1. Who We Are

Custard Ltd is a UK-based company providing a software platform that helps organisations collect feedback and generate insights about team performance and culture.

Registered office: First Floor Sterling House, Outrams Wharf, Little Eaton, Derby, DE21 5EL

Contact: support@itscustard.com

2. Our Role Under UK GDPR

When you use Custard:

• Your organisation is the Data Controller – they determine why and how your data is used
• Custard acts as the Data Processor – we process personal data on behalf of your organisation, under their instructions

Our customers enter into a Data Processing Agreement (DPA) with us, which governs how we process personal data on their behalf, including our obligations around security, confidentiality, and data subject rights.

If you have questions about how your organisation uses your data, please contact them directly. If you have questions about how Custard processes data as a Processor, contact us at hello@itscustard.com.

3. What Data We Process

Depending on how the Service is configured by your organisation, we may process:

• user account data (name, email address, job role)
• team structure data (manager relationships, reporting lines)
• feedback responses submitted through the platform
• usage data (logins, interactions, platform activity)
• IP addresses and user-agent strings

4. How We Use Data

We process personal data to:

• provide and operate the Custard platform
• generate insights and recommendations for managers
• improve product functionality and user experience
• maintain security and platform performance

We do not sell personal data to third parties.

5. Legal Basis for Processing

We process personal data on the following legal bases under UK GDPR:

• Contractual necessity: processing required to deliver the Service under our agreement with your organisation
• Legitimate interests: improving the product, ensuring security, and analysing aggregated usage trends, where these interests are not overridden by your rights and freedoms

Where we rely on legitimate interests, we have carried out a Legitimate Interests Assessment (LIA) to balance our interests against the rights of data subjects. A summary is available on request.

6. Anonymity & Feedback

Custard is designed to support anonymous feedback, helping teams share honest input while protecting individual privacy.

To support this:

• feedback is aggregated before being presented to managers
• reports are only generated once a minimum response threshold is met
• individual responses are not visible to managers

However, absolute anonymity cannot be guaranteed in all situations. In smaller teams or where response patterns are highly identifiable, there may be a risk that individuals could be inferred indirectly.

For this reason, organisations are responsible for using the platform appropriately, including:

• ensuring sufficient team sizes where anonymity is expected
• using insights responsibly and not attempting to identify individuals

Custard is designed to provide meaningful team-level insight, not to monitor or evaluate individuals.

7. Automated Processing & AI Insights

Custard uses automated processing to generate insights and recommendations based on feedback data. These insights are intended to support (not replace) human decision-making by managers.

We do not make solely automated decisions that produce legal or similarly significant effects on individuals, as defined under Article 22 UK GDPR. All recommendations generated by Custard require human review and judgement before action is taken.

If your organisation uses Custard in a way that may involve automated decision-making with significant effects, please contact us to discuss your obligations.

8. Data Retention

We retain personal data only for as long as necessary to provide the Service and meet our legal obligations. 

Upon termination of the Service:

• Custard will, at the Controller’s choice, manually delete or return all Personal Data within 90 days of the termination date
• Custard will provide written confirmation of deletion upon request

Custard may retain Personal Data beyond this period only where required by applicable law, and will inform the Controller of any such retention

Customers may request deletion of their data at any time by contacting hello@itscustard.com.

9. Security

We implement appropriate technical and organisational measures to protect personal data, including:

• role-based access controls
• encryption of data in transit and at rest where appropriate
• secure cloud infrastructure (Laravel Cloud)
• regular monitoring and security assessments

10. Sub-processors

We use the following trusted providers to deliver the Service:

All sub-processors are required to process data in accordance with UK GDPR and are bound by appropriate data protection agreements.

11. Your Rights

Under UK GDPR, you may have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request deletion of your data (“right to be forgotten”)
• Restrict or object to processing in certain circumstances
• Data portability – receive your data in a structured, machine-readable format
• Object to automated processing where it produces significant effects

To exercise your rights, contact your organisation in the first instance (as Data Controller). You may also contact us directly at hello@itscustard.com and we will assist where we are able to do so.

If you have concerns about how your data is handled, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk. We encourage you to contact us first so we can try to resolve your concerns directly.

12. International Transfers

Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including the use of the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) as applicable.

Additional Rights by Region

Depending on where you are based, you may have additional privacy rights under local laws. These are outlined below.

United States

If you are a resident of certain US states (including California), you may have the right to:

• request access to the personal data we process about you
• request deletion of your personal data
• correct inaccurate personal data
• opt out of the sale or sharing of personal data

Where permitted by applicable US privacy laws, you may designate an authorised agent to make requests on your behalf. We may require verification of your identity and the authority of the agent before responding to such requests.

For the purposes of applicable US state privacy laws (including the California Consumer Privacy Act), Custard acts as a “service provider” to its customers.

We process personal data only on behalf of our customers and in accordance with their instructions, and do not retain, use, or disclose personal data for any purpose other than providing the Service.

We do not sell or share personal data as those terms are defined under applicable US privacy laws.

To exercise your rights, you can contact your organisation directly (as the Data Controller), or contact us at hello@itscustard.com and we’ll support where appropriate.

Canada

If you are based in Canada, we process your personal data with your organisation’s authority and for the purposes outlined in this policy.

Your organisation is responsible for obtaining your consent to use the platform and for ensuring that you are informed about how your data is used.

Where required, you may withdraw your consent to the processing of your personal data, subject to legal or contractual restrictions. In most cases, this should be done by contacting your organisation directly.

You have the right to:

• access the personal data held about you

• request corrections if it is inaccurate

• withdraw consent where applicable

Australia

If you are based in Australia, you have the right to:

• access the personal data held about you
• request correction of inaccurate data
• raise a complaint about how your data is handled

If you have a concern, we recommend contacting your organisation first.
You can also contact us at hello@itscustard.com and we will work with your organisation to resolve the issue.

If you are not satisfied with how your complaint is handled, you may contact the Office of the Australian Information Commissioner (OAIC).

European Union & United Kingdom

If you are based in the EU or UK, you have rights under data protection law including:

• access to your personal data
• correction of inaccurate data
• deletion of your data
• restriction or objection to processing
• data portability

As Custard acts as a Data Processor, your organisation is responsible for responding to these requests. We support them in doing so.

If you have concerns, you can contact your organisation or reach us at support@itscustard.com.

You also have the right to lodge a complaint with your local data protection authority, including the Information Commissioner’s Office in the UK.

We’re committed to handling personal data responsibly, no matter where you’re based. If you have any questions about how your data is used, we’re always happy to help.

14. Changes to This Statement

We may update this Privacy Statement from time to time. We will notify users of material changes. The latest version will always be available on our website.

15. Contact

For data protection queries: support@itscustard.com