1. Who we are
Eselram is currently supplied by Marlese Rosch Haden trading as ESELRAM.COM. For information used for Eselram's own business purposes, that supplier acts as controller. Contact: eselram.support@gmail.com. Business correspondence address: 2 Hagbourne Close, Woodcote, RG8 0RZ, United Kingdom. ESELRAM.COM is a trading name, not a separately incorporated company.
2. Scope and roles
This notice concerns Eselram's website, hosted account administration, subscription billing, support, service diagnostics and related controller-side activities. For client bookings, consultation responses, health information, photographs and treatment records entered by a business customer, that customer normally determines the purposes and means of processing and acts as controller. Eselram generally acts as processor for that hosted customer-controlled information under the Data Processing Agreement.
3. Information Eselram uses as controller
Depending on the relationship and features used, this may include:
- name, business name, email address and other business contact information;
- account, subscription and billing information;
- payment and transaction references (payment-card details are handled by the relevant payment provider rather than stored by Eselram where Stripe-hosted checkout is used);
- support communications and information supplied when asking for help;
- service configuration, version, operational, security and diagnostic information;
- OAuth connection identifiers and authorisation information needed to maintain integrations; and
- records needed for accounting, fraud prevention, dispute handling and legal compliance.
4. Purposes and lawful bases
Eselram uses personal information only where it has an appropriate lawful basis. The main purposes and bases are:
- Providing hosted subscriptions, account access and requested support: contract, or steps requested before entering a contract.
- Operating, securing and improving reliability of Eselram: legitimate interests in providing a secure, dependable business service, including preventing misuse and diagnosing faults, balanced against individuals' rights.
- Billing, tax, accounting and legal records: legal obligation where applicable and legitimate interests in maintaining appropriate business records and resolving disputes.
- Service and security communications: contract where necessary to provide the service, or legitimate interests in administering and protecting the service.
- Optional communications that legally require consent: consent, which can be withdrawn at any time without affecting processing already carried out lawfully.
Eselram does not use consent where another lawful basis is more appropriate merely because information appears in a contract or account.
5. Customer-controlled operational data
In the hosted Eselram service, customer-controlled business data is processed on Eselram-administered Cloudflare infrastructure, including tenant-specific D1 databases and R2 storage where used. The business customer ordinarily controls why client information is collected, its lawful basis and relevant health-data condition, access permissions and retention instructions. Eselram provides the technical processing service under the DPA. Tenant-specific storage does not remove the need for verified access controls, backups, logging and recovery procedures.
6. Special-category information
Optional treatment features may contain health information or other special-category personal information. The customer, as controller, is responsible for identifying and documenting both an Article 6 lawful basis and an appropriate special-category condition, and for deciding whether a data protection impact assessment or additional safeguards are required. Where Eselram acts as processor, it processes that information only on documented instructions and under the DPA.
7. Google and Gmail
If a customer connects Gmail, Eselram requests the permission needed to send email on the user's behalf (gmail.send). This feature does not require permission to read the user's Gmail inbox.
- Authorisation information is used to establish and maintain the requested connection.
- Outbound content is processed to send messages configured by the customer.
- Eselram does not sell Google user data or use it for advertising or unrelated profiling.
8. Recipients and integrations
Eselram does not sell personal information. Information may be shared where necessary with infrastructure, payment, email, security and professional service providers; with authorities where required by law; or in connection with establishing, exercising or defending legal claims. Cloudflare, Stripe, Google/Gmail and supported email services may be involved depending on configuration. The Subprocessors & Integrations Notice explains their current roles in more detail.
9. Support access
Eselram does not routinely access customer client data for support. Where access is needed to investigate a support issue, Eselram will normally seek the customer's authorisation and limit access to what is reasonably necessary. This does not prevent proportionate access or preservation required for security, incident response or a legal obligation.
10. International transfers
Some providers may process information outside the UK. Where Eselram initiates a restricted transfer for which it is responsible, Eselram will use an applicable UK adequacy regulation, the UK International Data Transfer Agreement or UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism as appropriate. Information about relevant provider arrangements can be requested from the privacy contact. Customers remain responsible for transfer arrangements arising from third-party accounts they independently select and control.
11. Retention
Eselram retains its own account, billing, support and security records for periods justified by the relevant purpose and legal obligations. Customer-controlled hosted records are held for the duration of the service and the applicable export/closure period, subject to the customer's lawful instructions, required retention and the DPA. The method and timetable for data return or deletion will be confirmed through the closure process and DPA. Eselram does not offer a fixed 30-day recovery guarantee. Retention may differ for accounting, dispute and security records.
12. Security
Eselram is responsible for implementing risk-appropriate security measures for the hosted infrastructure under applicable law and the DPA. Measures are subject to ongoing review and testing; this notice does not certify the completion of any particular penetration test, backup restoration test or security audit. Customers must also secure their users, devices and connected external accounts. Security concerns can be reported to eselram.support@gmail.com.
13. Your rights
Where Eselram is controller, individuals may have rights under UK data-protection law including access, rectification, erasure, restriction, objection and portability, depending on the circumstances and lawful basis. Where processing is based on consent, consent may be withdrawn. Individuals also have the right to object to direct marketing at any time.
Requests can be sent to eselram.support@gmail.com. Eselram will normally respond within one month, subject to the rules that permit an extension in some circumstances. If a request concerns information controlled by an Eselram customer, the requester should normally contact that business directly.
14. Complaints
Privacy concerns can be sent to eselram.support@gmail.com. Individuals also have the right to complain to the Information Commissioner's Office (ICO), the UK data-protection regulator. ICO information and complaint routes are available at ico.org.uk/make-a-complaint, and its helpline is 0303 123 1113.
15. Cookies and similar technologies
At the effective date of this notice, the public Eselram website does not intentionally deploy advertising or analytics cookies. Strictly necessary technologies may be used where required to provide security, checkout or requested functionality. If Eselram later introduces non-essential cookies or similar technologies, the website will provide appropriate information and obtain consent where required before they are used.
16. Children
Eselram is supplied to businesses and the Eselram website and subscription service are not directed to children. A customer that records information about minors using its Eselram hosted account is responsible for ensuring that processing is lawful, transparent and appropriately safeguarded.
17. Changes
Eselram may update this notice to reflect changes to the service, law or providers. The current version will be published here with its effective date. Material changes will be highlighted or communicated where appropriate.
18. Contact
Controller: Marlese Rosch Haden trading as ESELRAM.COM
Email: eselram.support@gmail.com
Business correspondence address: 2 Hagbourne Close, Woodcote, RG8 0RZ, United Kingdom