Scarecrow Systems Privacy Policy

1. Our Role

There are two different circumstances in which Scarecrow may process personal data.

1.1 Data we process for our own purposes

When you create a Scarecrow account, subscribe to Scarecrow, contact us, request support, communicate with us, make payments or use our website, Merch Cast Ltd is generally the data controller. We determine why and how this information is processed.

1.2 Data entered into Scarecrow by our customers

Scarecrow allows businesses to store information about their own customers, employees, suppliers and contacts. In these circumstances, the Scarecrow customer will generally be the data controller, while Scarecrow acts as a data processor processing the information on the customer's behalf. The processing of this information is governed by our Data Processing Agreement (DPA).

2. Information We Collect

Depending on how you use Scarecrow, we may collect and process the following information.

Account information

• Name;
• Business name;
• Business address;
• Email address;
• Telephone number;
• Login information;
• User role;
• Account preferences;
• Subscription information.

Billing information

Payment transactions are processed through Stripe. We may receive information relating to your subscription, payment status and transaction, but payment card details are processed by Stripe rather than being stored directly by Scarecrow.

Support information

• Your name;
• Email address;
• Account information;
• Information contained within your support request;
• Technical information necessary to investigate an issue.

Where necessary to provide support, we may access information within your Scarecrow account.

Technical information

• IP address;
• Browser information;
• Device information;
• Login information;
• Access logs;
• Security and diagnostic information;
• Information about how the Service is accessed.

3. Information You Enter Into Scarecrow

Scarecrow allows customers to enter and store business information, including information relating to their own customers.

• Names;
• Email addresses;
• Telephone numbers;
• Addresses;
• Company information;
• Order information;
• Quote information;
• Job information;
• Product information;
• Artwork and files;
• Other information entered by the customer.

Where Scarecrow processes this information on behalf of a business customer, that customer remains responsible for determining the lawful basis for processing the information and complying with applicable data-protection legislation. Our role in relation to this information is generally that of data processor. Further information is contained in our DPA.

4. How We Use Personal Information

Where Merch Cast Ltd acts as the data controller, we may use personal information to:

• Provide Scarecrow;
• Create and administer accounts;
• Process subscriptions and payments;
• Provide customer support;
• Communicate with customers;
• Send service-related communications;
• Maintain and secure the platform;
• Monitor access and security;
• Investigate technical problems;
• Prevent fraud and misuse;
• Improve Scarecrow;
• Develop new features;
• Manage our business;
• Comply with legal and regulatory obligations;
• Establish, exercise or defend legal claims.

We may also use information to send relevant marketing communications about Scarecrow where permitted by law. You can unsubscribe from marketing communications at any time.

5. Legal Bases for Processing

Where required by applicable data-protection legislation, we rely on one or more of the following legal bases:

Contract

Where processing is necessary to provide Scarecrow or fulfil our agreement with you.

Legitimate interests

Where processing is necessary for legitimate business purposes, such as operating and improving Scarecrow, providing support, securing our systems, preventing fraud, managing customer relationships and protecting our business. Where we rely on legitimate interests, we consider the impact on individuals and seek to ensure that those interests do not override their rights.

Legal obligation

Where processing is necessary for us to comply with a legal or regulatory obligation.

Consent

Where we specifically request consent, we will process information in accordance with that consent. You may withdraw consent where processing is based on consent.

6. Third-Party Service Providers

We use third-party providers to help operate Scarecrow. These providers may process personal information on our behalf.

• Stripe — subscription billing and payment processing;
• Vercel — hosting and infrastructure;
• Supabase — database, authentication and backend infrastructure;
• Google — where customers choose to connect Google services;
• Dropbox — where customers choose to connect Dropbox;
• Email service providers — for sending transactional and service communications;
• Supplier APIs — where customers choose to connect supplier services.

The specific providers used by Scarecrow may change as the platform develops. We seek to use appropriate providers and require appropriate contractual protections where required.

7. Third-Party Integrations

Scarecrow may allow you to connect third-party services such as Google, Dropbox, Xero, Stripe, supplier systems and other services.

When you choose to connect a third-party service, information may be exchanged between Scarecrow and that service as necessary to provide the integration. Your use of the third-party service is also subject to that provider's own privacy policy and terms.

You can disconnect supported integrations through Scarecrow where the relevant functionality allows this. We are not responsible for the privacy practices of third-party services.

8. Cookies

Scarecrow does not currently use non-essential advertising or analytics cookies.

The platform may use essential technical mechanisms necessary for functions such as authentication, login sessions, security, maintaining your session and providing the Service.

We may introduce additional cookies or analytics technologies in the future. Where required, appropriate information and consent mechanisms will be provided.

9. Marketing

We may contact existing customers about Scarecrow updates, new features, new services, relevant offers and product announcements.

You can opt out of marketing communications at any time by using the unsubscribe mechanism provided or contacting us. Service and transactional communications, such as account, billing and security messages, may still be sent where necessary.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Scarecrow customer account data is generally retained for up to 90 days following the end of a customer's subscription, after which it may be permanently deleted. This 90-day period is intended to provide customers with an opportunity to retrieve information following cancellation.

You remain responsible for maintaining your own independent backups. Certain information may be retained for longer where necessary for accounting, tax purposes, legal obligations, fraud prevention, dispute resolution, establishing or defending legal claims or other legitimate business purposes.

11. Data Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

• HTTPS-secured connections;
• Role-based access controls;
• Access logging;
• Backups and infrastructure protections;
• Regular software updates;
• Access restrictions for administrative systems;
• Appropriate controls around third-party service providers.

Scarecrow is continually developed and security measures may change over time. No internet-based system can be guaranteed to be completely secure. You are also responsible for maintaining the security of your own account, passwords, devices and users.

12. Your Responsibilities

If you use Scarecrow to process personal information relating to your customers or other individuals, you are responsible for:

• Having an appropriate lawful basis for processing;
• Providing appropriate privacy information to individuals;
• Ensuring that information entered into Scarecrow is accurate;
• Responding to data-subject requests where appropriate;
• Configuring your Scarecrow account appropriately;
• Maintaining appropriate user access controls;
• Maintaining appropriate backups;
• Complying with applicable data-protection legislation.

13. International Transfers

Some of our service providers may process or store information outside the United Kingdom.

Where personal information is transferred internationally, we will seek to ensure that appropriate safeguards are in place in accordance with applicable data-protection law. These safeguards may include adequacy regulations, approved contractual safeguards or other lawful transfer mechanisms.

Because our infrastructure and service providers may change over time, the location of processing may also change.

14. Your Data Protection Rights

Depending on the circumstances and applicable law, you may have rights including:

• The right to access your personal information;
• The right to correct inaccurate information;
• The right to request deletion;
• The right to restrict processing;
• The right to object to processing;
• The right to data portability;
• The right to withdraw consent where processing is based on consent.

You can exercise applicable rights by contacting: paul@merchcast.co.uk.

We may need to verify your identity before responding to a request. Where Scarecrow is acting as a data processor for one of our business customers, you should normally direct your request to that business in the first instance. We will provide reasonable assistance to our customer where required under our DPA.

15. Complaints

If you have concerns about how we have handled your personal information, please contact us first at: paul@merchcast.co.uk.

You also have the right to complain to the Information Commissioner's Office (ICO) where you believe your data-protection rights have been infringed.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to Scarecrow, our services, our technology, our suppliers, data-protection requirements and our business practices.

The latest version will be published on the Scarecrow website.

17. Contact

For privacy or data-protection enquiries: Merch Cast Ltd t/a Scarecrow Systems, Britannia Works, Magdalene Road, Torquay, Devon, TQ1 4AF, United Kingdom.

Email: paul@merchcast.co.uk

Company number: 16949588