Privacy Policy

Last Updated: 14 October 2026

1. Introduction

AppDeploy by ScotiTech is operated by ScotiTech Solutions Limited ("AppDeploy", "we", "us", or "our"). This Privacy Policy explains how we collect, use, store, and share personal data when you use the AppDeploy by ScotiTech website, request-access flow, hosted workspace, branded distribution pages, and related services.

AppDeploy by ScotiTech is an internal app distribution platform built around Apple Business workflows, with optional Android distribution capability available for certain enterprise customers.

If you do not agree with this Privacy Policy, do not use the service.

2. Who We Are

Company: ScotiTech Solutions Limited Registered Address: 11 Caldervale Drive, Motherwell ML1 2GB, United Kingdom Company Number: SC829021 (registered in Scotland) ICO Registration: ZB925464 (UK Data Protection Register, ico.org.uk) Corporate Address: Eurocentral Scotland, 2 Parklands Way, Maxim 1, Maxim Business Park, 1st Floor, Motherwell ML1 4WR, United Kingdom Email: privacy@scotitech.com Data Controller: ScotiTech Solutions Limited is the data controller for personal data collected in connection with operating and delivering AppDeploy by ScotiTech.

3. Information We Collect

3.1 Information You Provide

We may collect:

• name and work email address
• company or organisation name
• phone number and country
• business details provided during request access or onboarding
• account credentials and authentication data
• branding assets such as logos
• app metadata, release information, and related administrative data
• iOS redemption-code spreadsheets or related distribution data
• enterprise Android APK distribution files and metadata where that feature is enabled
• employee name and work email address when an administrator issues a device enrolment (email is optional for open enrolment links)
• support enquiries and other communications

3.2 Information We Collect Automatically

We may collect:

• IP address
• browser and device information
• operating system
• pages visited and actions performed
• login events and security logs
• audit events, role changes, invitations, approvals, and password actions
• install and distribution activity related to the platform

3.2A Device Management Data

Where your organisation enrols devices into AppDeploy's mobile device management (MDM), we process on your organisation's behalf:

• device identifiers: UDID, serial number, and where reported by the device, IMEI/MEID
• device model, name, OS version and build, and supervision state
• the installation status of apps and configuration profiles your organisation manages — the device reports managed apps only, never a personal app inventory
• security posture facts the device reports, such as whether a passcode is set and compliant
• device management events: enrolment, check-ins, command outcomes, and unenrolment

We do not collect device location, personal apps, photos, messages, browsing history, or personal account contents. When a device leaves management, employee name, employee email, and the personal device name are anonymised after 180 days (Section 9).

3.3 Information From Third Parties

We may receive limited information from:

• Stripe for billing and subscription status
• Apple Business related workflows used by the customer
• service providers used for email delivery, hosting, security, and support

4. How We Use Personal Data

We use personal data to:

• provide and operate the AppDeploy service
• create and manage workspaces and user accounts
• operate device enrolment, app deployment, configuration, and the device actions your organisation's administrators request
• process request-access submissions and onboarding
• verify email addresses and secure accounts
• process subscriptions and billing
• deliver operational emails and service notices
• support customers and respond to enquiries
• maintain audit trails and platform security
• monitor service performance and improve the product
• comply with legal obligations

5. Legal Bases For Processing

Where UK GDPR or GDPR applies, we rely on one or more of the following legal bases:

• Contract: to provide the service and manage customer accounts
• Legitimate interests: to secure the platform, prevent abuse, improve the service, and run our business
• Legal obligation: where we must retain or disclose data by law
• Consent: for optional marketing communications where applicable

6. How We Share Data

We may share personal data with:

• hosting and infrastructure providers
• payment processors such as Stripe
• Apple, where your organisation connects Apple Business or enrols devices
• email and support service providers
• security and logging providers
• our call-booking provider, Calendly (based in the United States), if you choose to book a call with us: it receives your name, email address and anything you enter on the booking form
• advisers, auditors, or regulators where required
• law enforcement or courts where legally required

We do not sell personal data. We do not share personal data for third-party advertising or marketing purposes.

7. Subprocessors

We use a limited set of third-party subprocessors to help deliver the service. The current list — each subprocessor, the personal data shared with it, and its jurisdiction — is published on our Sub-processors page at /sub-processors. We maintain that single list rather than duplicating it here, review it at least quarterly, and give 30 days' notice before adding or replacing a subprocessor.

8. International Transfers

Your data may be processed in countries outside the United Kingdom or your country of residence, including the United States. Where required, we apply appropriate safeguards for those transfers, such as:

• UK International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses (SCCs) adopted by the European Commission
• adequacy decisions by the UK Government or European Commission where applicable

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy. The following windows are enforced automatically by the platform:

• active account data: for the duration of the customer relationship
• audit and security records: 2 years, then deleted
• access requests that never became accounts: 90 days, then deleted
• device records after a device leaves management: employee name, employee email, and the personal device name are anonymised after 180 days (hardware identifiers are retained for enrolment integrity)
• webhook event payloads: 30 days after successful delivery (90 days for undeliverable events), then deleted
• billing and tax records: the period required by law (typically 7 years under UK tax rules)

When data is no longer needed, we delete it or anonymise it. Remote passcode-clearing commands have their device-bound credentials redacted from our systems the moment the command completes.

10. Data Processing Agreements

Our Data Processing Agreement (DPA), published at /dpa, sets out the basis on which we process personal data on behalf of the customer. It applies automatically to every customer and is incorporated into our Terms of Service, so you do not need to request it for it to apply.

If your procurement process requires a countersigned copy of the DPA, contact us at info@scotitech.com, as section 17 of our Terms of Service says.

11. Security

We use reasonable technical and organisational measures to protect personal data, including:

• transport encryption (TLS) for all data in transit
• encryption at rest for sensitive credentials
• role-based access controls and workspace isolation
• audit logging for all sensitive administrative actions
• access restricted to authorised personnel only

No service can guarantee absolute security. You are also responsible for maintaining the confidentiality of your credentials and ensuring that only authorised users have access to your workspace.

12. Cookies and Similar Technologies

We may use cookies or similar technologies for:

• authentication and session handling
• security
• user preferences
• basic service analytics and performance monitoring

You can manage cookies through your browser settings, although some parts of the service may not function correctly if essential cookies are disabled. We do not use cookies for cross-site advertising or behavioural tracking.

13. Your Rights

Depending on applicable law, you may have rights to:

• access personal data we hold about you
• correct inaccurate data
• request deletion of personal data
• restrict or object to certain processing
• request portability of certain personal data
• withdraw consent where processing is based on consent
• complain to the relevant supervisory authority

For UK residents: You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

For EEA residents: You may lodge a complaint with your local supervisory authority.

For India residents: see Section 16A. For US residents: see Section 16B.

For residents of India: You may exercise the rights available to Data Principals under the Digital Personal Data Protection Act, 2023 (access, correction, erasure, and grievance redressal) using the contact details below, and you may escalate unresolved grievances to the Data Protection Board of India.

To exercise any of your rights, contact us using the details below. We will respond within the timeframe required by applicable law (typically within one month for UK/EEA GDPR requests).

14. Marketing Communications

We may send service-related communications as part of operating the platform. We will only send optional marketing communications where permitted by law and, where required, with your consent. You can opt out of marketing communications at any time by using the unsubscribe link in the email or by contacting us directly.

15. Third-Party Services

The service may link to or rely on third-party services including Apple Business Manager, the App Store, and payment processors. We are not responsible for the privacy practices of third-party services outside our control. You should review their privacy notices separately where relevant.

16. Children

AppDeploy is intended for business and organisational use and is not directed to children under the age of 18. We do not knowingly process the personal data of children, and we do not perform tracking, behavioural monitoring, or targeted advertising directed at children.

16A. Additional Information for India (DPDP Act, 2023)

Where we process personal data of individuals in India, we act consistently with the Digital Personal Data Protection Act, 2023:

• Notice and consent. Where processing is based on consent, we describe the purpose in clear terms at the point of collection, and withdrawing consent is as simple as giving it (cookie choices can be changed at any time from the footer; account-level consents can be withdrawn by contacting us).
• Grievance redressal. Our Grievance Officer is Pardeep Kumar, Data Protection Officer, ScotiTech Solutions Limited, reachable at info@scotitech.com (mark the subject "DPDP grievance"). We acknowledge grievances within 72 hours and aim to resolve them within 30 days.
• Data Protection Board. If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India.
• Security and breach notification. We apply the security safeguards described in Section 11. In the event of a personal data breach affecting Indian Data Principals, we will notify the Data Protection Board of India and affected individuals as required by the Act.
• Retention. Personal data is deleted or anonymised when its purpose is served, per the enforced windows in Section 9, or earlier upon a valid erasure request.

16B. Additional Information for United States Residents

Where we process personal data of residents of California or other US states with comprehensive privacy laws (including the CCPA/CPRA, and the laws of Virginia, Colorado, Connecticut, and Utah):

• We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the preceding 12 months. We use no third-party advertising cookies; optional analytics runs only after opt-in.
• Service-provider role. For workspace and device data processed on behalf of a customer organisation, we act as a "service provider"/"processor": we process that data only to provide the service under our agreement with the customer and for no other commercial purpose. If you are an employee of one of our customers, please direct rights requests to your organisation — we support them in responding, as our DPA describes.
• Your rights. Where we act as the business (our website, request-access flow, and billing contacts), you may request to know, access, correct, or delete the personal information we hold about you, and you will not be discriminated against for exercising these rights. Contact us at info@scotitech.com; we verify requests using the email address associated with the data and respond within the timeframe your state's law requires (typically 45 days).
• Sensitive information. We do not collect sensitive personal information as defined by the CPRA, and we do not use personal information for automated decision-making with legal or similarly significant effects.
• Health information. AppDeploy is not designed for, and must not be used to process, protected health information (PHI) under HIPAA. We do not offer a Business Associate Agreement.

17. Changes To This Policy

We may update this Privacy Policy from time to time. We will update the "Last Updated" date and, where appropriate, provide notice of material changes via email or in-product notification.

18. Contact

For privacy enquiries, data subject rights requests, or questions about our Data Processing Agreement, contact:

Email: privacy@scotitech.com Registered Address: ScotiTech Solutions Limited, 11 Caldervale Drive, Motherwell ML1 2GB, United Kingdom