Privacy Policy
Last updated: September 2026
1. Introduction and controller details
HeadData Ltd (trading as Asterias) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store and protect your personal data when you visit our website, communicate with us, or use our software platforms and services.
Under the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018, HeadData Ltd acts primarily as a Data Controller for our website visitors, business contacts and personnel, and as a Data Processor when providing contracted software services to our corporate clients.
- Company name: HeadData Ltd (Asterias)
- Company registration number: 12723578
- Registered office address: Kemp House, City Road, London, EC1V 2NX, United Kingdom
- Data protection contact: andrew.walker@asterias.io
2. Scope of this policy
This Privacy Policy applies to personal data collected through:
- Our public website (asterias.io).
- Business communications, customer onboarding and support channels.
- Recruitment and job applications.
- Our software platform environments and demonstration portals.
3. Personal data we collect, lawful bases and retention
We only collect personal data that is necessary to fulfil specific business and service obligations. The table below outlines the categories of data we collect, our lawful basis under UK GDPR Article 6, and our retention schedules as documented in our formal Record of Processing Activities (RoPA).
| Purpose / activity | Data categories collected | Lawful basis (UK GDPR) | Retention period |
|---|---|---|---|
| Customer Relationship & Account Management | Name, business email address, telephone number, job title, and company details. | Contract Execution (Article 6(1)(b)) | Duration of contract + 6 years. |
| Hosted Platform & Service Delivery | User identifiers, login credentials, system access logs, and operational usage data. | Contract Execution (Article 6(1)(b)) | Duration of contract + 12 months. |
| Technical Support & Enquiries | Name, email address, support ticket communications, and technical descriptions. | Legitimate Interests (Article 6(1)(f)) | 3 years from ticket resolution. |
| Marketing & Updates | Name, business email address, and marketing preferences. | Consent (Article 6(1)(a)) | Until consent is withdrawn. |
| Financial & Billing Operations | Invoicing contact details, tax identifiers, transaction history, and payment logs. | Legal Obligation (Article 6(1)(c)) | 7 years following financial year-end. |
| Recruitment & Applicant Review | CV, work history, contact information, and interview notes. | Legitimate Interests (Article 6(1)(f)) | 12 months from application. |
| Security & System Analytics | IP addresses, browser types, timestamped access logs, and device identifiers. | Legitimate Interests (Article 6(1)(f)) | 12 months. |
4. Special category data
HeadData Ltd does not collect or process Special Category Personal Data (such as medical records, biometric data, racial or ethnic origin, political opinions, or criminal history) as part of our core website or platform operations.
5. Data hosting and international data transfers
- Data residency: All personal data managed by HeadData Ltd is hosted and processed securely within the United Kingdom and the European Economic Area (EEA) using Microsoft 365 UK/EEA datacenters and Amazon Web Services (AWS) London Region infrastructure.
- International transfers: We do not transfer personal data outside the UK or EEA unless explicitly required under a customer contract or data processing agreement. Where international transfers are required, they are safeguarded using UK International Data Transfer Agreements (IDTAs) or European Commission Standard Contractual Clauses (SCCs).
6. Technical and organisational security
HeadData Ltd operates a certified Information Security Management System (ISMS) compliant with ISO/IEC 27001:2022 (Certificate No. 26057). We enforce robust security controls to ensure the confidentiality, integrity and availability of all personal data, including:
- Encryption: Data in transit is encrypted using TLS 1.2/1.3, and data at rest is encrypted using FIPS-approved AES algorithms (AES-128/AES-256).
- Access control & identity: Strict multi-factor authentication (MFA), passkeys, and role-based access control (RBAC) across all systems.
- Endpoint hardening: All company endpoints are managed via Microsoft Intune MDM with enforced full disk encryption, auto-patching, anti-malware, and USB storage blocking.
7. Third-party sub-processors
We engage vetted third-party service providers to support our operations. All sub-processors are bound by written agreements ensuring compliance with UK GDPR standards. Key infrastructure suppliers include:
- Microsoft Corporation (productivity, identity, Intune MDM, and cloud services).
- Amazon Web Services, AWS (application cloud infrastructure, UK region).
8. Your data protection rights
Under UK data protection law, you have the following rights regarding your personal data:
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: request correction of inaccurate or incomplete personal data.
- Right to erasure ("right to be forgotten"): request deletion of your personal data where there is no compelling legal reason for its continued processing.
- Right to restrict processing: request the suppression or restriction of processing under specific circumstances.
- Right to data portability: request a structured, machine-readable copy of data provided under consent or contract.
- Right to object: object to processing based on legitimate interests or direct marketing.
- Right to withdraw consent: withdraw consent at any time where processing is based on consent.
To exercise any of these rights, please contact our Data Protection Lead at andrew.walker@asterias.io. We will respond to valid requests within one calendar month.
9. Cookies and analytics
Our website uses essential cookies to ensure secure navigation, session management and access to protected areas. Non-essential analytical or performance cookies are deployed only with your explicit consent via our website cookie consent banner. You can manage or update your cookie preferences at any time through your web browser settings.
10. Complaints and regulatory authority
If you have concerns about how HeadData Ltd processes your personal data, please contact us first so we can resolve the issue. You also have the right to lodge a complaint with the UK data protection supervisory authority:
- Information Commissioner's Office (ICO)
- Website: ico.org.uk
- Telephone: 0303 123 1113