CueVexa legal
Privacy Policy
This draft describes a data-minimised CueVexa account, licensing, download and support service operated as an OkangGroup product.
Pre-launch draft for approval by OkangGroup and qualified counsel. It must not be presented as final until an effective date, legal entity details and contact address are approved.
Data collected
Account identity and profile details; licence/order status; device installation identifier, public-key hash, device label, app version and validation times; download and security logs; support messages; payment-provider references rather than full card data.
Purposes and lawful basis
Provide accounts, licences, downloads, support and purchases; prevent fraud and secure the service; comply with law; and improve reliability using proportionate, privacy-conscious diagnostics. The final policy must map each purpose to its UK GDPR lawful basis.
Sharing and international transfers
Only approved processors needed for hosting, authentication, email, payments, monitoring and support receive relevant data. A current subprocessor list and transfer safeguard must be published before launch.
Retention
Keep data only for operational, security, tax/legal and dispute periods. Define production periods for dormant accounts, download/audit logs, support records and backups; diagnostics must use the shorter test-programme retention.
Your rights
Subject to applicable law, users may request access, correction, deletion, restriction, portability or objection and complain to the UK ICO. Account export/deletion requests require identity verification and a recorded workflow.
Security and incidents
Use access control, private storage, encryption in transit, server-side entitlement checks, secret isolation, backups and monitoring. Maintain a breach triage, containment, notification and lessons-learned procedure.
Contact
Insert the approved OkangGroup controller identity, postal/email contact and privacy-request channel before launch.