1. Who We Are

Opzing Ltd. ("Opzing", "we", "our", or "us") provides Workflow Governance software designed to help Marketing Operations teams better understand and manage their HubSpot automation.

We are committed to protecting your privacy and ensuring that your personal data is handled in a safe, transparent and responsible manner.

 

OpZing Ltd is a company registered in England and Wales under company number 16160036.

​

For questions about this Privacy Policy, to exercise your data-protection rights, or to make a data-protection complaint, contact:

Email: info@opzing.co

​

When Opzing determines why and how personal data is used, OpZing Ltd acts as the data controller.

​

In some circumstances, particularly where a customer connects its HubSpot portal to Opzing, we process certain information on that customer's behalf. In those circumstances, the customer generally acts as the controller and Opzing acts as its processor.

​

2. Scope of this Privacy Policy

This Privacy Policy explains how we collect and use personal data when you:

• visit the Opzing website;

• apply for or participate in an Opzing beta programme;

• create or use an Opzing account;

• connect a HubSpot portal to Opzing;

• contact us for support, sales, feedback or another business purpose;

• receive communications from us; or

• otherwise interact with Opzing
   

It also explains how we process information obtained through connected services such as Google and HubSpot.

Our Cookie Policy provides additional information about cookies, analytics and browser-storage technologies.

​

3. Our role as controller and processor

The role Opzing plays depends on the context.

​

When Opzing is the controller

We generally act as controller for personal data relating to:

• website visitors;

• prospects and business contacts;

• people who contact us;

• Opzing account users;

• customer administrators;

• authentication and account-security information;

• support and feedback communications;

• website analytics;

• our own business administration and records; and

• security, audit and operational information generated by the Opzing service.
   

In these circumstances, Opzing determines the purposes for which the information is used.

​

When Opzing is a processor

When a customer connects its HubSpot portal, Opzing retrieves and processes supported HubSpot configuration and workflow information in order to provide the Opzing service.

​

To the extent that this information contains personal data for which the customer determines the purpose of processing, the customer is normally the controller and Opzing processes that information on the customer's behalf.

​

If you are an individual whose personal data appears in a customer's connected HubSpot environment, your primary relationship is normally with that customer. Requests concerning that information should generally be directed to the relevant customer, although we will assist customers with their data-protection obligations where appropriate.

​

4. Personal data we collect

The information we collect depends on how you interact with Opzing.

​

Account and identity information

When you sign in to Opzing using Google, we may receive information required to authenticate you and associate you with your Opzing account.

This can include your:

• name;

• email address;

• Google account identifier;

• Opzing account membership;

• organisation or customer account;

• application role; and

• account approval or access status.
   

Opzing currently uses Google authentication and does not maintain a separate Opzing password for users.

​

Customer and business information

We may process information such as:

• your name and business contact details;

• company or organisation;

• job title or professional role;

• customer-account information;

• HubSpot portal identifiers;

• commercial relationship with Opzing;

• beta participation;

• support history;

• feedback; and

• communications with us.
   

Information from connected HubSpot portals

When an authorised customer connects a HubSpot portal, Opzing retrieves supported information required to provide its workflow-governance functionality.

​

This includes workflow, property and related configuration metadata and information used to analyse relationships, dependencies, issues and governance conditions.

​

Depending on how a customer's HubSpot environment has been configured, this metadata may itself contain personal data, such as user names, email addresses, identifiers or information included by the customer in workflow or property configuration.

​

Opzing is not designed to import a customer's entire HubSpot CRM database simply for the purpose of providing workflow governance.

The precise categories of HubSpot information processed may evolve as Opzing's supported analysis functionality develops.

​

Integration and authentication information

We process technical information required to maintain connected services, including:

• OAuth connection information;

• HubSpot access and refresh tokens;

• connection status;

• portal identifiers;

• authentication sessions; and

• related security information.
   

HubSpot OAuth credentials are encrypted before they are stored.

​

Website and device information

When you use our website, we may receive information such as:

• IP address;

• browser or device information;

• pages visited;

• referring information;

• website interactions;

• analytics identifiers; and

• cookie or browser-storage information.
   

The use of non-essential analytics technologies is governed by the choices available through our cookie-consent controls.

Please see our Cookie Policy for more information.

​

Support, feedback and communications

If you contact us, we may process the information you provide, including:

• your contact details;

• the content of your message;

• support or product-feedback information;

• relevant account or portal context; and

• information required to investigate and respond to your request.
   

Please avoid sending passwords, OAuth tokens or other credentials through normal support communications.

​

5. Where we obtain personal data

We may obtain personal data:

• directly from you;

• from your employer or organisation;

• from another authorised user of your Opzing customer account;

• from Google when you authenticate;

• from a HubSpot portal that an authorised customer connects;

• from website and analytics technologies;

• from our communications with you; and

• from publicly available professional or business sources where we conduct appropriate B2B outreach.
   

We do not buy consumer data for unrelated advertising purposes.

​

6. How we use personal data and our lawful bases

We only process personal data where we have an appropriate legal basis.

​

​

​

​

​

​

​

​

​

​​​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​​​​​​​​​​​​​​​​​​​

Where we rely on legitimate interests, those interests can include operating and improving Opzing, protecting the platform, communicating with business users and prospects, understanding how our service is used, preventing misuse and developing our business.

​

We consider the impact of this processing on individuals and do not rely on legitimate interests where your rights and interests override ours.

​

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

​

7. Information required to use Opzing

You are not generally required by law to provide personal data to Opzing.

​

However, certain information is necessary for us to provide particular services.

​

For example, we need sufficient identity and authentication information to create and secure an Opzing user account.

A customer that chooses to connect HubSpot must also provide the OAuth authorisation and technical information necessary to establish that connection.

​

If required information is not provided, some Opzing functionality may not be available.

​

8. Google authentication

Opzing uses Google OpenID Connect to authenticate current users.

​

Google confirms your identity to Opzing. Opzing then independently determines whether that identity is authorised to use the application and which Opzing account, role and customer resources the user may access.

​

Authentication by Google does not by itself provide access to an Opzing customer account.

​

Opzing maintains its own application session after successful authentication.

​

9. HubSpot integration

Customers may authorise Opzing to connect to a HubSpot portal using HubSpot OAuth.

​

The current Opzing product is designed as a read-only HubSpot governance service.

​

Within the current product scope, Opzing retrieves supported HubSpot information for analysis but does not create, modify or delete customer workflows or CRM records through the integration.

​

HubSpot remains the source system.

​

Opzing stores an imported and analysed copy of supported metadata necessary to provide governance features.

HubSpot access and refresh tokens are encrypted before being stored by Opzing.

​

Customers are responsible for ensuring that they are authorised to connect a HubSpot portal and instruct Opzing to process information from that portal.

10. Website analytics and cookies

Our marketing website uses technologies including Wix, Google Analytics, Google Tag Manager and HubSpot website analytics.

​

Non-essential technologies are managed through our cookie-consent controls where consent is required.

​

Our application currently uses first-party authentication and functional browser technologies necessary to provide the service and remember relevant user choices.

​

For detailed information about these technologies, their purposes and how to change your preferences, please see our Cookie Policy.

​

11. Who we share personal data with

We may share or make personal data available to service providers that help us operate Opzing.

​

These currently include providers supporting:

• application hosting, including Render;

• database hosting and backup, including MongoDB Atlas;

• authentication and business productivity services, including Google;

• HubSpot integration, CRM and website analytics;

• website hosting and consent management, including Wix;

• email and business communications;

• accounting and financial administration, where applicable; and

• professional, legal, security or technical services where necessary.
   

These providers may act as processors, independent controllers or both depending on the particular service.

​

We may also disclose information where necessary to:

• comply with law or a valid legal request;

• protect Opzing, our customers or others;

• investigate suspected misuse or security incidents;

• enforce our agreements; or

• establish, exercise or defend legal claims.
   

We do not sell personal data.

We do not provide connected customer HubSpot data to third parties for unrelated advertising purposes.

​

12. International data transfers

Opzing uses service providers in more than one country.

​

Our current production database is hosted in the United Kingdom, and parts of the Opzing application infrastructure operate in the European Economic Area.

​

Some third-party providers may also process or access information from other jurisdictions as part of providing their services.

​

Where UK data-protection law treats a transfer as a restricted international transfer, we take steps to ensure an appropriate legal transfer mechanism applies.

​

Depending on the circumstances, this may include reliance on UK adequacy regulations, contractual safeguards or other mechanisms recognised under applicable UK data-protection law.

​

You may contact us if you would like further information about the safeguards applicable to a particular transfer.

​

13. How long we keep personal data

We do not keep personal data indefinitely simply because we have collected it.

​

The appropriate retention period depends on the type of information and why it is being processed.

​

We consider factors including:

• the duration of the customer or user relationship;

• whether an account or portal remains active;

• whether the information is required to provide the service;

• security, fraud-prevention and audit requirements;

• support and dispute history;

• legal, accounting and regulatory obligations;

• whether an individual has objected to marketing;

• the sensitivity and volume of the information; and

• the operation of managed database backups and recovery systems.
   

When information is no longer reasonably required, we aim to delete, anonymise or otherwise remove it from active use, subject to legal obligations and technical backup cycles.

​

Information contained in managed backups may remain until the relevant backup expires or is overwritten in accordance with the applicable backup lifecycle.

​

We periodically review our retention practices and may adopt more specific category-based periods as the service develops.

​

14. How we protect personal data

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

​

Current controls include:

• encrypted HTTPS connections;

• encrypted storage of HubSpot OAuth credentials;

• secure application-session controls;

• role-based and account-based access controls;

• restricted administrative access;

• separation between production and non-production environments;

• restricted production-database network access;

• least-privilege database credentials;

• database backup and point-in-time recovery;

• protected source-code change controls; and

• security-conscious logging designed to avoid exposing credentials and authentication secrets.
   

Access to customer information is limited according to operational need and application permissions.

​

No internet-based service can guarantee absolute security, but we continually seek to maintain controls appropriate to the nature of the information we process.

​

If we become aware of a personal-data breach, we will investigate it and make any notifications required under applicable law.

​

15. Automated analysis and decision-making

Opzing automatically analyses supported HubSpot configuration and workflow metadata in order to generate governance information, observations, priorities and other product findings.

​

These outputs are intended to support human users in understanding and managing their HubSpot environment.

​

Opzing does not currently make solely automated decisions about individuals that produce legal effects or similarly significant effects on them.

​

Users remain responsible for decisions and actions they choose to take in HubSpot based on the information Opzing presents.

​

16. Marketing communications

We may contact existing or prospective business users with information about Opzing where permitted by applicable law.

Where consent is required, we will obtain it.

​

Where permitted, we may rely on our legitimate interests in promoting a relevant B2B service to professional contacts.

​

You can unsubscribe from marketing communications at any time or tell us that you object to the use of your personal data for direct marketing.

​

Transactional, account-security and service-related communications may still be sent where necessary to provide or protect the service.

​

17. Your data-protection rights

Depending on the circumstances and the lawful basis involved, UK data-protection law may give you rights including:

• the right to request access to your personal data;

• the right to request correction of inaccurate data;

• the right to request erasure;

• the right to request restriction of processing;

• the right to data portability;

• the right to withdraw consent where processing relies on consent; and

• rights relating to certain automated decision-making.

• Some rights are subject to conditions or exemptions.
   

If Opzing is processing information solely on behalf of one of our customers, we may need to refer your request to that customer or assist them in responding to it.

​

To exercise a right, contact us at info@opzing.co.

​

We may need to verify your identity before acting on a request.

​

Your right to object

You have the right to object to processing based on legitimate interests in certain circumstances.

​

You also have the right to object at any time to the use of your personal data for direct marketing.

​

If you object to direct marketing, we will stop using your personal data for that purpose.

​

18. Data-protection complaints

If you are concerned about how Opzing has handled your personal data, you can raise a data-protection complaint with us by emailing:

info@opzing.co

​

Please include enough information for us to understand the issue and investigate it.

​

We will acknowledge receipt of a data-protection complaint within 30 days, investigate the matter appropriately and without undue delay, keep you informed where appropriate, and communicate the outcome of our investigation.

​

Making a complaint does not affect any other rights you may have.

​

19. Complaining to the Information Commissioner's Office

You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.

​

You can find information about making a complaint through the ICO's official website.

​

You do not have to contact Opzing before exercising your right to complain to the ICO, although we would welcome the opportunity to investigate and resolve any concern.

​

20. Children

Opzing is a business-to-business service and is not designed or intended for use by children.

​

We do not knowingly offer Opzing accounts to children.

​

If we become aware that we have collected personal data from a child in circumstances where we should not have done so, we will take appropriate steps to address it.

​

21. Special-category information

We do not intentionally request special-category personal data or criminal-offence information through ordinary website enquiries or Opzing account registration.

​

A customer's HubSpot configuration may contain information chosen or configured by that customer.

​

Customers are responsible for ensuring that the personal data they instruct Opzing to process is collected and used lawfully and that they have an appropriate basis for using any sensitive information contained within their systems.

​

22. Changes to this Privacy Policy

We may update this Privacy Policy as Opzing's services, technology, providers or legal obligations change.

​

Where a change materially affects how we use personal data, we will take reasonable steps to bring the change to the attention of affected users where required.

​

The date at the top of this policy shows when it was last updated.

​

23. Contact us

For privacy questions, rights requests or data-protection complaints, contact:

OpZing Ltd
Company number: 16160036
Email: info@opzing.co