How CITSYS LIMITED uses personal data: visitors, people who sign up, users of Composure247 and customer contacts.
1.1 Who we are. Composure247 is software provided by CITSYS LIMITED, a company registered in England and Wales with company number 07254892, whose registered office is at 248 Church Lane, Kingsbury, London, NW9 8SL ("we", "us"). We are registered with the Information Commissioner's Office as a data controller, registration number ZC283741.
1.2 What this notice covers. It explains how we use personal data when we decide how and why it is used. That is, we are the controller. It covers:
1.3 What it doesn't cover. Our customers are managed service providers. They use Composure247 to hold details of their own customers and to send them incident updates. For that data, our customer is the controller and we only process it on their instructions, under our Data Processing Agreement. If you received an incident update from a service provider through Composure247, that provider's privacy notice applies, and they are the right people to contact about your data.
1.4 Contact. Email legal@composure247.com about anything in this notice, or write to us at the address above.
2.1 When you sign up for a trial: your first and last name, work email address, company name, country and, if you give it, your company's size. We record which versions of our Terms of Service and Data Processing Agreement you accepted, and when.
2.2 When you use Composure247: your name, work email address, mobile number if you add one, your role and permissions, your sign-in details (your password is stored only in scrambled, hashed form), your second sign-in step settings, and single sign-on identifiers if your organisation uses Microsoft Entra ID. We also keep records of what happens in your account, such as sign-ins, changes to settings and messages sent, with the time and IP address.
2.3 Technical data: the IP address and browser details sent with every web request. If the app hits an error in your browser, it sends us a short error report so we can fix it. On our website we count visits using Vercel Web Analytics, which records the page you visited, the page or site that sent you, your country, and your browser, operating system and device type (section 7.4).
2.4 To protect the sign-up page from abuse: a one-way scrambled (hashed) version of your IP address, so we can limit how many sign-ups come from one place, and the result of the "not a robot" check run by Cloudflare.
2.5 When you contact us: what you tell us, and your contact details.
2.6 Billing: the name and contact details of the person who handles your account, and billing and payment records. If you pay by card, our payment provider Stripe takes and keeps your card details: we never see or store them. We keep the plan you chose, your invoices, your billing address and any VAT number you give us.
2.7 When you message our WhatsApp number: your phone number, what you send and when. If you reply STOP, we record it and switch off WhatsApp messages to your number for every one of our customers who holds it. If we can tell which of our customers your message was for, we pass it to that customer only, and section 1.3 applies to it. If we can't, only our staff can see it. We delete the message after 90 days (section 6).
2.8 Where it comes from. Mostly from you. Some comes from your employer, when an administrator invites you to Composure247 or connects Microsoft Entra ID to add users automatically.
| What we use it for | Lawful basis under UK GDPR |
|---|---|
| Creating your trial or account, letting you sign in, and providing Composure247 | Contract: it is needed to provide the service your organisation signed up for. Where you use it on your employer's behalf, our legitimate interest in providing the service they asked for. |
| Recording which terms were accepted, and keeping account and billing records | Legal obligation, and our legitimate interest in being able to show what was agreed |
| Taking payment for a subscription or message credits, charging VAT, and dealing with failed payments, refunds and disputes | Contract, and legal obligation (tax and accounting records) |
| Keeping the service secure: second sign-in step, sign-in records, audit records, rate limits, the "not a robot" check | Legitimate interests: protecting our customers, their data and the service |
| Sending service messages, such as password resets, security alerts, and notice of changes to our terms or sub-processors | Contract and legitimate interests. You can't opt out of these while you have an account, because they are part of running it. |
| Answering your questions and providing support | Legitimate interests |
| Fixing faults and improving the service, using error reports and records of how features are used | Legitimate interests |
| Acting on a STOP reply to our WhatsApp number, and passing other messages to the customer they were for, with an answer pointing you to them | Legitimate interests: respecting your choice to stop messages, and getting your message to the right people |
| Counting visits to our website, to understand which pages people use | Legitimate interests. No cookies are used and you aren't identified (section 7.4). |
| Telling you about new features or offers by email | Legitimate interests, for business contacts as UK law allows. Every such email has an unsubscribe link, and we stop when you ask. |
| Naming your organisation as a customer | Our Terms of Service, which let your organisation opt out at any time |
3.2 AI. Composure247 uses AI to draft incident updates from what our customers enter. We don't use AI to make decisions about you that have legal or similarly significant effects, and we don't use your data to train AI models.
4.1 Our suppliers. We use these companies to run Composure247 and our website. Each handles personal data only on our instructions, under a contract that protects it:
| Supplier | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in and server functions | UK (London) |
| Vercel | Hosts the web application and our website, and counts website visits | Global edge network |
| Resend | Sends emails | EU (Ireland) |
| Twilio | Sends texts and WhatsApp messages, and receives messages sent to our WhatsApp number | United States |
| Meta | Carries WhatsApp messages, through Twilio | Global (Meta data centres, including the United States) |
| Anthropic | AI drafting of incident updates | United States |
| Cloudflare | The "not a robot" check on the sign-up page | Global |
| Microsoft | Single sign-on and user provisioning, only if your organisation connects Microsoft Entra ID | Your organisation's Microsoft tenant |
| Formspree | Receives the contact form on our website and passes it to us | United States |
| Stripe | Takes card payments for subscriptions and message credits, and keeps card details, invoices and billing records | United States, and other countries where Stripe operates |
Stripe also uses payment data as a controller in its own right, for example to prevent fraud and to meet financial regulation. Its privacy notice is at stripe.com/privacy.
The current list is at composure247.com/subprocessors.
4.2 Your organisation. Administrators at your organisation can see the users in their account and the account's activity records.
4.3 Professional advisers, such as our accountants and lawyers, where they need it.
4.4 If the law requires it, for example to the police or a regulator.
4.5 If our business is sold, to the buyer, who must keep using your data in line with this notice.
4.6 We never sell your personal data.
5.1 We store your data in the UK (London). Some of our suppliers process it outside the UK:
5.2 When data goes to the United States or elsewhere outside the UK without a UK adequacy finding, we rely on the safeguards UK law requires: the UK Extension to the EU–US Data Privacy Framework where the supplier is certified, or otherwise the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details at legal@composure247.com.
| Data | How long |
|---|---|
| Sign-up requests that were never completed | 30 days |
| Records used to limit sign-up abuse (hashed IP addresses) | 30 days |
| Your account details | While your organisation's account is open, then deleted within 90 days of it ending (30 days to export, then deletion), as in our Terms of Service |
| Records of which terms were accepted | For as long as the agreement lasts, plus 6 years, in case of a legal claim |
| Billing and accounting records | 6 years after the end of the financial year they relate to, as UK tax law requires |
| Emails and support conversations with us | 2 years after the conversation ends, unless they relate to a dispute |
| Error reports from the app | 90 days |
| Messages sent to our WhatsApp number | 90 days |
| Backups | Copies in our daily backups are deleted within 7 days of the original |
| Data sent to our AI supplier | Deleted by the supplier within 30 days |
7.1 The Composure247 app (app.composure247.com) doesn't use advertising or analytics cookies, and doesn't track you across other websites. It stores a small amount of information in your browser that it needs to work:
These are strictly necessary, so they don't need your consent. Clearing your browser's site data signs you out and resets them.
7.2 The sign-up page runs Cloudflare's "not a robot" check, which reads signals from your browser to tell people from bots. It is used only for that.
7.3 Our fonts are served from our own site, so loading a page doesn't contact a third party for them.
7.4 Our website (www.composure247.com) uses no cookies, and loads no scripts, fonts or other content from third parties. It counts visits using Vercel Web Analytics, served from our own site. It records the page you visited, the page or site that sent you, your country, and your browser, operating system and device type. It doesn't use cookies or keep your IP address: it recognises repeat visits on the same day by a code made from your request, which is reset every 24 hours, so you can't be followed from one day to the next or across other websites. The website also remembers whether you chose light or dark mode, in your browser. If you fill in our contact form, what you enter is sent to Formspree, which passes it to us (section 4).
7.5 The Composure247 iPhone app contains no analytics, crash reporting, advertising or tracking code. It keeps a little data on your phone:
All of it is cleared when you sign out. One screen lets you answer by voice: the microphone is on only while you hold the button, and speech is turned into text on the phone itself.
We protect your data with:
Our security overview at composure247.com/security gives more detail. If you think your account has been compromised, email security@composure247.com straight away.
9.1 Under UK data protection law you have the right to:
9.2 How to ask. Email legal@composure247.com. We will answer within one month, and it is free. We may need to confirm who you are first.
9.3 If your data came to us through a service provider. For data held in Composure247 on behalf of one of our customers (section 1.3), contact that customer. If you contact us instead, we will pass your request to them.
9.4 Complaints. If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
We will update this notice when how we use personal data changes, and change the date below. If a change matters to you, we will tell account administrators by email or in the app. Earlier versions are kept at composure247.com/legal.
---
Version 1.4, 30 October 2026. Composure247 is software provided by CITSYS LIMITED. Changes from version 1.3: card payments through Stripe (sections 2.6, 3, 4.1 and 5.1). Changes in version 1.3: messages to our WhatsApp number (sections 1.2, 2.7, 3, 4.1, 5.1 and 6). Changes in version 1.2: our ICO registration number (section 1.1). Changes in version 1.1: website visit counting (sections 2.3, 3, 4.1 and 7.4); the website's free trial form became a link to the sign-up page, so Formspree receives only the contact form.
Composure247