Overview
PORTALD is a trading name of IT BOFFINS LTD, company number 12408554. IT BOFFINS LTD is a company registered in England and Wales. This Privacy Policy explains how PORTALD handles personal data when you visit the website, create or use a business account, access a client portal, complete forms, upload files, accept agreements, connect third-party integrations, manage billing or submit a product enquiry.
- We use clear privacy information because UK GDPR requires personal data to be handled lawfully, fairly and transparently.
- The exact data processed depends on how a business configures its portal and which features are enabled.
- A business using PORTALD may also need to give its own customers a privacy notice explaining how that business uses personal data inside its portal.
- This policy should be read with our Terms of Service and any data processing agreement that applies to a business workspace.
Who is responsible for your data
Data protection law distinguishes between a controller, which decides why and how personal data is used, and a processor, which processes personal data on behalf of a controller.
- IT BOFFINS LTD, trading as PORTALD, is usually the controller for website enquiries, demo requests, business account administration, billing, service security, product analytics, support messages and our own legal compliance.
- The business that creates a PORTALD workspace is usually the controller for customer records, customer contacts, uploaded files, form answers, agreement documents, agreement acceptances and portal instructions that it manages through PORTALD.
- PORTALD is usually the processor for that customer portal data, acting on the business's instructions to host, secure, display, transmit and support it.
- Where a business connects a third-party integration, the business remains responsible for deciding what data should be connected and shown to its customer portal users.
- If you are an invited client portal user and your request relates to data controlled by the business that invited you, we may direct you to that business or help them respond.
Registered office: 20 Tanners Drive, Blakelands, Milton Keynes, England, MK14 5BN.
Personal data we may collect
We collect or receive personal data directly from you, from the business that invited you, from team members using a workspace, from connected integrations and from technical systems that keep the service running.
- Identity and contact data, such as name, email address, phone number, business name, role, customer organisation and portal invitation details.
- Account data, such as login credentials, authentication events, password reset records, tenant memberships, user roles, workspace settings and support preferences.
- Business and portal data, such as customer records, contact records, portal branding, support email addresses, custom domains, forms, files, agreement templates, assignment records and acceptance history.
- Uploaded content, such as documents, images, job photos, service records, certificates, completed forms and other files a business or client portal user chooses to upload.
- Accounting integration data, such as OAuth connection details, linked contacts, invoice references, invoice status, amounts, dates and simplified finance views where a business connects an accounting system.
- Technical data, such as IP address, device and browser details, user agent, page views, session events, audit logs, security logs, error logs and cookie or similar technology identifiers.
- Communications data, such as demo requests, support messages, feedback, email delivery records and administrative correspondence.
- Lead enquiry data submitted through portald.co.uk, Google lead forms or other PORTALD advertising forms, such as name, company name, business email and the product problem you asked us to discuss.
How we use personal data
We use personal data only where we have a lawful reason. The lawful basis may differ depending on whether we are acting as controller or processor.
- To provide the service, including account creation, sign-in, customer invitations, tenant routing, portal access, file delivery, form completion, agreement acceptance, workspace settings and support.
- To manage subscriptions, payments, billing, plan limits, customer service, onboarding and service communications.
- To keep PORTALD secure, including authentication, access control, tenant isolation, audit logging, abuse prevention, malware or file validation signals, troubleshooting and incident response.
- To operate integrations, including connected invoice views and any email, hosting, storage, file-scanning, analytics or monitoring provider needed for enabled features.
- To improve PORTALD, including product diagnostics, aggregated usage insights, testing, debugging and service reliability work.
- To respond to PORTALD walkthrough requests, product enquiries, support requests and Google Ads lead forms.
- To meet legal, tax, accounting, regulatory, dispute resolution and record-keeping obligations.
- To send marketing or product updates where permitted by law and your choices. You can opt out of marketing messages at any time.
Common lawful bases include contract, legitimate interests, consent, legal obligation and, where a business controls portal data, the business's own lawful basis under UK GDPR.
Client portal data
A client portal is controlled by the business that invited the client. PORTALD provides the software infrastructure and access controls that allow that business to operate the portal.
- The inviting business decides which customers are added, which contacts are invited, what forms and agreements are assigned, which files are shared, and which accounting or invoice information is visible.
- Client portal users should contact the inviting business first for questions about why data is requested, how long it is kept, or whether a file, form answer or agreement record should be corrected or deleted.
- PORTALD may process portal activity records, IP addresses and user agents to provide security, audit history and evidence of actions such as agreement acceptance.
- Customer passwords are scoped to the relevant business portal. The same email address may have different credentials for different business portals.
- We do not sell client portal content or use it for unrelated advertising.
Files, forms and agreements
PORTALD may store and process sensitive operational documents because businesses use the service for real customer work.
- Files may include business records, job photos, onboarding documents, service records, certificates, completed forms or other material chosen by a business or portal user.
- Form answers may include contact details, business information, supporting files, free-text answers and other information requested by the business.
- Agreement records may include agreement text, version snapshots, assignment details, acceptance timestamps, user details, IP addresses and user agents.
- Businesses should request only the information they need, explain why they need it, and avoid collecting special category or high-risk information unless appropriate safeguards are in place.
- PORTALD may use validation, security checks, storage controls and audit logs to protect these records and manage access.
Accounting integrations
Some businesses use PORTALD with third-party integrations. These features may involve additional processing.
- When a business connects an accounting integration, PORTALD uses the authorised connection to retrieve and display relevant invoice or contact information for that business and its permitted client portal users.
- Connected accounting providers remain third-party services with their own terms, privacy notices, permissions and security models.
- File-scanning providers may process uploaded file metadata or content where a business has configured scanning for production use.
Automated document checks
Where a business enables automated document checks, selected uploads are analysed by an AI model to provide a short triage result for staff review.
- PORTALD sends the selected document and the business's check instruction to its configured AI model provider, which may be OpenAI or another configured model endpoint, to produce a short traffic-light result.
- PORTALD stores the result and relevant processing metadata against the tenant record. The check is limited to document text, layout and content triage; it does not perform identity verification or biometric analysis.
- Automated results support staff review only. The business remains responsible for deciding whether a document is suitable and can request another copy.
- A business can operate PORTALD without automated checks. Where they are turned off, uploaded documents are not analysed in this way.
Advertising, analytics and lead forms
PORTALD may use advertising, analytics and conversion measurement tools to understand whether the website and campaigns are working.
- We may use Google Analytics and Google Ads measurement to understand visits, demo requests, conversion events and campaign performance.
- If you submit a PORTALD lead form through Google or portald.co.uk, we use the details you provide to respond to that PORTALD enquiry and keep an internal record of the request.
- PORTALD demo and lead forms are for business contact details only. Do not send passwords, payment card details, bank details, customer files, government identifiers or third-party login credentials through those forms.
- We do not sell lead enquiry data or client portal content.
- You can ask us to stop sending marketing messages, and each marketing email should include an unsubscribe route where required.
International transfers
Some providers may process personal data outside the UK. When this happens, we use safeguards required by data protection law.
- Safeguards may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, contractual controls and provider due diligence.
- Where a business requires data residency or additional transfer controls, that must be agreed in writing before the relevant data is processed.
- Third-party integrations may transfer data according to their own terms and privacy arrangements.
How long data is kept
We keep personal data only for as long as needed for the purpose it was collected, including service delivery, security, legal, accounting, dispute and backup purposes.
- Business account and billing records are kept while the account is active and for a reasonable period afterwards for tax, contract and dispute purposes.
- Client portal content is kept according to the business workspace settings, the business's instructions, any data processing agreement and practical backup deletion cycles.
- Security logs, audit logs and agreement acceptance evidence may be kept for longer where needed to protect accounts, evidence important actions or resolve disputes.
- Demo enquiries and marketing records are kept until they are no longer needed or you opt out, subject to any lawful suppression list we need to keep.
- Backups are deleted or overwritten on a rolling basis according to our backup procedures.
Your data protection rights
Depending on the context and legal basis, you may have rights over your personal data under UK GDPR.
- You may have the right to ask for access to your data, correction of inaccurate data, deletion of data, restriction of processing, objection to processing, data portability and withdrawal of consent.
- Some rights are not absolute. For example, data may need to be retained for legal claims, security, tax, audit or contractual reasons.
- If your request relates to a client portal controlled by a business, we may need to pass the request to that business or ask you to contact them directly.
- To make a request to PORTALD, contact hello@portald.co.uk.
- You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.
Security
We use technical and organisational measures designed to protect personal data. Security also depends on how each business configures and manages its workspace.
- PORTALD uses account authentication, tenant-scoped access controls, portal membership checks, audit logs and server-side permission checks.
- Businesses should use strong passwords, limit team access, remove users who no longer need access, keep customer contact details accurate and review connected integrations.
- No online system can be guaranteed to be completely secure. If you believe an account, portal, file or integration has been accessed without permission, contact us promptly.
- If you receive a message that claims to be from PORTALD and asks for passwords, payment card details, bank details or third-party login credentials, do not provide them and contact us at the email address above.
- We may notify affected customers, users, regulators or businesses where required by law or where notice is needed to reduce harm.
Our Trust and Security page explains PORTALD ownership, public lead form boundaries and integration limits.
Children and regulated data
PORTALD is intended for business use and is not designed for children.
- Users must not create accounts for children or knowingly invite children into portals unless this has been expressly agreed and the required safeguards are in place.
- Businesses must not use PORTALD for special category, criminal offence, medical, financial-regulated or other high-risk data unless their plan and written agreement permit it.
- If you believe a child has provided personal data to PORTALD without appropriate authority, contact us so the issue can be reviewed.
Changes and contact
We may update this Privacy Policy as PORTALD develops, legal requirements change or new features are added.
- The latest version will be posted on this page with a new update date.
- Where changes are material, we will take reasonable steps to bring them to the attention of affected users or businesses.
- Questions about this policy can be sent to hello@portald.co.uk.
- You can also read our Terms of Service and Trust and Security page.