Privacy Notice

Abaci is a trading name of Luna Capital Limited, a company incorporated in Guernsey with company registration number 69466.

For the purposes of applicable data-protection law, Luna Capital Limited is the controller of the personal data described in this Privacy Notice unless we expressly state otherwise.

Our details are:

Luna Capital Limited
trading as Abaci
Company registration number: 69466
Website: abaci.gg
Privacy enquiries: privacy@abaci.gg

In this Privacy Notice, “Abaci”, “we”, “us” and “our” refer to Luna Capital Limited trading as Abaci.

This Privacy Notice explains how we collect, use, disclose, store and protect personal data relating to people who interact with Abaci.

It applies in particular to:

• visitors to abaci.gg and other websites we may operate;
• people who contact or make enquiries with us;
• prospective clients and their personnel;
• clients and their personnel, representatives and professional advisers;
• suppliers, service providers and their personnel;
• professional contacts;
• people introduced to us through referrals;
• people we meet through networking events and similar business activities; and
• other individuals with whom we interact in the course of operating Abaci.

This Privacy Notice principally concerns personal data for which Luna Capital Limited determines the purposes and means of processing.

Where we process data for our clients

As part of our software, automation, reporting and consulting services, Abaci may sometimes process personal data on behalf of a client and in accordance with that client's instructions.

Where we act solely as a processor on behalf of a client, the client will ordinarily be the controller responsible for determining how and why that information is processed. That processing will be governed by our agreement with the client and, where applicable, appropriate data-processing terms.

This Privacy Notice does not replace a client's own privacy notice in relation to personal data for which that client is the controller.

The personal data we collect depends on how you interact with us.

3.1 Contact and identity information

This may include:

• your name;
• business or organisation;
• job title or professional role;
• business email address;
• telephone number;
• business address; and
• other contact information you choose to provide.

3.2 Enquiries and communications

If you contact us, we may process:

• the contents of your enquiry;
• correspondence between you and us;
• meeting notes;
• requests for proposals or information;
• records of calls or meetings;
• information about your organisation and its requirements; and
• other information you voluntarily provide.

You should not provide special category, highly sensitive, confidential or unnecessary personal information through a general website enquiry form.

3.3 Business relationship information

Where you or your organisation engages or considers engaging with Abaci, we may process information relating to:

• proposals and potential projects;
• contracts and statements of work;
• services requested or provided;
• project communications;
• commercial discussions;
• invoicing and payment administration;
• account and relationship management;
• support and service communications; and
• the history of our business relationship.

3.4 Professional and business-development information

We may process professional information about business contacts, including:

• your employer or organisation;
• your role and professional responsibilities;
• your business contact details;
• areas of professional interest;
• how we met or were introduced;
• relevant previous communications; and
• publicly available professional information where reasonably relevant to our relationship with you.

3.5 Website and technical information

When you visit our Website, we and the providers used to operate it may process technical information such as:

• IP address;
• browser type and version;
• device type;
• operating system;
• referring website or URL;
• pages requested or viewed;
• dates and times of access;
• approximate location derived from an IP address;
• security and diagnostic information;
• error and performance logs; and
• other information generated through normal web-server and network operation.

Our Website uses infrastructure provided by Cloudflare, which may process technical, network and security information in connection with hosting, delivery, performance and protection of the Website.

3.6 Marketing preferences

Where we provide marketing communications, we may record:

• whether you have requested or agreed to receive them;
• your areas of interest;
• communications sent to you;
• relevant engagement information; and
• any opt-out or unsubscribe request.

3.7 Case studies and testimonials

Where appropriate and with the necessary permissions, we may process personal data in connection with testimonials, case studies or other descriptions of our work.

This could include an individual's name, job title, organisation, quotation, professional opinion, photograph or other agreed information.

We will not publish identifiable personal information in a case study or testimonial without an appropriate lawful basis and any permissions reasonably required in the circumstances.

We may obtain personal data:

Directly from you, for example when you submit a contact form, email or communicate with us, attend a meeting, request information or a proposal, enter into a business relationship with us, subscribe to marketing communications, provide feedback or otherwise interact with Abaci.

Through your organisation, where your employer, colleague or another representative provides us with your business contact details.

Through referrals and professional contacts, including introductions, referrals, professional advisers, clients, suppliers, colleagues, business partners or other members of our professional network.

Through networking, where we meet you at conferences, professional events, meetings or other networking activities.

From publicly available sources, where appropriate for legitimate business purposes, including an organisation's website, professional directories, public corporate records and professional networking platforms.

We do not currently intend to conduct large-scale collection of personal data from publicly available sources.

Where applicable law requires us to provide privacy information when we obtain your personal data indirectly, we will provide or draw your attention to this Privacy Notice within the required period, including when we first communicate with you where appropriate.

We may process personal data for the following purposes.

5.1 Responding to enquiries

We use contact information and communications to respond to enquiries, understand what you or your organisation may require, arrange discussions or demonstrations, prepare proposals and determine whether Abaci may be able to assist.

5.2 Providing and managing services

Where we have a business relationship with you or your organisation, we may process personal data to establish and administer the relationship, provide contracted services, manage projects, communicate with relevant personnel, provide support, administer agreements, maintain business records and manage billing and payment matters.

5.3 Operating and protecting our Website and systems

We may process technical and security information to operate the Website, deliver Website content, maintain performance and availability, detect and investigate errors, prevent fraud, malicious traffic and abuse, maintain cybersecurity, investigate security incidents and protect Abaci, our infrastructure and our users.

5.4 Improving our business and services

We may use appropriate information to understand how people use our Website, improve Website performance and content, understand interest in our services, improve our services and business processes, develop new services and capabilities and manage our business effectively. Where analytics technologies require consent, we will obtain that consent before using them.

5.5 Business development and professional relationships

We may process business contact information to maintain professional relationships, follow up introductions or networking conversations, discuss services that may reasonably be relevant to an organisation, maintain records of previous business discussions and develop Abaci's business. We will do so proportionately and in accordance with applicable data-protection and direct-marketing requirements.

5.6 Marketing

Where you have separately subscribed to or requested Abaci marketing communications, we may use your contact details to send information about Abaci, our services, insights and articles, case studies, events and other relevant business information. We may also send business-to-business communications where otherwise permitted by applicable law.

You may ask us to stop sending direct marketing at any time. Submitting a general enquiry to Abaci does not, by itself, mean that you have subscribed to an ongoing marketing mailing list.

5.7 Legal, regulatory and business protection

We may process personal data where reasonably necessary to comply with legal and regulatory obligations, respond to lawful requests from authorities, establish, exercise or defend legal rights, obtain legal or professional advice, maintain appropriate records, investigate suspected fraud or misconduct, enforce contractual rights, resolve disputes and protect Abaci, our clients and other persons.

We process personal data only where we have an appropriate lawful basis. Depending on the circumstances, these may include:

Legitimate interests

We may process personal data where it is necessary for legitimate interests pursued by Abaci or another person, provided those interests are not overridden by your significant interests or applicable data-protection rights.

Our legitimate interests may include operating and developing our business; responding to business enquiries; developing prospective business relationships; maintaining professional relationships; providing and improving our services; administering client and supplier relationships; operating and protecting our Website and IT systems; cybersecurity and fraud prevention; understanding Website usage; protecting our legal and commercial interests; and appropriate business-to-business communications.

Contract

We may process personal data where necessary to enter into or perform a contract with you. Where our contract is with your employer or organisation rather than with you personally, much of the processing of your business contact information will instead be based on our legitimate interests in administering that relationship.

Legal obligation

We may process information where necessary to comply with an obligation imposed on us by law.

Consent

We may rely on your consent where appropriate, including for certain marketing communications, optional cookies or analytics technologies. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

Legal claims and other lawful grounds

Where applicable, personal data may also be processed where necessary to establish, exercise or defend legal claims or under another lawful ground permitted by applicable law.

The Website may use cookies and similar technologies necessary for security, network operation and Website functionality. Our Website infrastructure provider, Cloudflare, may process technical information and may use technologies necessary to provide security, traffic management and Website functionality.

At the date of this Privacy Notice, Abaci does not use advertising or remarketing tags such as the LinkedIn Insight Tag, Meta Pixel or Google Ads remarketing tags.

We may introduce privacy-conscious website analytics in the future. If we use non-essential analytics, advertising, remarketing or similar tracking technologies, we will update our privacy and cookie information and, where required, obtain consent before those technologies are activated.

Where appropriate, a separate Cookie Notice or cookie-preference mechanism will provide more detailed information about the technologies actually in use.

Abaci may use Microsoft Forms or other services within our Microsoft 365 environment to collect website enquiries. Information submitted through those forms may therefore be processed using Microsoft services on our behalf.

We may also use Microsoft 365 for email, document storage, communications, collaboration and general business administration. Microsoft and other service providers may process personal data in accordance with their contractual arrangements with us and their own legal obligations.

We may disclose personal data where reasonably necessary to:

• technology and cloud-service providers;
• Website hosting, infrastructure and security providers;
• Microsoft and other productivity or communications providers;
• analytics providers, where enabled;
• professional advisers such as lawyers, accountants and consultants;
• insurers;
• contractors and suppliers assisting us with our business;
• clients where appropriate to an engagement;
• auditors;
• courts, regulators, government bodies or law-enforcement authorities where required or appropriate by law; and
• another organisation in connection with a genuine corporate restructuring, investment, financing, merger, acquisition or sale of all or part of our business, subject to appropriate confidentiality and data-protection arrangements.

Service providers acting on our behalf are expected to process personal data only for appropriate purposes and subject to applicable contractual and legal protections. We do not disclose personal data to third parties merely because they request it.

Abaci is based in Guernsey but may use technology providers, cloud infrastructure, professional advisers or other service providers operating in other jurisdictions. Personal data may therefore be stored, accessed or processed outside the Bailiwick of Guernsey.

Where an international transfer is subject to restrictions under applicable data-protection law, we will use an appropriate lawful transfer mechanism or safeguard where required. Depending on the destination and circumstances, this may include:

• transferring information to a jurisdiction recognised as providing an adequate level of protection;
• appropriate contractual safeguards;
• recognised standard contractual clauses together with any applicable Guernsey requirements;
• another legally recognised transfer mechanism; or
• an applicable exemption where permitted by law.

The locations from which particular cloud services process data may change over time according to the service provider and our configuration of that service.

We do not retain personal data indefinitely simply because we may have a technical ability to do so. We determine retention periods by considering the reason information was collected, whether we continue to need it, legal and contractual requirements, security requirements and whether information may be required to establish or defend legal rights.

General and unsuccessful enquiries

We will normally retain records of general enquiries and prospective business discussions for up to 24 months after the last meaningful interaction, unless there is a reason to retain them for longer or you ask us to delete them and we have no continuing lawful reason to retain them.

Client and business relationships

Information relating to an established business relationship may be retained for the duration of that relationship and afterwards for the period reasonably required for contractual, legal, tax, accounting, insurance, audit and claims purposes.

Marketing

Marketing contact information may be retained while you remain subscribed or while we have an appropriate basis to communicate with you. If there has been no meaningful marketing interaction for a prolonged period, we may remove or suppress your information from active marketing records. Where you unsubscribe, we may retain limited information on a suppression list so that we can respect your request not to receive further marketing.

Website and security records

Technical logs, security information and diagnostic records will be retained only for periods reasonably necessary for Website operation, security, troubleshooting and legal purposes, taking into account the retention settings and practices of the providers we use.

Legal and regulatory matters

Information relevant to a dispute, investigation, legal claim or regulatory matter may be retained for as long as reasonably necessary to deal with that matter and protect our legal rights.

When information is no longer required, we will delete, anonymise or otherwise cease retaining it where reasonably practicable.

We take reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, disclosure, alteration or misuse. The measures used will depend on the nature of the information, the systems involved and the risks associated with the processing.

We also use reputable technology and infrastructure providers to support the security and operation of our systems. However, no internet transmission, email system, website, cloud service or electronic storage system can be guaranteed to be completely secure.

You should therefore avoid sending highly sensitive or confidential information through a general Website contact form unless we have specifically asked you to use an appropriate secure method.

The Data Protection (Bailiwick of Guernsey) Law, 2017 gives individuals a number of rights over their personal data. Depending on the circumstances and subject to applicable exemptions, these may include the right to:

• be informed about how your personal data is used;
• request access to personal data we hold about you;
• request correction of inaccurate or incomplete information;
• request erasure of your personal data in appropriate circumstances;
• request restriction of processing in appropriate circumstances;
• object to processing based on legitimate interests;
• object to direct marketing;
• request data portability where the right applies;
• withdraw consent where processing is based on consent; and
• not be subject to certain decisions based solely on automated processing.

If another applicable data-protection law gives you additional rights, we will respect those rights where that law applies to our processing. You will not normally have to pay a fee to exercise a data-protection right. We may need to request information reasonably necessary to confirm your identity before acting on a request.

To exercise a privacy right, contact privacy@abaci.gg. We will respond within the period required by applicable law.

Abaci does not currently use personal data collected under this Privacy Notice to make decisions about individuals solely by automated means where those decisions produce legal effects or similarly significant effects. Normal cybersecurity tools, spam filtering, analytics and automated technical processes are not intended to make such decisions about you. If our practices materially change, we will update this Privacy Notice and provide any additional information required by law.

You have the right to object to the use of your personal data for direct marketing. Where Abaci sends marketing communications, we will provide an appropriate means of opting out. You may also contact privacy@abaci.gg at any time and ask us to stop sending marketing communications.

An opt-out from marketing does not necessarily require us to delete all information we hold about you. For example, we may need to retain your contact details on a suppression record so that we know not to contact you for marketing purposes in the future. Service, project, contractual and other non-marketing communications relating to an existing business relationship are separate from marketing communications.

We do not intentionally request special category personal data or other highly sensitive personal information through the Abaci Website or general enquiry channels. Please do not include unnecessary information concerning matters such as health, medical information, political opinions, religious beliefs, criminal matters, government identification information, bank details or other highly sensitive information in a general enquiry.

If it becomes necessary for Abaci to process sensitive personal data in connection with a particular engagement, we will assess the appropriate legal, contractual and security requirements separately.

Abaci provides business-to-business services and its Website and services are not directed at children. We do not knowingly seek to collect personal data from children through the Website. If you believe that a child has provided personal information to us inappropriately, please contact privacy@abaci.gg.

Our Website may contain links to websites, platforms or services operated by third parties. Those organisations may collect or process personal data independently from Abaci and will have their own privacy practices and notices. We are not responsible for how an independent third party processes personal data merely because our Website links to its service. You should review the relevant third party's privacy information where appropriate.

We may update this Privacy Notice from time to time to reflect changes to our business, our Website, the services we provide, the technology and service providers we use, our data-processing activities or applicable law and regulatory guidance. The latest version will be published on abaci.gg and will state the date on which it was last updated. Where a change materially affects how we process personal data, we will take additional steps to notify affected individuals where required or appropriate.

If you have a question about this Privacy Notice, want to exercise a data-protection right or have a concern about how Abaci has handled your personal data, please contact privacy@abaci.gg.

We would welcome the opportunity to address any concern directly. You also have the right to raise a complaint with the Office of the Data Protection Authority for the Bailiwick of Guernsey (ODPA) where you believe that your data-protection rights have not been respected.

Office of the Data Protection Authority
Block A
Lefebvre Court
Lefebvre Street
St. Peter Port
Guernsey
GY1 2JP

Telephone: 01481 742074
Email: enquiries@odpa.gg
Website: odpa.gg