Geniusin Ltd
Consolidated Privacy Policy
Applies to Geniusin, Facts Disc and Ding Dong.
1. About this Privacy Policy
Geniusin Ltd (“Geniusin”, “we”, “us” or “our”) respects your privacy. This policy explains how we collect, use, share, retain and protect personal information when you visit www.geniusin.com or www.factsdisc.com, contact us, buy or use Facts Disc, enquire about or take part in Ding Dong activities, or deal with us as a business contact.
This policy covers website visitors, customers, account holders, business contacts and, where relevant, people whose information is processed in connection with demonstrations or pilots. Additional notices may be provided for particular projects or processing activities. This policy should be read alongside applicable Terms & Conditions and any relevant pilot or project agreement.
2. Who we are and how to contact us
Geniusin Ltd is registered in England and Wales (company number 07812171) at 22 West Street, Olney, Buckinghamshire, MK46 5HR, United Kingdom.
Privacy enquiries, requests and complaints: DP@geniusin.com. General enquiries: info@geniusin.com.
Geniusin is generally the controller when it decides why and how personal information is processed. For some Ding Dong pilot activities, the participating organisation may be an independent controller and Geniusin may be a separate controller or processor, depending on the agreed arrangements. Any relevant responsibilities should be explained in the pilot documentation.
3. Personal information we collect
3.1 Facts Disc account information
To register a Facts Disc account, you must provide your first name, last name, email address and password. We also process account identifiers, authentication information, registration and account status information, and records of acceptance of relevant Terms & Conditions (including the version and time where recorded). Passwords are handled by the relevant authentication system; you should never send us your password by email.
3.2 Purchases, payments and delivery
When you order from Facts Disc, we process relevant names, contact details, billing and delivery addresses, order history, product and transaction information, payment status, delivery details, returns, refunds and customer- service correspondence. Payment providers may process full card or other payment credentials; the information visible to Geniusin depends on the provider and payment method.
3.3 Facts Disc vehicle profiles
All fields within a Facts Disc vehicle profile are optional. You may choose to add vehicle details, history, descriptions, registration information, images, supporting documents and other material. Such content may include personal information about you or others.
Published vehicle profiles can be viewed by anyone who scans the associated QR code or obtains the profile link. Published information should not be regarded as private or confidential. Other people may view, copy, save or share published material. Account holders should review content before publication and avoid uploading V5C registration certificates, identity documents, financial records, private addresses or other sensitive or confidential information. Information about another person should be published only where there is an appropriate lawful basis or authority to do so. We process profile information to display and administer the service, respond to support requests and arrange authorised transfers.
When a profile is transferred to another account holder, the former account holder loses administrative access, but the profile may remain publicly accessible under the new account holder. A transfer of account control does not necessarily transfer ownership of copyright in uploaded material.
Where published content contains personal information, Geniusin handles it in accordance with this Privacy Policy and applicable data protection law. Individuals may contact DP@geniusin.com to report privacy concerns or request removal of personal information. We assess such requests in accordance with applicable legal rights and obligations. Removal from the live profile may not remove copies independently retained by third parties.
3.4 QR scan activity and website information
Facts Disc can produce scan statistics for selected larger partnerships, events or collaborations upon request. The reports are understood to include scan totals and dates and times. We have not yet verified whether the underlying systems also collect IP addresses, device identifiers or other technical information in connection with scans.
Our websites and service providers may process technical information such as IP address, browser or device information, log records, pages visited, referral information, security events, cookies and similar identifiers, depending on the technologies in use. See section 9.
3.5 Customer service and business enquiries
If you contact us, we may process your name, contact details, the content of your enquiry, attachments, relevant order or account details and our correspondence. Where a person approaches us about a partnership, event, collaboration or other business opportunity, we may also process their job title, employer or organisation, business email and details of the opportunity.
3.6 Ding Dong demonstrations, pilots and evaluations
For Ding Dong, we process professional contact information and communications relating to demonstrations, pilots, delivery and evaluation. We may receive participant observation records without names or direct contact details, covering duration of use, engagement, observed reactions and staff comments, together with an overall evaluation prepared by the participating organisation’s designated contact.
Our standard observation records do not request diagnoses or clinical histories. Nevertheless, comments, identifiers or the circumstances of a small rehabilitation pilot could make a person identifiable or reveal health information. We treat such material as personal data, and special-category data where applicable, unless it has been effectively anonymised so identification is not reasonably possible.
3.7 Sources of information
We usually receive information directly from you. We may also receive information from Shopify and payment or delivery providers, the organisation you represent, the person making an authorised introduction, or a Ding Dong participating organisation. We may receive professional contact details and correspondence when an enquiry is forwarded internally between Facts Disc and Geniusin.
4. How and why we use personal information
The following table summarises the purposes and lawful bases generally applicable to our activities. A particular activity may involve more than one basis, depending on the circumstances.
Our legitimate interests include providing and improving services, keeping our systems secure, responding to enquiries, managing professional relationships, evaluating Ding Dong and informing relevant business contacts about appropriate opportunities. Where we rely on legitimate interests, we consider necessity and the impact on individuals.
We do not rely on an organisation’s pilot agreement alone as a substitute for any lawful basis or additional condition required to process identifiable participant or health-related information.
5. Marketing and professional communications
Facts Disc uses Shopify to administer customer marketing preferences. Customers may choose to subscribe to email marketing through an optional checkbox, and marketing messages provide an unsubscribe facility. We respect unsubscribes and other marketing objections. Order confirmations, account notices and essential service messages are not marketing subscriptions.
Geniusin uses FuseMetrix to manage professional contacts, business enquiries, partnerships and bulk business email campaigns. This may include following up on a relevant opportunity after an earlier enquiry. Ordinary Facts Disc purchasers and profile users are not routinely added to FuseMetrix simply because they buy a product or create an account.
We send marketing emails only where permitted under the Privacy and Electronic Communications Regulations and applicable data protection law. Marketing to corporate subscribers may be permitted without prior consent; marketing to individual subscribers, including sole traders and some partnerships, generally requires consent or an applicable exception. Where the existing-customer soft opt-in is used, all relevant conditions must be met.
You can object to direct marketing at any time by using the unsubscribe link where available, replying to a business marketing email requesting no further contact, or contacting DP@geniusin.com. We record suppression preferences as necessary to prevent further marketing. An opt-out must be respected across relevant systems when the same contact is present in more than one.
6. Who we share information with
We do not sell customer lists or routinely disclose customer or business contact databases to other organisations for their independent marketing. Where a business introduction requires sharing someone’s details, we agree the introduction with the person concerned beforehand.
We may share information as necessary with Shopify (ecommerce and customer management), FuseMetrix (business CRM and email campaigns), payment processors, delivery and postal providers, website hosting and technical providers, professional advisers, and other service providers supporting our operations. Providers may act as processors or independent controllers depending on the service. Where legally required, we put appropriate data-processing arrangements in place.
For Ding Dong, we may exchange administrative details, observation records and evaluation findings with participating organisations under the relevant pilot arrangements. We aim to use non-identifying findings in commercial case studies and presentations. We may also disclose information where required by law or reasonably necessary for legal claims, or in connection with a lawful business reorganisation subject to appropriate safeguards.
7. How long we keep information
We retain personal information for no longer than reasonably necessary for the purposes described in this policy, taking account of legal obligations, contractual needs, security, dispute resolution and the nature of the information. We review information that is no longer needed.
7.1 Facts Disc accounts and profiles
Account closure and deletion requests are handled manually. When an account is closed, associated active vehicle profiles are removed from public access, except profiles already transferred to another account holder. We delete or anonymise personal information where appropriate, while retaining records that we are legally required or otherwise permitted to keep. Removed information may remain temporarily in backups pending their normal deletion cycle.
7.2 Orders, support and CRM records
Historical orders are stored in Shopify. Transaction and accounting records are retained according to applicable tax, accounting and legal requirements; the existence of a historical Shopify record does not itself justify keeping it indefinitely. Support and business correspondence, including FuseMetrix records, are retained for as long as relevant to the relationship, enquiry, follow-up, dispute or legal requirement, with periodic review. Marketing suppression information may be retained as necessary to honour objections.
7.3 Ding Dong findings
Pilot observations and findings are collected for product evaluation, improvement and potential future commercial case studies, as described in the relevant pilot agreement. Genuinely anonymised findings may be used for ongoing research, product development and commercial purposes. Any identifiable records are retained only for as long as necessary under appropriate criteria and safeguards; the agreement does not by itself justify indefinite retention of personal data.
8. International processing and transfers
We are based in the United Kingdom. Some technology providers may store, access or otherwise process personal information outside the UK. Where a restricted international transfer occurs, we use a lawful transfer mechanism, such as applicable adequacy regulations, approved contractual safeguards or another permitted mechanism, and conduct any assessment required by law. You may contact DP@geniusin.com for information about applicable safeguards and how to obtain a copy where available.
9. Cookies and similar technologies
Our websites may use essential cookies and other technologies for operation and security and, depending on settings, optional analytics, preference or marketing technologies. Where the law requires consent, we seek it before using the relevant technology. Visitors can manage preferences through available controls; settings may be separate for geniusin.com and factsdisc.com.
Further information is available in our separate Cookie Policy at https://www.geniusin.com/cookie-policy/. Facts Disc also provides website cookie information and controls through its Shopify customer privacy arrangements. The detailed cookie inventory and the operation of consent controls must be verified before this section is published.
10. Keeping information secure
We use appropriate technical and organisational safeguards having regard to the information and risks involved. Access to business systems is limited to authorised personnel, and team members use individual login credentials. We use third-party service providers for certain operations and assess relevant safeguards as appropriate. No electronic system can be guaranteed completely secure. We assess and respond to personal data breaches and make notifications where legally required.
11. Your data protection rights
Subject to the relevant legal conditions and exemptions, you may have rights to access your personal information, have inaccurate information corrected, request erasure, restrict processing, receive certain information in a portable format, object to certain processing, and withdraw consent where consent is the lawful basis. Applicable protections also exist in relation to certain significant decisions made solely by automated processing.
You have an unconditional right to object to the use of your personal information for direct marketing. If you object, we will stop processing your information for that purpose.
Send requests to DP@geniusin.com or write to the address in section 2. We may ask for proportionate evidence of identity or authority where necessary. We respond within the applicable legal deadlines, generally one calendar month for rights requests, subject to lawful extensions or exceptions. We do not normally charge a fee, although the law permits fees in limited circumstances.
12. Data protection complaints
If you are concerned about how we handle personal information, please email DP@geniusin.com or write to the address in section 2. We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate and communicate the outcome without undue delay.
You may also complain to the UK Information Commissioner’s Office (ICO) at https://ico.org.uk/. Where EU data protection law applies, you may have a right to complain to a competent EEA supervisory authority.
13. Children
Our websites, Facts Disc accounts and Ding Dong commercial activities are primarily intended for adults and are not specifically directed at children. We do not knowingly seek personal information directly from children through our account-registration processes. If a supervised activity involves a child, the relevant parties must assess and implement the additional safeguards required by law. We will address any inappropriate collection of a child’s personal information, including deletion where required.
14. Changes to this policy
We may update this policy to reflect changes to our business, technology or legal requirements. The latest version will be available on our websites with its publication or effective date. Where material changes require additional notice or consent, we will take the steps required by law.