Privacy policy

Who we are

This website is run by SA12 Technology & Solutions Ltd ("SA12", "we", "us"), registered in England and Wales, company number 17195905. Our registered office is Unit 14, SA12 Business Centre, Seaway Parade, Baglan Energy Park, Port Talbot, SA12 7BR. We make atlasHR, WfMHub, atlasDrive, atlasStock and atlasConnect.

We are the controller of the personal information described here. For anything about this policy or your information, email info@sa12.co.uk, call 0330 133 0716 or write to us at the address above.

What this policy covers

This policy covers sa12.co.uk, including our events and insights pages, and the enquiries, demo requests, event bookings, emails and calls that come through it.

It doesn't cover the information your organisation keeps inside atlasHR, WfMHub, atlasDrive, atlasStock or atlasConnect, such as staff records, rotas or documents. We handle that on your organisation's behalf, under our agreement with it, and your organisation decides how it's used. If you're an employee of one of our customers, ask your employer how they use your information.

What we collect

When you visit the website

Our analytics script sends the following to our own servers:

• the pages you view, how long you stay, how far you scroll and where you click;
• how you arrived, such as the website that linked to us or the campaign tags in the link;
• your device type, operating system, browser, screen size, language and time zone;
• which form fields were filled in or left empty, never what was typed in them;
• page speed measurements and any errors the page hit;
• your IP address, from which we work out an approximate location (country, region and city) and the organisation the address belongs to.

Session replays. For most visits we also record a replay of the page: how it was scrolled, where the pointer moved and what was clicked, so we can see where the site is confusing or broken. Everything typed into a form is masked in your browser before it's sent, so replays never contain what you typed.

Which organisations visit. We look up who an IP address is registered to. We use the public registers of internet address holders (such as RIPE NCC, which see the address we ask about), a free IP database kept on our own server, and the address's public DNS name. If you visit from an office network, this can tell us your employer's name. From home or a mobile network it usually shows only your internet provider. Our sales team may be told when an organisation we already work with, or one that looks very interested, visits the site.

Cookies and local storage

We don't set cookies on this website. Our analytics keeps two random identifiers in your browser's local storage:

Name	What it does	How long
sa12_vid	A random ID that recognises this browser on a later visit	Until you clear it or opt out
sa12_ses	Groups the pages of one visit together	Starts again after 30 minutes of inactivity
sa12_optout	Remembers that you switched analytics off	Until you clear it or switch analytics back on

Our "I'm not a robot" check on forms doesn't use cookies or a third-party service.

Our main website pages use fonts stored on our own servers. Our Insights and Events pages still load their fonts from Google Fonts: to deliver them, Google receives your IP address and browser details. Google Fonts doesn't set cookies.

When you book a demo

We collect what you enter: your name, work email, phone number, company, job title, number of employees, country, the products and areas you'd like to see, and any message. We also store the IP address and browser details the request came from, to spot spam and abuse.

We use these details only to arrange and follow up your demo. Your request goes into our customer relationship management (CRM) system, and our team is emailed a copy. If our analytics was on in your browser, we link your request to your earlier visits on this site. That shows us which pages you looked at, so the demo covers what matters to you.

When you book an event

We collect the details on the booking form, and the IP address and browser details the booking came from. We use them to manage your place, send your confirmation and follow up afterwards.

When you email or call us

We keep our correspondence with you, and notes of calls and meetings, in our CRM and mailboxes. Some of the emails we send report back whether they were opened and which links were clicked.

Keeping the site secure

Our servers keep short-term technical logs of requests. To stop repeated form submissions, our spam protection keeps a hashed copy of your IP address, which expires after an hour.

How we use it, and our lawful basis

UK data protection law requires a lawful basis for each use of personal information. Ours are:

What we do	Lawful basis
Understand how the website is used and improve it (analytics, heatmaps and replays)	Our legitimate interest in running a useful website
Find out which organisations are interested in us, and alert our team	Our legitimate interest in finding and serving business customers
Arrange and follow up demos and enquiries you ask for	Steps you've asked us to take before a contract, and our legitimate interest in replying to you
Manage event bookings	Our agreement with you to provide your place
Send you news about our products, if you've asked to hear from us or you're a customer	Your consent, or our legitimate interest in keeping customers informed, within the rules on electronic marketing. Every marketing email has an unsubscribe link.
Keep the website and forms secure and free of spam	Our legitimate interest in protecting our systems and visitors
Keep records if you become a customer	Our contract with your organisation, and our legal duty to keep accounting records

Where we rely on legitimate interests, we've weighed them against your rights, and you can object at any time (see your rights). Our CRM scores how engaged a visitor or contact is, to help our team decide who to follow up first. It never makes decisions that have legal or similarly significant effects on you.

Your choices

• Switch analytics off. Use this switch, or the Analytics link at the bottom of any page: Analytics. It stops analytics and replays in this browser and deletes its identifiers. Select it again to switch analytics back on.
• Global Privacy Control and Do Not Track are honoured automatically. If your browser sends either, our analytics doesn't run.
• Clear your browser's site data for sa12.co.uk to remove the identifiers at any time.
• Unsubscribe from marketing emails using the link in any of them, or by emailing info@sa12.co.uk. We keep your address on a suppression list so we don't email you again.

Who we share it with

We don't sell personal information or share it with advertisers. We use these service providers, who act on our instructions and only receive what they need:

• IONOS hosts our website and CRM on servers in the UK.
• Postmark (ActiveCampaign) delivers the emails our website and CRM send.
• Microsoft 365 runs our email and calendars.
• Anthropic and OpenAI provide AI tools that help our team draft emails, summarise conversations and find information in our CRM. Under their business terms, they don't use our data to train their models.
• Google Fonts delivers the fonts on our Insights and Events pages.
• Internet address registries, such as RIPE NCC, answer our lookups of who an IP address belongs to.

We may also share information if the law requires it, or to protect our rights or the safety of others.

International transfers

Some of these providers, including Postmark, Microsoft, Google, Anthropic and OpenAI, may process information in the USA or elsewhere outside the UK. When they do, we rely on a safeguard recognised by UK law, such as the UK-US Data Bridge or the International Data Transfer Addendum to the EU standard contractual clauses.

How long we keep it

Information	How long
Session replays	90 days
Your full IP address in our analytics	90 days. After that we keep only the organisation, approximate location and a masked address.
Other analytics (pages, clicks, visits)	25 months
Hashed IP addresses for the spam check	Expire after an hour
Demo requests, event bookings, enquiries and correspondence	While we're in touch with you, then up to two years after our last contact, unless you become a customer
Customer and billing records	For the length of the contract, then as long as the law requires (usually six years)
Marketing suppression list	Indefinitely, so we never email you after you've opted out

Your rights

Under UK data protection law you have the right to:

• get a copy of the personal information we hold about you;
• have it corrected if it's wrong;
• have it deleted, or its use restricted, in some circumstances;
• object to our use of it for legitimate interests, and to stop direct marketing at any time;
• receive information you gave us in a portable format, in some circumstances.

To use any of these, email info@sa12.co.uk. It's free, and we'll reply within one month. We may need to confirm who you are first.

If you're unhappy with how we've handled your information, please tell us so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Children

Our website and products are for businesses. They're not aimed at children, and we don't knowingly collect children's information.

Changes to this policy

When we change how we use personal information, we'll update this page and the date at the top. This version was last updated on 23/10/2026.