Where We rely solely on consent, You may withdraw it at any time by contacting Us at dpo@sapphire.net. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. How We Share Your Data
We may share Your personal data with the following categories of recipients:
•    Service providers and processors - third parties who assist Us in operating Our business, such as cloud hosting, payment processing, analytics, communications and customer support, under contractual obligations of confidentiality and data protection
•    Professional advisers - lawyers, accountants, auditors, insurers and other advisers
•    Regulatory and public authorities - where required by law, regulation, court order or governmental request
•    Business transaction parties - in connection with any merger, acquisition, reorganisation or sale of assets, subject to confidentiality obligations
We require all third-party recipients to process personal data only on Our instructions where they act as processors and to implement appropriate security measures.

7. Sub-processors
We may engage trusted third-party sub-processors to help deliver aspects of Our services. These sub-processors process personal data only on Our documented instructions and are bound by contractual obligations equivalent to those We owe under applicable data protection laws.
Sapphire should maintain an up-to-date internal list of sub-processors, including the services they provide and their processing locations, and make this available to customers where contractually required.

8. Cookies and Similar Technologies
When You visit Our website, We use cookies and similar technologies to ensure the website functions correctly, analyse website usage and performance, and, where used, deliver relevant content and communications. You can manage Your cookie preferences through Your browser settings or through Our cookie consent mechanism on the website.
To comply with the UK GDPR, EU GDPR, the Data (Use and Access) Act 2025 where applicable, and PECR, Sapphire should maintain a clear cookie notice, identify each cookie or similar technology by purpose and duration, obtain consent before setting non-essential cookies, allow users to accept or reject non-essential cookies with equal ease, record consent choices, and enable users to withdraw consent at any time. Strictly necessary cookies may be used without consent where they are genuinely required to provide the requested service or maintain essential website functionality.

​

9. International Data Transfers
Sapphire operates in the United Kingdom and the European Union. Your personal data may be transferred to, and processed in, the United Kingdom and countries within the European Economic Area. Where We transfer personal data outside the UK or EEA, We ensure appropriate safeguards are in place, including adequacy determinations, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism where required.

10. Data Retention
We retain Your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, tax, accounting, or reporting requirements.
Retention periods are determined by applicable legal and regulatory requirements, operational necessity, contractual requirements, and the principles of data minimisation and storage limitation. When personal data is no longer required, it is securely deleted, anonymised, or otherwise put beyond use. Where data is retained solely for legal compliance beyond its original purpose, access is restricted to the minimum necessary personnel.

11. Your Rights
Under the GDPR, UK Data Protection Act 2018, UK GDPR and other applicable privacy and data protection laws, You have a number of rights with regard to Your personal data. These include: