WWeldon WebAzure Platform & AI Agents
← Posts

Marketplace Privacy Policy

Last updated: 30/09/2026 Effective date: 27/05/2026

1. Introduction

Weldon Web LTD ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect information when you use our software products, services, websites, and offers listed on Microsoft Azure Marketplace and Microsoft AppSource (collectively, the "Services").

By using our Services, you agree to the practices described in this policy. If you do not agree, please do not use the Services.

2. Who we are

Weldon Web LTD is a company registered in England and Wales under company number 10988760, with its registered office at:

8 The Dell, Plymouth, England, PL7 4PS

For data protection purposes, we act as a data controller for personal data we collect directly (such as account information, billing details, and support correspondence), and as a data processor for personal data you process through our Services as part of operating the software.

3. Information we collect

We collect the following categories of information:

3.1 Information you provide directly

  • Account registration details (name, email, company, job title)
  • Billing and payment information (handled by Microsoft for Marketplace transactions; we do not store your payment card details)
  • Support requests and correspondence
  • Survey responses and feedback

3.2 Information collected automatically

  • Service usage telemetry (feature usage, performance metrics, error logs)
  • Technical data (IP address, browser type, operating system, device identifiers, timezone)
  • Authentication metadata (sign-in timestamps, Microsoft Entra ID tenant identifiers)

3.3 Information processed on your behalf

When you operate our Services within your own Azure tenant (e.g. as a Managed Application), your application data, customer data, and any personal data flowing through the Services remain under your control as the data controller. We process this data solely on your instructions as a data processor, in accordance with the Microsoft Product Terms and any Data Processing Addendum (DPA) executed between us.

3.4 Information we do not collect

  • We do not knowingly collect personal data from children under 16
  • We do not collect special category data (health, biometric, racial or ethnic origin, political opinions, religious beliefs) unless you explicitly choose to process such data through the Services
  • We do not sell personal data to third parties under any circumstances

4. Why we collect this information (lawful basis)

We process personal data on the following lawful bases under GDPR and equivalent legislation:

  • Contract performance — to provide the Services you have purchased
  • Legitimate interests — to improve our products, prevent fraud, maintain security, and operate our business
  • Legal obligation — to comply with tax, accounting, and regulatory requirements
  • Consent — for marketing communications, where required by law
  • Vital interests — in rare emergency situations involving health or safety

For California residents, this corresponds to the business and commercial purposes described under the CCPA/CPRA.

5. How we use your information

We use collected information to:

  • Deliver, maintain, and improve the Services
  • Process transactions and provide customer support
  • Communicate with you about your account, service updates, and security notifications
  • Detect, prevent, and respond to security incidents and abuse
  • Comply with legal obligations and enforce our terms
  • Conduct analytics to understand product usage and improve user experience
  • Send marketing communications, where you have opted in and have the right to opt out at any time

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

6. How we share your information

We share information only as necessary and only with parties bound by appropriate confidentiality and data protection obligations:

6.1 Microsoft

As a Marketplace publisher, we receive limited transaction information from Microsoft (customer organisation name, Azure tenant ID, plan purchased, billing geography). This is governed by the Microsoft Publisher Agreement.

6.2 Subprocessors

We engage the following categories of subprocessors:

  • Cloud infrastructure providers (Microsoft Azure, hosting our Services)
  • Customer support and ticketing platforms
  • Analytics and product telemetry providers
  • Email and communication platforms
  • Payment and billing platforms (Microsoft handles Marketplace payments)

A current list of subprocessors is available on request at privacy@weldonweb.co.uk.

6.3 Legal disclosure

We may disclose information when required by law, court order, or governmental request, or where necessary to protect our rights, safety, or property, or that of our users or the public.

6.4 Business transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your data becomes subject to a different privacy policy.

7. International data transfers

We may transfer personal data outside your country of residence, including to the United Kingdom, the European Economic Area, the United States, and other countries where our subprocessors operate.

For transfers from the EEA, UK, or Switzerland, we rely on:

  • Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office
  • Adequacy decisions where they exist
  • UK International Data Transfer Agreement (IDTA) where applicable

We do not transfer personal data to jurisdictions that lack adequate safeguards.

8. Data retention

We retain personal data only as long as necessary for the purposes described in this policy:

  • Account data — for the duration of your subscription plus 7 years after termination, for legal and tax purposes
  • Telemetry and logs — typically 90 days, except security logs which are retained for 12 months
  • Support correspondence — 3 years after case closure
  • Marketing data — until you withdraw consent
  • Audit logs (where required for compliance) — per the retention configured in your deployment, typically 1–7 years

Customer data processed through Managed Applications deployed to your own Azure tenant is retained per your configuration; we do not control its retention.

9. Your rights

Depending on your location, you may have the following rights under GDPR, UK GDPR, CCPA/CPRA, and equivalent legislation:

  • Access — request a copy of personal data we hold about you
  • Rectification — correct inaccurate or incomplete data
  • Erasure — request deletion ("right to be forgotten"), subject to legal retention requirements
  • Restriction — limit how we process your data
  • Portability — receive your data in a structured, machine-readable format
  • Objection — object to processing based on legitimate interests
  • Withdraw consent — where processing is based on consent
  • Non-discrimination (California) — exercise rights without retaliation
  • Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at privacy@weldonweb.co.uk. We respond within 30 days (or one month for GDPR requests), and may require identity verification before fulfilling requests.

10. Security

We implement appropriate technical and organisational measures to protect personal data, including:

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Identity and access management with least-privilege principles
  • Multi-factor authentication for administrative access
  • Regular security assessments and penetration testing
  • Incident response procedures with notification commitments
  • Employee security awareness training
  • Background checks for personnel with access to customer data
  • Compliance with industry standards [SOC 2 Type II / ISO 27001 / HIPAA / OTHER — list only those you actually hold or remove this line]

No system is completely secure. In the event of a personal data breach affecting your information, we will notify you and the relevant supervisory authority within 72 hours where required by law.

11. Cookies and tracking

Our public websites use cookies and similar technologies for:

  • Strictly necessary — site functionality, authentication
  • Analytics — anonymised usage statistics
  • Preferences — remembering your settings

You can manage cookie preferences through your browser settings or our cookie banner. We do not use advertising or tracking cookies for behavioural advertising.

Our deployed software products generally do not use cookies, as they operate as backend services within your Azure tenant.

12. Children's privacy

Our Services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by:

  • Posting the updated policy at this URL with a new "Last updated" date
  • Emailing registered users for significant changes
  • Where required by law, obtaining renewed consent

Continued use of the Services after changes constitutes acceptance.

14. Region-specific provisions

14.1 European Economic Area, United Kingdom, Switzerland

You have rights under the GDPR (Regulation 2016/679), UK GDPR, and the Swiss Federal Act on Data Protection. Data protection matters are handled by the company director at the registered office above.

You have the right to lodge a complaint with:

  • UK: Information Commissioner's Office (ico.org.uk)
  • EU: Your national data protection authority
  • Switzerland: Federal Data Protection and Information Commissioner

14.2 California

California residents have rights under the CCPA/CPRA including the right to know, delete, correct, opt out of "sale" or "sharing" (we do neither), and limit use of sensitive personal information. We do not sell or share personal information as defined under California law.

14.3 Other jurisdictions

We comply with applicable data protection laws in jurisdictions where we operate, including Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act 1988), and Japan (APPI).

15. Data Processing Addendum

Enterprise customers requiring a signed Data Processing Addendum (DPA) for GDPR Article 28 compliance can request one at privacy@weldonweb.co.uk. Our standard DPA incorporates the EU Standard Contractual Clauses and UK International Data Transfer Agreement.

16. Contact us

For privacy questions, requests, or complaints:

Weldon Web LTD Attn: Data Protection Officer Email: privacy@weldonweb.co.uk Postal address: 8 The Dell, Plymouth, England, PL7 4PS

For EU/UK data subjects, you may also contact us directly at jack@weldonweb.co.uk

For security incidents, contact security@weldonweb.co.uk.

This policy is published at https://weldonweb.co.uk/privacy-marketplace and is the canonical version. Translations may be provided for convenience; in case of conflict, the English version prevails.