Legal
Everything below is current as of 30 July 2026 (version 2026-06). Where a document is accepted inside Chartping, we record which version you accepted and when, and you can re-read it at any time from Settings → Legal.
Published documents
The contract between you and TrendSoft Ltd for using Chartping.
Published here, and accepted in the app before you can use it.
What personal data we handle, why, who receives it, and your rights.
Published here, and accepted in the app before you can use it.
What Chartping does not do, and the risks of relying on any monitoring tool.
Published here, and acknowledged in the app before you can use it.
Every cookie and stored item, why it is set, and the switches that control measurement.
Published here. The measurement switches on that page work immediately.
The terms for SMS alerts: what we send, how often, and how to stop.
Published here, and shown when you enable SMS alerts.
The Article 28 terms for Developers whose products process their own end users' personal data — in summary.
Published here, and accepted in the app before the Licensing module can be used.
Data Processing Addendum (full text)
The complete addendum the summary above is a summary of — this is the text that governs, including the sub-processor table, the audit conditions and the indemnity.
Published here. Read it before accepting the agreement in the app; you do not need to ask us for a copy.
Every past version of each document above, kept unchanged at its own address, with a fingerprint you can check it against.
Published here. If your record of what you accepted names a version, that is where you read exactly that text.
Every third party that processes personal data for us, what it receives, where it is, and the transfer safeguard relied on.
Published here, and kept in step with the Privacy Notice. Ask us to be told when it changes.
How to exercise your rights: the channels, what we need from you, how long we take, and what happens if we refuse.
Published here. Several of the rights are self-service in the app and need no request at all.
Where to send a vulnerability report, what is in scope, and what we undertake in return.
Published here, and at /.well-known/security.txt.
Data protection documents, on request
These exist and are adopted. They are written for regulators, auditors and business customers rather than for general publication, so we send them rather than post them.
Data Protection Policy
How we meet our obligations as a controller, and the discipline we hold ourselves to.
Regulator, auditor or business customer, on request.
Data Retention Policy and schedule
Every category of data and how long it is kept, mapped to the settings that enforce it.
Regulator, auditor or business customer, on request. A summary is in the Privacy Notice.
Data Subject Rights / SAR Procedure
The internal procedure behind the published request process — intake, verification, handling per right, and records.
Regulator or auditor, on request. The part that concerns you is published at /legal/data-requests.
Data Breach Response Procedure
How we detect, assess, report and communicate a personal data breach.
Regulator or auditor, on request.
Data Protection Impact Assessment Procedure
When we screen a change for privacy impact, and how an assessment is carried out and recorded.
Regulator or auditor, on request.
Record of Processing Activities (Article 30)
Our statutory record of what we process, why, who receives it and where it goes.
Provided to the Information Commissioner's Office on request, and to auditors.
International Data Transfer Policy
Our position on transfers, the instrument relied on for each recipient, and the transfer risk assessments.
Regulator, auditor or business customer, on request. The register itself is published at /legal/subprocessors.
Subprocessor Policy
How a new subprocessor is assessed and onboarded, and the notice and objection mechanics.
Business customer or auditor, on request. The list itself is published at /legal/subprocessors.
Legitimate Interests Assessments
The balancing assessments behind each processing activity we base on legitimate interests.
Regulator or auditor, on request.
Appropriate Policy Document
The document the Data Protection Act 2018 requires where special category or criminal offence data is processed under a Schedule 1 condition.
Provided to the Information Commissioner's Office on request.
Security documents, under NDA
These exist and are adopted. We share them for enterprise review under a non-disclosure agreement, and not otherwise: they describe our controls candidly, including where they are weakest, and that candour is only safe in a room with a door on it.
Information Security Policy
The master control set, its owner, and the risks we have accepted rather than closed.
Enterprise review under NDA.
Cybersecurity Policy
Our threat model for this product specifically, and the controls that answer it.
Enterprise review under NDA.
Access Control Policy
Who can reach what, across the product, the operator console and the infrastructure.
Enterprise review under NDA.
Encryption Policy
What is encrypted, with what, in transit and at rest, and how keys are handled.
Enterprise review under NDA.
Secure Development Policy
How changes are made, reviewed, built and released.
Enterprise review under NDA.
Vulnerability Management Policy
How vulnerabilities are found, triaged and fixed, and on what timescales.
Enterprise review under NDA. The reporting route is published at /legal/disclosure.
Incident Response Plan
What happens in the first hours of a security incident, and who does it.
Enterprise review under NDA.
Backup and Disaster Recovery Policy
Our recovery objectives and how restoration is tested.
Enterprise review under NDA.
How to request any of them
Email [email protected], name the documents you need and say who you are — a regulator, an auditor, or a customer carrying out due diligence. You do not need to explain yourself at length. We will come back to you, normally within ten working days, either with the documents or with an NDA to sign first for the security set.
If what you actually want is your own data rather than our paperwork, that is a different and faster route: see making a data request.
Not in force yet
We maintain an Employee and Worker Privacy Notice, which is dormant: TrendSoft Ltd has no staff, and it is published to candidates and employees before any of their data is processed rather than posted here to nobody.
Contact
TrendSoft Ltd, Aa House 54, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom. Company No. 16144241. Privacy and data-protection: [email protected]. Security: [email protected]. General: [email protected]. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).