Privacy Policy

Who this policy applies to

This policy applies to visitors, account holders, invited Workspace members and other people whose personal information is processed through the UniCo Platform. UniCo Solutions operates the Platform and is the privacy actor described in this policy.

For account, platform administration and direct service data, UniCo Solutions may act as controller. For content handled on documented instructions of a Business Workspace customer, that customer may be the controller and UniCo Solutions may act as processor or service provider. The role depends on the processing context.

Information UniCo Solutions may process

• Account and authentication data, including identity, email, session and account-status information.
• Profile and preference data supplied by the user, including private contact and address information.
• Workspace, membership, invitation, role and permission data.
• Content a user chooses to enter or upload into an available UniCo service.
• Security, administrative activity and technical request information needed to operate, protect and troubleshoot the service.

Why information is processed and legal bases

UniCo Solutions processes information to create and secure accounts, provide requested Platform and Workspace functions, manage permissions, communicate about the service, prevent misuse, meet legal obligations and establish or defend legal claims.

Depending on the activity and applicable law, the legal basis may be performance of a contract or steps requested before a contract, legitimate interests balanced against individual rights, compliance with a legal obligation, consent, or another basis permitted by law. Consent can be withdrawn for future processing where consent is the basis; withdrawal does not undo earlier lawful processing.

My Space, Business Space and Workspace data

My Space is an owner-scoped personal context. Business Space contains separate Workspaces whose data is available only through active membership and permissions. Personal and Business data are not mixed automatically.

Workspace customers and administrators decide who they invite and which authorized roles they assign. Workspace membership does not reveal another member’s private profile fields.

User-provided content

Personal information does not fall outside privacy law merely because a user provided or uploaded it voluntarily. Users must have authority to provide information about other people and should avoid adding data that is unnecessary for the intended purpose.

Recipients and service providers

Information may be disclosed to authorized Workspace members, infrastructure and authentication providers, professional advisers, authorities where legally required, and other recipients requested or authorized by the user or customer. Providers receive only the access needed for their contracted service and remain subject to applicable contractual and legal safeguards.

UniCo Solutions does not treat a service provider’s technical access as permission for that provider to use customer data for its own unrelated purposes.

International transfers

Operating an online service may involve processing in countries other than the user’s country. Where transfer rules apply, UniCo Solutions will use an available lawful mechanism and relevant contractual, organizational or technical safeguards. This policy does not promise that all data remains in one country.

Retention and deletion

Personal information is kept only while needed for the stated purposes, account or Workspace operation, security, legal obligations, dispute handling and recovery from backups. The criteria include data type, sensitivity, user relationship, legal limitation periods and the time needed for secure deletion from active systems and backup cycles.

A deletion request may be limited where retention is required by law, needed for security or fraud prevention, or necessary to establish, exercise or defend legal claims. Operational retention periods will be documented by data class before additional sensitive modules launch.

Security and automated decisions

UniCo Solutions uses authentication, application authorization, database-level access controls, deny-by-default permissions and managed encryption in transit and at rest. These measures reduce risk but cannot eliminate every security risk.

The Platform does not use solely automated processing to make decisions that produce legal or similarly significant effects about users. Future advisory classification must not grant permission or move data automatically.

Global privacy rights

Depending on applicable law, a person may request information and access, correction, deletion, restriction, portability, withdrawal of consent, or object to particular processing. Some rights are conditional and exceptions may apply. UniCo Solutions may verify identity, Workspace authority and request scope before acting.

Requests or data-protection complaints may be sent to info@unico-solutions.com. UniCo Solutions will record the request, acknowledge and respond within the period required by applicable law, and explain any refusal and available complaint route.

United Kingdom

Where UK data-protection law applies, processing is governed by the UK GDPR and Data Protection Act 2018 as amended, including the Data (Use and Access) Act 2025. PECR applies to relevant cookies and electronic communications.

UK rights may include access, rectification, erasure, restriction, portability, objection, withdrawal of consent and safeguards for significant automated decisions. A person may complain to UniCo Solutions and then to the Information Commissioner’s Office. UniCo Solutions will acknowledge a UK data-protection complaint within 30 days, investigate without undue delay, keep the complainant appropriately informed and communicate the outcome without undue delay.

EU / EEA

EU GDPR applies only where its territorial scope is met, for example because relevant processing is carried out by an EU establishment or relates to offering goods or services to, or monitoring, people in the EU/EEA.

Where it applies, the notice and rights framework includes Articles 13 and 14 transparency, access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to the competent supervisory authority. Restricted transfers outside the EEA require an applicable adequacy decision, contractual safeguards or another lawful derogation or mechanism.

United States and California

US privacy obligations vary by state, sector and processing activity. UniCo Solutions will give accurate notices, use reasonable safeguards appropriate to the information, and avoid unfair or deceptive statements about data practices.

If the CCPA as amended by the CPRA applies, California residents may have rights to know, delete, correct, opt out of sale or sharing, limit qualifying use or disclosure of sensitive personal information, and receive non-discriminatory treatment. Notice at collection and policy disclosures apply where required. UniCo Solutions does not sell personal information or use it for cross-context behavioral advertising through the Platform. This statement must be reassessed before such technology or a new commercial data use is introduced.

Australia

Where the Privacy Act 1988 and Australian Privacy Principles apply, UniCo Solutions will manage personal information openly, provide relevant collection information, take reasonable security steps, and support access, correction and complaints subject to lawful exceptions.

Before an applicable cross-border disclosure, APP 8 generally requires reasonable steps to ensure the overseas recipient does not breach the APPs, subject to statutory exceptions, and may make the disclosing APP entity accountable for the recipient’s handling. UniCo Solutions does not promise Australian-local storage.

Children, other jurisdictions and policy changes

The Platform is intended for adults and organizational users and is not designed as a child-directed service. If UniCo Solutions learns that information about a child was processed without an appropriate lawful basis or authorization, it will assess and address it under applicable law.

People in other jurisdictions may have additional mandatory rights. Material policy changes will be published before new processing begins where advance notice is legally required.