Our Privacy Policy
Last updated: 26 October 2026
CrowdHandler Ltd respects the privacy of everyone who uses our website and our virtual waiting room service. This policy explains what personal data We collect, why We collect it, who We share it with, and what rights you have.
1. Who We Are
Our website at www.crowdhandler.com ("Our Site") and the CrowdHandler application at signup.crowdhandler.com, admin.crowdhandler.com and wait.crowdhandler.com, together with its API ("the Application"), are owned and operated by CROWDHANDLER LTD. CrowdHandler Ltd is a limited company registered in England under company number 12677268. Its registered office is at Windsor House, Bayshill Road, Cheltenham, Gloucestershire, GL50 3AT, United Kingdom. In this policy, "We", "Us" and "Our" mean CrowdHandler Ltd.
For the personal data described in this policy, We are the controller under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. Where We process the personal data of individuals in the European Economic Area, the EU General Data Protection Regulation ("EU GDPR") also applies. In this policy, "Data Protection Legislation" means all of these laws.
You can contact Us about anything in this policy at support@crowdhandler.com.
2. What This Policy Covers
This policy covers personal data that We collect and use for Our own purposes. This includes data about:
- visitors to Our Site;
- Our customers and their users who sign up for and use the Application, including the control panel and API; and
- people who contact Us, book a demo, or receive Our marketing.
Waiting rooms on Our customers' websites. When you queue in a CrowdHandler waiting room for another organisation's website, We process your data (such as your IP address, browser details and queue position) on behalf of that organisation and under its instructions. That organisation is the controller of your data, and its own privacy policy explains how your data is used. Please contact that organisation about your data. We help Our customers respond to any requests they receive.
The one exception is the optional notification email. If you give your email address in a waiting room so that We can tell you when it is your turn, We are the controller of that email address. Sections 3 to 9 explain how We handle it.
Our Site contains links to other websites, and it includes content from third parties such as embedded YouTube videos. We do not control how those parties collect or use data. Please check their privacy policies.
3. What Personal Data We Collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact information | Name, business email address, telephone number | You, when you sign up, add users, contact Us or book a demo |
| Business information | Company name, billing address, plan details | You, at sign-up and through the control panel |
| Account information | Login credentials, user roles, control panel settings | You, when you create or manage a user account |
| Payment information | Card details and cardholder name | You, entered directly into Our payment provider, Stripe. We do not see or store your full card details. |
| Technical information | IP address, browser type and version, operating system, language preference, logs of control panel and API activity | Collected automatically when you use Our Site or the Application |
| Waiting room notification email | Email address | You, if you ask to be notified in a waiting room |
| Website usage and advertising data | Pages viewed, interactions, and identifiers set by Cookies and similar technologies | Collected through Cookies with your consent (see section 6) and from Our advertising partners |
| Correspondence | Support tickets, emails, and notes of calls and demos | You, when you contact Us |
We do not collect special category personal data, or data relating to criminal convictions. Our Site and the Application are not directed at children.
4. How We Use Your Personal Data
We must have a lawful basis for each use of your personal data.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Setting up and running your account, and providing the Application | Contact, business, account and technical information | Contract |
| Billing and taking payment | Contact, business and payment information | Contract |
| Keeping records for tax and accounting purposes | Business and payment information | Legal obligation |
| Providing customer support | Contact information and correspondence | Contract, and Our legitimate interest in supporting Our customers |
| Securing the Application and preventing fraud and abuse, including checking IP addresses against threat-intelligence databases | Technical information | Legitimate interests (keeping Our service secure and fair) |
| Sending the waiting room notification you asked for | Waiting room notification email | Legitimate interests (providing the notification you requested) |
| Sending marketing emails about CrowdHandler to customers and prospects (see section 5) | Contact and business information | Legitimate interests |
| Website analytics, and advertising and re-marketing through Cookies | Website usage and advertising data | Consent |
| Improving Our Site and the Application | Technical information and website usage data | Legitimate interests, or consent where Cookies are involved |
| Complying with the law, responding to legal requests, and establishing or defending legal claims | Any relevant data | Legal obligation, and legitimate interests |
Where We rely on legitimate interests, We have balanced Our interests against your rights. You can object at any time (see section 10).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Marketing
We send emails about CrowdHandler products, features and events to Our customers and to business contacts who have shown an interest in Our service. Every marketing email contains an unsubscribe link, and you can opt out at any time. Opting out of marketing does not affect service emails about your account.
We do not sell your personal data, and We do not share it with third parties for their own marketing.
6. Cookies
Our Site uses Cookies and similar technologies. Necessary Cookies are always active. Preferences, Statistics and Marketing Cookies are set only if you consent through Our cookie banner. You can change your choices at any time. Marketing Cookies allow advertising platforms, including Google, LinkedIn, Meta, X and Reddit, to collect data about your visit. Those platforms use the data under their own privacy policies.
For full details, see Our Cookie Policy.
7. Who We Share Your Personal Data With
We share personal data only as described here.
Service providers. We use the following providers to run Our business. They process personal data on Our behalf and under contract with Us.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, networking and control panel sign-in (AWS Cognito) | USA (Ohio, with failover in Virginia) |
| Stripe | Payment processing | USA |
| Google Workspace | USA | |
| MailChimp | Marketing email | USA |
| Mandrill | Transactional email, including waiting room notifications | USA |
| FreshDesk | Customer support | EU |
| Capsule | Customer relationship management | USA |
| Zoom | Demo scheduling | USA |
| Xero | Accounting and invoicing | USA |
| ipdata | IP threat intelligence | USA |
| Hotjar | Website analytics (only with your consent) | EU |
Our group. We may share personal data with Made Media Holdings Ltd, Our parent company, and with its subsidiaries for administration and to fulfil Our contracts.
Business transfers. If We sell, transfer or merge all or part of Our business, personal data may be transferred to the new owner. The new owner may continue to use it as described in this policy.
Legal requirements. We may disclose personal data where the law requires it, to comply with a court order or a request from a public authority, or to establish or defend legal claims.
8. International Transfers
Much of Our infrastructure, and several of Our service providers, are based in the United States. Where We transfer personal data outside the UK or EEA, We protect it in one of these ways:
- by transferring it to a country covered by UK or EU adequacy regulations, including US organisations certified under the EU-US Data Privacy Framework and its UK Extension; or
- by using the European Commission's Standard Contractual Clauses together with the UK Addendum, or the UK International Data Transfer Agreement.
You can contact Us for more information about the safeguards for a particular transfer.
9. How Long We Keep Your Personal Data
| Data | Retention |
|---|---|
| Contact information | Until the account or user is deleted |
| Account information | Up to one month after the user account is deleted |
| Business and billing information | Up to six years after the account was last used, to meet legal and tax obligations |
| Payment information (held by Stripe) | Until you delete the payment method, or 30 days after it expires |
| Technical information | Up to 30 days |
| Waiting room notification email | Up to 30 days |
| Marketing contacts | Until you unsubscribe, after which We keep a suppression record so that We do not contact you again |
| Correspondence | For as long as needed to deal with your query, and for the life of the customer relationship |
10. Security
We limit access to personal data to people and providers who need it, and they are bound by confidentiality. We encrypt data in transit, and We have procedures for handling data breaches. These include notifying you and the Information Commissioner's Office ("ICO") where the law requires it.
11. Your Rights
Under Data Protection Legislation, you have the right to:
- be informed about how We use your personal data (this policy);
- access your personal data;
- have inaccurate or incomplete data corrected;
- have your data deleted;
- restrict how We use your data;
- object to Our use of your data where We rely on legitimate interests, and to direct marketing at any time;
- withdraw your consent at any time, where We rely on consent; and
- data portability, where We process data you have given Us by automated means on the basis of contract or consent.
To exercise any of these rights, email support@crowdhandler.com. We may need to verify your identity before We act on your request. We will respond within one month. For complex or numerous requests, We may extend this by up to two further months, and We will tell you if We do. We do not normally charge a fee. However, We may charge a reasonable fee, or refuse the request, if it is manifestly unfounded or excessive.
12. Complaints
If you have a concern about how We use your personal data, please contact Us first at support@crowdhandler.com so that We can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ico.org.uk). If you are in the EEA, you can complain to the data protection authority in your country.
13. Changes to This Policy
We may update this policy, for example when We change Our services or Our providers, or when the law changes. We will post any changes on this page and update the date at the top.
14. Contact Us
- Email: support@crowdhandler.com
- Registered office: CrowdHandler Ltd, Windsor House, Bayshill Road, Cheltenham, Gloucestershire, GL50 3AT, United Kingdom
Related policies: