Skip to content

Legal

Privacy Policy

Last updated | 2 June 2026

This policy explains what personal data we collect, how we use it, and your rights under the UK GDPR and the Data Protection Act 2018.

Who we are

Data controller: 99 Developers Ltd, a company registered in England and Wales (company number 17257492), which owns and operates 99 Data Rooms. Contact: privacy@99datarooms.com.

What we collect

  • Account data: email, display name, hashed password.
  • Content: documents and datarooms you upload.
  • Usage data: IP, user agent, country (from IP), event timestamps.
  • Visit analytics on share links: pages viewed, dwell time, device.
  • Billing data: collected directly by Paddle when you purchase a paid plan (we receive only the subscription status, plan and limited customer reference).

Lawful basis

  • Contract: to provide the Service you signed up for.
  • Legitimate interests: security, fraud prevention, product analytics.
  • Consent: optional analytics cookies (you can opt out at any time).
  • Legal obligation: to comply with applicable law.

How we use data

To run the Service, secure it, communicate with you, and improve it. We do not sell your data and do not use it for cross-site advertising.

Sharing

We share personal data only with the following categories of recipients:

  • Service providers and subprocessors: hosting, email delivery, and error monitoring.
  • Merchant of Record (Paddle.com Market Limited): our reseller and payment processor. Paddle handles checkout, subscription billing, payment processing, tax compliance, invoicing, and refund handling. See Paddle's Privacy Notice.
  • Professional advisers: legal and accounting advisers where necessary.
  • Authorities: where required by law or to protect rights and safety.

Data is processed in the UK and EU. Transfers outside the UK/EU are protected by Standard Contractual Clauses or equivalent safeguards where applicable.

Retention

Account data is retained while your account is active and for 30 days after closure. Visit analytics are retained for 24 months. Backups are retained for 30 days.

Your rights

Access, rectification, erasure, restriction, portability, objection. Contact privacy@99datarooms.com to exercise rights. You can complain to the UK ICO (ico.org.uk).

Security

TLS in transit, encryption at rest, row-level security, short-lived signed URLs, rate limiting. Details on our security page.

Cookies

See our cookie policy.