This page explains how we approach the EU/UK General Data Protection Regulation for our marketing site and product. It is operational guidance, not a certified GDPR audit, legal opinion, or Data Protection Officer attestation. Edit it in Admin → Pages.

Roles

For marketing-site inquiries, job applications, and Sigmaviu accounts, we act as a controller. For personal data your organisation stores in the workspace (employees, clients, vendors, project records), your organisation is the controller and Sigmaviu is the processor.

Lawful bases we rely on

• Contract — creating and running your account and paid subscription
• Legitimate interests — securing the service, answering sales inquiries, considering job applications
• Consent — where we ask for it (for example optional marketing email, if enabled)
• Legal obligation — tax, accounting, and responding to lawful requests

Your rights

Depending on your location you may request access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent. You may also complain to a supervisory authority. Send requests through the contact form (choose privacy) and include enough detail for us to locate your data.

International transfers

We host on major cloud regions and use subprocessors that may process data outside your country. Where required, we use appropriate transfer tools (for example standard contractual clauses) with those providers.

Processors and DPA

A data processing addendum for customer-controller / Sigmaviu-processor relationships is available on request for paying customers via Contact (DPA). Submitting that form is not a signed DPA, and this page is not that contract.

See also the privacy notice, cookie notice, and trust center.

Last updated: 11 September 2026.