Privacy policy

Effective date: 2026-03-26 — Version: 2026-03-26-v1

The data controller is Camio Software Limited, registered at 124 City Road, London, England, EC1V 2NX. Contact / DPO: dpo@camio.co.

Scope (UK, EEA, and EU GDPR)

This privacy notice is primarily intended for users in the United Kingdom and the European Economic Area (EEA). We describe processing in line with the UK General Data Protection Regulation (UK GDPR) as it forms part of the law of England and Wales, Scotland, and Northern Ireland, read with the Data Protection Act 2018 (where applicable), and the EU General Data Protection Regulation (Regulation (EU) 2016/679; "EU GDPR") together with applicable EU Member State implementing laws. For cookie and similar technologies, rules under the Privacy and Electronic Communications Regulations 2003 (PECR) in the UK and the ePrivacy Directive (2002/58/EC) as implemented in EU/EEA countries also apply alongside GDPR where relevant.

1. Who we are

Camio is a circular asset and inventory management platform operated by Camio Software Limited ("we", "us"). This notice describes how we process personal data when you use the Camio web application and related services.

2. Data we process

Account and identity: e.g. name, email address, profile image, authentication identifiers from our identity provider (Auth0), organisation membership and roles.
Platform content: data you or your organisation enter (properties, rooms, assets, orders, moves, catalogues, etc.) including any personal data contained in those records.
This may include names, contact details, location data, or other personal data entered by users depending on how the platform is used.
Technical data: IP address, device/browser type, timestamps, and similar data in server logs and security tooling.
Support and communications: messages you send us and metadata needed to respond.

3. Purposes and lawful bases (UK GDPR and EU GDPR)

We rely on lawful bases set out in Article 6 UK GDPR / EU GDPR (and, where special category data were ever processed, Article 9 would apply with an additional condition). Typical bases include:

Performance of a contract (Art. 6(1)(b)) — providing the service you or your organisation signed up for.
Legitimate interests (Art. 6(1)(f)) — securing the platform, debugging, product improvement, and internal reporting, balanced against your rights; we consider necessity and impact and you may object where applicable (Art. 21).
Legal obligation (Art. 6(1)(c)) — where required by UK or EU law.
Consent (Art. 6(1)(a)) — for non-essential cookies and similar technologies (e.g. certain analytics or session replay) where UK PECR / EU ePrivacy rules require consent, and for any other processing we choose to base on consent. Consent must be freely given, specific, informed, and unambiguous (Article 7 UK GDPR / EU GDPR). You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal; strictly necessary cookies for authentication may still be required to use the Service.

Where we process personal data on behalf of our customers (e.g. data entered into the platform), we act as a data processor. The customer organisation is the data controller.

4. Cookies and similar technologies

We use cookies and similar storage for:

Strictly necessary / functional: session and security cookies from our authentication provider (Auth0) so you can sign in; locale preference (e.g. language cookie).
Analytics and reliability (with consent): Vercel Analytics for aggregated usage; Datadog (Real User Monitoring, logs, and optionally session replay sampled on a subset of sessions) to diagnose errors and improve performance. Session replay may capture interactions on pages where it is enabled; we configure privacy controls such as masking user input where supported. Where session replay is enabled, it is limited, sampled, and configured to mask user inputs and sensitive fields

Until you accept the in-app notice for the current policy version, we do not load the non-essential analytics tools above in the authenticated application.

5. Recipients and subprocessors

We use vetted service providers who process data on our instructions, including (non-exhaustive):

Auth0 (Okta) — authentication
Vercel — hosting; Vercel Analytics; feature flags where enabled
Datadog — monitoring, RUM, logs, application tracing
MongoDB (e.g. Atlas) — database hosting
Amazon Web Services / CloudFront — infrastructure and content delivery for assets and related services

We maintain an up-to-date list of subprocessors available upon request and will notify customers of material changes where required.

6. International transfers

Some subprocessors are established outside the UK and EEA. Where personal data are transferred from the UK or EEA to countries not subject to an adequacy decision (or equivalent UK "adequacy regulations"), we implement appropriate safeguards required under Chapter V UK GDPR / EU GDPR, such as the EU Commission Standard Contractual Clauses (SCCs) and, for UK transfers, the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, supplemented by transfer risk assessments where required. Details of these safeguards are available on request.

7. Retention

We keep personal data only as long as needed for the purposes above, in line with the storage limitation principle (Art. 5(1)(e) UK GDPR / EU GDPR), including legal, accounting, and dispute resolution. Define concrete retention periods in your internal records of processing (RoPA) and in customer-facing documentation where required.

Account data is retained while account remains active

Audit logs: 365 days
Support emails: 365 days

8. Your rights (UK GDPR and EU GDPR)

Subject to conditions and exemptions in the UK GDPR / EU GDPR, you may have the right to: access (Art. 15), rectification (Art. 16), erasure ("right to be forgotten", Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests or for direct marketing (Art. 21). Where processing is based on consent, you may withdraw consent at any time (Art. 7(3)). You may also have rights related to automated decision-making (Art. 22) if applicable.

UK: You may complain to the Information Commissioner's Office (ICO).

EEA: You may lodge a complaint with the supervisory authority in your country of habitual residence, place of work, or place of the alleged infringement (Art. 77 EU GDPR). A list of EU data protection authorities is published by the European Data Protection Board (EDPB).

To exercise any of these rights, contact dpo@camio.co. We will respond within statutory time limits (typically one month, extendable in complex cases under UK GDPR / EU GDPR).

9. Children

The service is not directed at children. We do not knowingly collect data from children.

10. Changes

We may update this policy. We will post the new version and, where appropriate, ask you to accept an updated version in the application.

11. Security

We implement appropriate technical and organisational measures including encryption, access controls, and monitoring to protect personal data.