Privacy Policy

1. Who We Are

openElara is a managed open-source platform that helps UK businesses replace expensive per-user SaaS subscriptions with self-hosted alternatives. We provide managed hosting, migration, and ongoing support.

Registered Address: openElara, United Kingdom

Contact Email: hello@openelara.org

Privacy enquiries: privacy@openelara.org

2. Information We Collect

We collect information you voluntarily provide when you:

• Contact us via our form, email, or forum — including your name, email address, company, and message content
• Subscribe to our newsletter — your email address
• Create a forum account — username, email address, and any information you choose to share in your profile
• Request a service consultation — business contact details and project requirements

We do not collect special category data (racial origin, political opinions, religious beliefs, etc.) unless voluntarily provided by you in message content.

3. How We Use Your Information (Legal Basis)

Under UK GDPR, we process your personal data on the following legal bases:

• Contract: Processing necessary to fulfil our service obligations to you when you engage us for consulting, hosting, or development work
• Legitimate Interests: Communicating with you about our services, improving our offerings, and ensuring network security (where overridden by your interests does not apply)
• Consent: Marketing communications and non-essential cookies — you can withdraw consent at any time
• Legal Obligation: Retaining records as required by UK tax and commerce law

4. How We Share Your Data

We share your personal data only with trusted third-party processors who assist in delivering our services:

• PocketBase (self-hosted) — contact form submissions, stored on our own infrastructure (first-party processor)
• Hosting providers — when providing managed services, your data may be processed on servers within the UK or EEA
• Email providers — for transactional and marketing emails

We do not sell, trade, or rent your personal information to third parties. All processors are contractually bound to handle your data securely and only for the purposes we specify.

5. International Transfers

If we transfer your data outside the UK/EEA, we ensure appropriate safeguards are in place (standard contractual clauses or adequacy decisions) before any such transfer.

6. Data Retention

• Contact form submissions: Retained for 12 months to respond to enquiries
• Forum accounts: Retained until you request deletion or your account is dormant for 2+ years
• Service records: Retained for 7 years per UK tax law requirements
• Marketing subscribers: Retained until you unsubscribe

7. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), access controls, regular security reviews, and secure storage with access logging.

8. Your Rights (UK GDPR)

You have the right to:

• Access — request a copy of your personal data (Subject Access Request)
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data ("right to be forgotten"), subject to legal retention requirements
• Restriction — request we limit how we process your data
• Portability — request your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Automated decisions — not be subject to solely automated decision-making with legal effects

To exercise any rights, email privacy@openelara.org. We will respond within 30 days.

Right to complain: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have mishandled your data. Visit ico.org.uk or call 0303 123 1113.

9. Cookies and Tracking

Our site currently uses minimal cookies. See our Cookie Policy for full details on what cookies are used and how to manage them.

10. Children's Privacy

Our services are not directed at individuals under 16. We do not knowingly collect data from minors without parental consent.

11. Changes to This Policy

We will notify you of material changes via a prominent notice on our website and, where appropriate, by email. Continued use after changes constitutes acceptance.