave Acts as a Data Controller

Weave acts as a Data Controller for Personal Data processed in connection with website visitors, prospective customers, sales enquiries, demonstrations and free trials, account registration, subscription and billing management, customer support, marketing, webinars, recruitment, security monitoring, fraud prevention, legal compliance, product analytics, operational telemetry and improving the Services.

5.3 When Weave Acts as a Data Processor

Where Customers upload, connect, store or otherwise process Personal Data using the Services, Weave generally acts as a Data Processor. The Customer determines the purpose and categories of Personal Data processed and who may access it; Weave processes Customer Data in accordance with documented instructions, contractual obligations and applicable law. Examples include imported business data, uploaded documents, connected databases, AI-assisted processing, dashboards, workflow automations and customer-configured integrations.

5.4 Customer Responsibilities

Where Weave acts as a Processor, the Customer remains responsible for determining the lawful basis for processing, providing appropriate privacy information, obtaining necessary consents, responding to data subject requests, ensuring lawful collection, configuring access and security settings, and managing retention periods.

5.5 Weave's Responsibilities as a Processor

Where Weave acts as a Processor, we process Customer Data per documented instructions, implement appropriate technical and organisational measures, bind personnel to confidentiality obligations, engage Subprocessors only with appropriate safeguards, assist Customers in meeting their obligations, notify Customers of Personal Data Breaches where required, and securely delete or return Customer Data following termination.

5.6 Operational Processing

Weave may process Personal Data for operational purposes including maintaining service availability, monitoring platform health, logging authentication events, detecting fraud and unauthorised access, maintaining backups, diagnosing defects, and complying with legal obligations.

5.7 Product Analytics and Service Improvement

Weave continually improves the Services through responsible use of operational analytics and product telemetry relating to feature usage, navigation behaviour, service performance, error reporting and product adoption. Where reasonably possible, this information is aggregated or pseudonymised.

5.8 AI Processing

Where Customers use AI-enabled functionality, prompts and inputs are processed only to provide the requested functionality, in accordance with the Customer's documented instructions. Unless expressly stated otherwise in writing, Customer Data is not intentionally used to train publicly available AI models.

5.9 Exercising Your Rights

Where Weave acts as a Controller, individuals may exercise their rights directly with us. Where Weave acts solely as a Processor, requests should ordinarily be directed to the relevant Customer.

5.10 Requests Relating to Customer Data

If Weave receives a request directly from an individual relating to Customer-controlled Personal Data, we may refer the individual to the relevant Customer, notify the Customer where legally permitted, and assist the Customer in responding where required.

6. Information We Collect

6.1 Overview

The information we collect depends on how you interact with Weave, the Services you use, the features you enable and the choices you make. We only collect Personal Data necessary to provide, secure, improve and support the Services, or where we have another lawful basis for processing.

6.2 Information You Provide Directly

You may provide Personal Data when you create an account, register for a free trial, request a demonstration, contact sales or support, subscribe to updates, complete forms, participate in webinars or surveys, submit feedback, upload Customer Data, configure integrations, or otherwise communicate with us. This may include your full name, business email address, telephone number, organisation, job title, postal address, account credentials, and any other information you choose to provide.

6.3 Account Information

When you create a Weave account we may collect user identifiers, username, email address, encrypted authentication credentials, MFA settings, account status, organisation and Workspace membership, roles and permissions, preferences, profile image, account creation date and activity.

6.4 Customer Data

Customers may choose to upload, connect, import or generate information within the Services, which may include Personal Data relating to employees, customers, suppliers, contractors, patients, members, students or donors, such as uploaded documents, spreadsheets, database records, API data, dashboards, AI prompts and outputs, and automation configurations.

6.5 Usage Data

We automatically collect operational and diagnostic information relating to your use of the platform, including pages viewed, features accessed, navigation paths, search activity, session duration, error events, performance metrics, authentication events and system diagnostics.

6.6 Device and Technical Information

We automatically collect technical information including IP address, browser type and version, operating system, device type and identifiers, language settings, timezone, screen resolution, referral URLs, approximate geographic location, and diagnostic logs, primarily used for security, fraud prevention and troubleshooting.

6.7 Cookies and Similar Technologies

We use Cookies and similar technologies to operate the Website and Services, remember preferences, analyse usage and measure the effectiveness of our communications and marketing. Further information is provided in our Cookie Policy.

6.8 Product Analytics

To improve the Services we collect information about how users interact with the Website and platform, including click activity, navigation behaviour, heatmaps, session replay data, feature adoption and usability metrics. Where required by law, analytics technologies are activated only after obtaining consent.

6.9 AI Interaction Data

Where you use AI-powered features we may process prompts, uploaded content, conversation history, generated responses, user feedback and operational telemetry. Unless explicitly stated otherwise, this content is not intentionally used to train publicly available AI models.

6.10 Communications

If you contact Weave we may retain records of emails, chat conversations, support tickets, telephone records, meeting notes and webinar attendance to respond to enquiries, improve support and comply with legal obligations.

6.11 Marketing Information

Where permitted by law, we may collect newsletter subscriptions, communication preferences, event registrations, campaign responses, advertising attribution and lead source information. You may update your preferences or unsubscribe at any time.

6.12 Information from Third Parties

Where permitted by law, Weave may receive account information, business contact information, identity information, or information received through authorised integrations from third parties.

6.13 Information We Do Not Intentionally Collect

Unless specifically required by the Services or instructed by a Customer, Weave does not intentionally collect special category Personal Data, criminal offence data, payment card information, government-issued identity documents, biometric or genetic information, or information relating to children under 16.

6.14 Accuracy of Information

We rely on information provided by users and Customers to be accurate and up to date. Users are responsible for keeping account information current, and Customers are responsible for the accuracy and lawfulness of Customer Data.

7. How We Collect Data

We collect Personal Data directly from you, through your use of the Services, from your organisation or Workspace administrator, from systems and services you authorise us to connect to, and automatically through the operation of the Website and Services. This includes information you provide directly, information provided by your organisation, Customer Data you upload, information collected automatically, product usage analytics, Cookies and similar technologies, Website analytics (including PostHog, Microsoft Clarity, Google Analytics 4 and Google Tag Manager), marketing and advertising technologies, identity providers and authentication services, authorised integrations, customer support communications, and publicly available business information used to verify organisational details or prevent fraud. As Weave introduces new products and services, we may collect Personal Data from additional compatible sources.

8. Legal Bases for Processing

8.1–8.2 Performance of a Contract

We process Personal Data where necessary to create and manage Accounts, authenticate users, provide access to the Services, process subscriptions, provide customer support and fulfil our contractual obligations under the Terms of Service.

8.3 Legitimate Interests

We process Personal Data where necessary for our legitimate interests, including operating and improving the Services, maintaining platform security, detecting fraud, developing new features, and managing our business operations, provided those interests are not overridden by your rights.

8.4 Compliance with Legal Obligations

We may process Personal Data where necessary to comply with applicable legislation, respond to lawful requests, comply with tax and accounting requirements, and enforce legal claims.

8.5 Consent

Where required by law, we process Personal Data on the basis of consent, including for non-essential Cookies, website analytics, marketing Cookies and electronic marketing communications. Consent may be withdrawn at any time.

8.6 Vital Interests

In exceptional circumstances, we may process Personal Data where necessary to protect the vital interests of an individual, such as to protect someone's life or prevent serious harm.

8.7 Public Task

Some Customers may use the Services to support the exercise of official authority or tasks carried out in the public interest; the relevant Customer is responsible for determining and documenting the appropriate lawful basis.

8.8 Processing on Behalf of Customers

Where Weave acts as a Data Processor, the Customer is responsible for determining the lawful basis upon which Personal Data is processed within their Workspace.

8.9 Special Category Personal Data

Weave does not intentionally require Customers to provide Special Category Personal Data. Where Customers choose to process such data, they remain responsible for identifying an appropriate lawful basis and any additional conditions required by law.

8.10 Changes to the Lawful Basis

If the purpose for processing changes materially, Weave will assess whether additional notices or consent are required before continuing the processing.

9. How We Use Your Information

We use Personal Data only where necessary to provide, operate, secure, improve and support the Services, comply with our legal obligations, fulfil our contractual commitments and operate our business, including to:

• provide the Services, including creating and administering Accounts, authenticating users and delivering requested functionality;
• operate and maintain the platform, including monitoring infrastructure, maintaining backups and supporting disaster recovery;
• maintain security and prevent fraud, including detecting suspicious activity and enforcing our Terms of Service;
• provide customer support and customer success services;
• perform product analytics and service improvement;
• deliver AI-enabled features requested by Customers;
• send product communications necessary to operate or secure your Account;
• send marketing communications where permitted by law;
• comply with legal and regulatory obligations;
• support general business operations, research and product development; and
• execute Customer-configured automated workflows.

Weave does not use automated processing to make decisions that produce legal effects or similarly significant effects on individuals on its own behalf.

10. Product Analytics and Behaviour Tracking

Weave uses product analytics and behavioural data to understand how the Website and Services are used, identify opportunities for improvement, maintain platform reliability and deliver a better experience. Depending on how you use the Website and Services, this may include pages viewed, navigation paths, feature usage, clicks, search activity, form completion, workflow progression, onboarding progress, session duration, browser and device information, and system diagnostics, along with behavioural events such as account creation, feature usage, integrations connected, files uploaded, workflows completed and errors encountered.

We use product analytics to improve usability, identify confusing user journeys, measure feature adoption, prioritise future development, detect software defects, and improve customer success activities — used to improve the Services as a whole rather than to monitor individual employee performance.

Weave may use session replay and heatmap technologies, including Microsoft Clarity, to better understand how users interact with the Website and certain areas of the Services; sensitive fields are masked or excluded where supported by the underlying technology. Where reasonably possible, analytics information is aggregated or pseudonymised. Marketing analytics (referral sources, campaigns, UTM parameters and conversion events) are distinct from product analytics.

Weave does not use behavioural analytics to make automated decisions that produce legal or similarly significant effects on individuals. Where behavioural analytics rely on non-essential Cookies, you may manage your consent preferences through our Cookie preferences centre.

11. AI & Machine Learning

The Services include AI and machine learning capabilities designed to help Customers analyse information, generate content, automate tasks and improve productivity. These features are optional, and Customers remain responsible for determining whether AI-generated outputs are appropriate for their intended use.

Depending on the Services enabled, AI may be used to analyse information, answer questions about Customer Data, generate summaries, assist with workflow automation, identify trends, and support search and documentation. When a Customer uses AI-enabled functionality, Weave may process prompts, Customer Data selected for analysis, uploaded documents, conversation history, AI-generated outputs, and operational telemetry — only the information necessary to fulfil the requested task is processed.

Customers decide whether to use AI-enabled functionality and control which users have access, which information is submitted, and how AI outputs are used within their organisation. To provide AI functionality, Weave may use AI models and infrastructure provided by trusted third-party service providers, subject to our vendor assessment processes.

Unless expressly stated otherwise in writing or agreed with the relevant Customer: Customer Data submitted through the Services is not intentionally used by Weave to train publicly available AI models; Weave does not sell Customer prompts, uploaded content or Customer Data for AI training purposes; and Weave does not intentionally permit third-party AI providers to use Customer Data to train publicly available AI models on Weave's behalf.

AI-generated outputs may occasionally be inaccurate, incomplete, outdated or unsuitable for a particular purpose. Customers and Authorised Users remain responsible for reviewing, validating and verifying AI-generated outputs before relying on them for legal, financial, regulatory, healthcare, employment or other important business decisions. Weave designs AI-enabled features to support human decision-making rather than replace it, and does not use AI to make decisions on its own behalf that produce legal or similarly significant effects without appropriate human involvement.

AI-enabled processing is subject to the same security controls that apply to the rest of the Services, including access controls, encryption, monitoring and logging where appropriate. As Weave introduces new AI functionality, this Privacy Policy may be updated to reflect changes in how Personal Data is processed.

12. Automations & Product Adoption

Weave includes automation capabilities designed to improve the user experience, support product adoption and enable Customers to automate business processes. Some automations are operated by Weave to help users successfully adopt and use the platform — for example, reminding users to complete onboarding or highlighting unconfigured features. Other automations, such as customer-configured workflows that process Customer Data, trigger notifications or update connected systems, are created and controlled by Customers within their own Workspaces.

Where permitted by applicable law, Weave may also use information about how the Services are used to personalise aspects of the user experience, such as highlighting relevant features or tailoring in-application messaging. Product adoption information may be used by our Customer Success team to better support Customers, generally focusing on Workspace-level trends rather than individual employee behaviour.

Weave does not use these automations to make decisions on its own behalf that produce legal or similarly significant effects on individuals. Customers remain responsible for any automated business processes they configure within their own Workspaces and for ensuring compliance with applicable legal and regulatory requirements.

13. Cookies & Similar Technologies

Weave uses Cookies and similar technologies to operate the Website and Services, improve functionality, understand usage, measure the effectiveness of our communications and maintain security. Some Cookies are essential for the operation of the Website and Services, while others help us understand product usage and measure marketing effectiveness. Where required by applicable law, non-essential Cookies are only used with your consent.

We use the following categories of Cookies:

• Strictly Necessary Cookies – required for authentication, security and core functionality; cannot ordinarily be disabled.
• Analytics Cookies – help us understand how visitors use the Website and how Customers interact with the Services; activated only after consent where required by law.
• Functional Cookies – remember user choices such as language and accessibility preferences.
• Advertising and Marketing Cookies – help us understand how visitors discover our Website and measure marketing effectiveness; used only with consent where required.

We currently use Cookies and similar technologies associated with Microsoft Clarity, Google Analytics 4, Google Tag Manager, Google Ads, and services necessary to authenticate users and operate the platform securely. An up-to-date list of Cookies, including purpose, duration and provider, is maintained in our separate Cookie Policy.

Where required by applicable law, you will be presented with a Cookie preference banner when you first visit the Website, allowing you to accept, reject or customise non-essential Cookies and withdraw consent at any time. Most browsers also allow you to control Cookies through browser settings, though blocking some Cookies may affect functionality.

14. Third-Party Services

Weave uses carefully selected third-party service providers to help us operate, secure, maintain and improve the Website and Services, including for cloud infrastructure and hosting, identity and authentication, analytics, artificial intelligence, communications, customer support, monitoring, security, marketing, payment processing and backup and disaster recovery.

At the time this Privacy Policy was last updated, Weave uses third-party services including, where applicable, Microsoft Azure (cloud infrastructure and hosting), PostHog (product analytics, error tracking and performance monitoring), Microsoft Clarity (behavioural analytics), Google Analytics 4 (Website analytics), Google Tag Manager (tag deployment), Google Ads (advertising attribution), and Microsoft 365 (business communications and collaboration). Additional providers may be introduced as the Services evolve.

Before engaging a third-party service provider, Weave undertakes appropriate due diligence considering information security practices, privacy controls, contractual commitments, regulatory compliance and data residency. Where a third party processes Personal Data on our behalf, appropriate contractual arrangements are implemented to ensure it is processed only for authorised purposes and in compliance with applicable Data Protection Law.

Some third-party organisations connected with the Services, such as advertising platforms, identity providers selected by Customers, and Customer-configured integrations, may act as independent Data Controllers governed by their own privacy notices. Weave is not responsible for the privacy practices of third-party services selected and configured solely by Customers.

15. Data Sharing

We treat Personal Data as confidential and only disclose it where necessary to provide the Services, fulfil our contractual obligations, comply with applicable law or operate our business. We do not sell Personal Data to third parties.

Personal Data may be shared: within Weave, among authorised employees and contractors who need access for legitimate business purposes; with trusted service providers that support the operation of the Website and Services; with Customers and Authorised Users, in accordance with the permissions configured by that Customer within their Workspace; through Customer-configured integrations, in accordance with the Customer's own configuration and responsibility; where necessary to comply with applicable law, court orders or regulatory requirements, or to protect the rights, property or safety of Weave, our Customers or others; as part of a corporate transaction such as a merger, acquisition or sale of assets, subject to the successor continuing to protect Personal Data; with our professional advisers, such as legal, accounting and audit firms; and with business partners such as implementation partners or resellers, where necessary and subject to appropriate safeguards.

We may also use or disclose aggregated, anonymised or statistical information that does not identify an individual, for purposes such as service improvement, research and benchmarking.

16. International Transfers

Weave is established in the United Kingdom and seeks, where reasonably practicable, to host and process Personal Data within the United Kingdom or jurisdictions providing an appropriate level of protection. However, because we use trusted third-party service providers and cloud infrastructure, Personal Data may occasionally be processed or accessed from countries outside the United Kingdom — for example, where a Customer authorises an integration located overseas, or where a third-party provider processes Personal Data outside the UK.

Where Personal Data is transferred outside the United Kingdom and an adequacy decision does not apply, Weave implements appropriate safeguards as required by applicable Data Protection Law, which may include the UK International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission's Standard Contractual Clauses (SCCs), transfers to countries recognised as providing an adequate level of protection, or another lawful transfer mechanism. Additional technical measures, such as encryption in transit and at rest, logical separation of Customer Workspaces and access controls based on least privilege, may also be applied.

17. Security

Protecting Personal Data and Customer Data is fundamental to the design, development and operation of the Services. Weave implements and maintains technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.

Depending on the nature of the Services, technical measures may include encryption of data in transit and at rest, logical separation of Customer Workspaces, role-based access controls, multi-factor authentication for administrative access, network security controls, monitoring and alerting, audit logging, vulnerability management and backup and recovery capabilities. Organisational measures include confidentiality obligations for personnel, security awareness training, controlled access to systems, change management processes and incident management procedures.

We maintain procedures for identifying, investigating, managing and responding to security incidents. Where a Personal Data Breach occurs, we will assess the incident and, where required, notify affected Customers without undue delay, report the incident to the relevant supervisory authority, and take appropriate steps to contain, investigate and remediate the issue.

Security is a shared responsibility — Customers are responsible for maintaining the confidentiality of Account credentials, configuring appropriate user permissions, enabling available security features, and reporting suspected security issues promptly. No system can guarantee absolute security, and we continually review and improve our security controls.

18. Data Retention

Weave retains Personal Data only for as long as necessary to fulfil the purposes described in this Privacy Policy, comply with applicable legal and regulatory obligations, resolve disputes, enforce our contractual rights and operate the Services. When Personal Data is no longer required, we take reasonable steps to securely delete, anonymise or otherwise dispose of it.

Account information is generally retained for as long as an Account remains active and for a reasonable period afterwards where necessary for legal or business purposes. Where Weave acts as a Data Processor, the Customer determines how long Customer Data should be retained within the Services, and Customer Data will be deleted or returned following termination in accordance with the Terms of Service, unless Weave is required by law to retain it. Backup copies, operational security logs and communications records may be retained for a limited additional period for resilience, security or dispute-resolution purposes. Marketing information is retained only for as long as necessary or until you withdraw consent. In some circumstances Weave may be required to retain Personal Data for longer to comply with legal or regulatory obligations.

19. Your Rights

Applicable Data Protection Law provides individuals with a number of rights regarding their Personal Data. Where Weave acts as the Data Controller, you may exercise these rights by contacting us using the details in Section 23 – Contact Us. Where Weave acts solely as a Data Processor, requests relating to Customer Data should generally be directed to the relevant Customer.

• Right of Access – confirmation of whether we process your Personal Data, and access to it.
• Right to Rectification – correction of inaccurate, incomplete or out-of-date Personal Data.
• Right to Erasure – deletion of your Personal Data in certain circumstances, subject to legal and contractual exceptions.
• Right to Restrict Processing – restriction of processing in certain circumstances, such as while accuracy is contested.
• Right to Data Portability – a copy of Personal Data you provided, in a structured, machine-readable format, where applicable.
• Right to Object – objection to processing based on legitimate interests, and to processing for direct marketing purposes.
• Right to Withdraw Consent – withdrawal of consent at any time, without affecting the lawfulness of prior processing.
• Rights Relating to Automated Decision-Making – Weave does not use Personal Data to make decisions on its own behalf that produce legal or similarly significant effects solely by automated means.

To help protect Personal Data, we may ask you to verify your identity before responding to a request, and will respond within the timescales required by applicable Data Protection Law. If you believe Weave has processed your Personal Data in a manner that does not comply with applicable law, we encourage you to contact us first; you also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk.

20. Marketing

Certain communications, such as account verification, security alerts, maintenance notifications and billing information, are essential for the operation of the Services and cannot generally be opted out of while you continue to use the Services.

Where permitted by applicable law, Weave may also send marketing communications relating to new products and features, newsletters, webinars, events and customer stories. Marketing communications are sent only where permitted under applicable Data Protection Law and the Privacy and Electronic Communications Regulations 2003 (PECR).

You may opt out of marketing communications at any time using the unsubscribe link included in our emails, by updating your communication preferences, or by contacting us. If you opt out, Weave may retain limited information necessary to maintain suppression lists and honour your preference. Weave does not sell Personal Data to third parties for their own direct marketing purposes.

21. Children's Privacy

The Services are designed for use by businesses, public sector organisations, charities and other organisations, and are intended for use by adults acting in a professional capacity. The Website and Services are not directed at children, and Weave does not knowingly collect Personal Data directly from children under the age of 16 or design the Services for use by individuals under that age.

Some Customers, such as educational institutions, charities or healthcare providers, may choose to process Personal Data relating to children within their own Workspaces as part of their legitimate business activities; in these circumstances the relevant Customer acts as the Data Controller and is responsible for the applicable lawful basis and required privacy information. If you believe a child has provided Personal Data directly to Weave, please contact us using the details in Section 23 – Contact Us.

22. Changes to this Policy

Weave may update this Privacy Policy from time to time to reflect changes to the Services, our processing activities, applicable laws, security practices or third-party service providers. Where we make material changes that significantly affect how Personal Data is processed or the rights available to individuals, we will take reasonable steps to notify affected users through a notice on our Website, an in-application notification, or email communication.

The version number and Effective Date displayed at the beginning of this Privacy Policy indicate when the current version became effective. Your continued access to or use of the Services after this Privacy Policy has been updated indicates that you have been provided with the revised Privacy Policy; where applicable law requires your separate consent for a particular processing activity, we will obtain that consent separately.

23. Contact Us

If you have any questions about this Privacy Policy, how Weave processes Personal Data, or wish to exercise any of your rights under applicable Data Protection Law, please contact us.

Weave Data Limited
Registered in England and Wales
Website: https://weavedata.co.uk
Privacy Email: [email protected]
Registered Office: Thornfield House, Sandtoft Road, Belton, Doncaster, DN9 1PH

We aim to respond to all genuine privacy enquiries as promptly as reasonably practicable and within any timeframes required by applicable Data Protection Law.

If your Personal Data is processed by Weave on behalf of one of our Customers, that Customer is generally responsible for responding to requests relating to your Personal Data, and you should normally contact the organisation that collected your information.

If you believe your Personal Data has been processed incorrectly, your Account has been compromised, or you have identified a security vulnerability affecting the Services, please contact us as soon as reasonably practicable. We encourage responsible disclosure of any suspected security vulnerabilities.

For individuals in the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO), https://ico.org.uk. If you are located in another jurisdiction, you may also have the right to contact the supervisory authority responsible for data protection in your country or region.

Schedules

Schedule 1 – Categories of Personal Data

The categories of Personal Data processed by Weave depend on the Services used, the features enabled and the relationship between Weave and the individual concerned, and may include: identity information (name, username, organisation, job title); contact information (business email, telephone, postal address); account and authentication information (user ID, roles, permissions, login history, MFA status); Customer Data uploaded or processed within the Services; usage data (feature usage, navigation, workflow progression); technical information (browser, IP address, device identifiers); communications (emails, support tickets, webinar attendance); marketing information (preferences, campaign responses); analytics information (product adoption metrics, behavioural analytics); AI interaction data (prompts, conversation history, AI outputs); security information (audit logs, authentication and security events); and financial information (subscription records, invoices, billing contacts, excluding payment card details processed by third-party payment providers).

Schedule 2 – Lawful Basis Matrix

Weave typically relies on Performance of a Contract for account registration, user authentication, Workspace administration, AI functionality and service communications; Legitimate Interests for website administration, product and behaviour analytics, product adoption, security monitoring, fraud prevention, backup and disaster recovery, and product improvement; Consent for marketing communications and Cookie preferences (where required by law); and Legal Obligation for compliance with legal requirements and responding to lawful requests. Where Weave acts as a Data Processor, the relevant Customer is responsible for determining the lawful basis applicable to Customer-controlled processing activities.

Schedule 3 – Third-Party Service Providers (Subprocessors)

At the time of publication, Weave's primary subprocessors include Microsoft Azure (cloud hosting and infrastructure), PostHog (product analytics, error tracking and performance monitoring), Microsoft Clarity (behaviour analytics), Google Analytics 4 (website analytics), Google Tag Manager (tag deployment), Google Ads (advertising attribution) and Microsoft 365 (business communications). Additional providers may be introduced as the Services evolve; an up-to-date list of subprocessors may be published separately from this Privacy Policy.

Schedule 4 – Cookie Categories

Strictly Necessary Cookies (authentication, security, session management) do not require consent. Functional Cookies (remembering preferences) may require consent depending on applicable law. Analytics Cookies and Behaviour Analytics Cookies (heatmaps, session replay) require consent where required by law. Advertising and Marketing Cookies (campaign attribution, conversion tracking) require consent. A complete list of the Cookies currently used by Weave, including provider, purpose and retention period, is maintained in the separate Cookie Policy.