1. Who we are
Eselram is business software supplied by Marlese Rosch Haden trading as Eselram. For personal information Eselram uses for its own business purposes, Marlese Rosch Haden trading as Eselram is the controller.
Privacy contact: [email protected]. A UK correspondence/service address must be made available to individuals and on applicable business documents; until a public correspondence address is published, it can be requested using the privacy contact above.
2. Scope and roles
This notice explains how Eselram handles personal information for its own business purposes and in providing the Eselram service. For information about a customer's own clients, staff or prospective clients, the Eselram customer will normally decide why and how that information is used and will therefore normally be the controller. Where Eselram processes that information only on the customer's instructions, Eselram acts as processor under the Data Processing Agreement.
3. Information Eselram uses as controller
Depending on the relationship and features used, this may include:
- name, business name, email address and other business contact information;
- account, licence, installation, subscription and billing information;
- payment and transaction references (payment-card details are handled by the relevant payment provider rather than stored by Eselram where Stripe-hosted checkout is used);
- support communications and information supplied when asking for help;
- service configuration, version, operational, security and diagnostic information;
- OAuth connection identifiers and authorisation information needed to maintain integrations; and
- records needed for accounting, fraud prevention, dispute handling and legal compliance.
4. Purposes and lawful bases
Eselram uses personal information only where it has an appropriate lawful basis. The main purposes and bases are:
- Providing subscriptions, licences, purchases and requested support: contract, or steps requested before entering a contract.
- Operating, securing and improving reliability of Eselram: legitimate interests in providing a secure, dependable business service, including preventing misuse and diagnosing faults, balanced against individuals' rights.
- Billing, tax, accounting and legal records: legal obligation where applicable and legitimate interests in maintaining appropriate business records and resolving disputes.
- Service and security communications: contract where necessary to provide the service, or legitimate interests in administering and protecting the service.
- Optional communications that legally require consent: consent, which can be withdrawn at any time without affecting processing already carried out lawfully.
Eselram does not use consent where another lawful basis is more appropriate merely because information appears in a contract or account.
5. Customer-controlled operational data
Depending on enabled features, customer-controlled data may include client names and contact details, bookings, communications, payment records, forms, signatures, photographs, treatment records and clinical information. Eselram does not acquire ownership of that data. The customer is responsible for its own privacy information, lawful bases, retention choices, permissions and regulatory obligations as controller.
6. Special-category information
Optional treatment features may contain health information or other special-category personal information. The customer, as controller, is responsible for identifying and documenting both an Article 6 lawful basis and an appropriate special-category condition, and for deciding whether a data protection impact assessment or additional safeguards are required. Where Eselram acts as processor, it processes that information only on documented instructions and under the DPA.
7. Google and Gmail
If a customer connects Gmail, Eselram requests the permission needed to send email on the user's behalf (gmail.send). This feature does not require permission to read the user's Gmail inbox.
- Authorisation information is used to establish and maintain the requested connection.
- Outbound content is processed to send messages configured by the customer.
- Eselram does not sell Google user data or use it for advertising or unrelated profiling.
8. Recipients and integrations
Eselram does not sell personal information. Information may be shared where necessary with infrastructure, payment, email, security and professional service providers; with authorities where required by law; or in connection with establishing, exercising or defending legal claims. Cloudflare, Stripe, Google/Gmail and supported email services may be involved depending on configuration. The Subprocessors & Integrations Notice explains their current roles in more detail.
9. Support access
Eselram does not routinely access customer client data for support. Where access is needed to investigate a support issue, Eselram will normally seek the customer's authorisation and limit access to what is reasonably necessary. This does not prevent proportionate access or preservation required for security, incident response or a legal obligation.
10. International transfers
Some providers may process information outside the UK. Where Eselram initiates a restricted transfer for which it is responsible, Eselram will use an applicable UK adequacy regulation, the UK International Data Transfer Agreement or UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism as appropriate. Information about relevant provider arrangements can be requested from the privacy contact. Customers remain responsible for transfer arrangements arising from third-party accounts they independently select and control.
11. Retention
Eselram keeps personal information only for as long as needed for the purpose for which it is used, taking account of legal, accounting, security and dispute requirements. In particular:
- Customer-controlled data processed on behalf of a customer: for the subscription and the 30-day export/recovery period where applicable, then deleted or returned in accordance with the DPA, unless law requires retention or the data remains solely in customer-controlled infrastructure.
- Account and licence records: for the active relationship and a reasonable period afterwards where needed for security, support, dispute prevention and legal records.
- Billing and accounting records: retained for the period required by applicable tax and accounting law.
- Support and security records: retained according to the nature of the issue and only as long as reasonably needed for support, security, claims or legal obligations.
Where a fixed period is not stated, Eselram applies these criteria rather than retaining information indefinitely.
12. Security
Eselram uses technical and organisational measures designed to protect personal information proportionate to the risk, including access controls, encrypted connections and separation of customer environments where supported by the architecture. No internet service can guarantee absolute security. Customers remain responsible for their own users, devices, credentials, Cloudflare environment and connected third-party accounts.
13. Your rights
Where Eselram is controller, individuals may have rights under UK data-protection law including access, rectification, erasure, restriction, objection and portability, depending on the circumstances and lawful basis. Where processing is based on consent, consent may be withdrawn. Individuals also have the right to object to direct marketing at any time.
Requests can be sent to [email protected]. Eselram will normally respond within one month, subject to the rules that permit an extension in some circumstances. If a request concerns information controlled by an Eselram customer, the requester should normally contact that business directly.
14. Complaints
Privacy concerns can be sent to [email protected]. Individuals also have the right to complain to the Information Commissioner's Office (ICO), the UK data-protection regulator. ICO information and complaint routes are available at ico.org.uk/make-a-complaint, and its helpline is 0303 123 1113.
15. Cookies and similar technologies
At the effective date of this notice, the public Eselram website does not intentionally deploy advertising or analytics cookies. Strictly necessary technologies may be used where required to provide security, checkout or requested functionality. If Eselram later introduces non-essential cookies or similar technologies, the website will provide appropriate information and obtain consent where required before they are used.
16. Children
Eselram is supplied to businesses and the Eselram website and subscription service are not directed to children. A customer that records information about minors using its own Eselram installation is responsible for ensuring that processing is lawful, transparent and appropriately safeguarded.
17. Changes
Eselram may update this notice to reflect changes to the service, law or providers. The current version will be published here with its effective date. Material changes will be highlighted or communicated where appropriate.
18. Contact
Controller: Marlese Rosch Haden trading as Eselram
Email: [email protected]