Privacy policy.
What we do with personal information, and what you can ask us to do about it.
Privacy policy
This policy covers personal information handled by Mythic Software Limited, both through this website and in the course of providing Clockwork CRM. Please read it carefully, because it explains:
- Who we are, and the two different roles we play depending on whose data it is
- How and why we collect, store, use and share personal information
- Your rights, and how to exercise them
- How to contact us, and how to complain
Read this bit first if you are a Clockwork CRM customer, or if a business that uses Clockwork CRM holds your data.
There are two very different kinds of personal information in play, and this policy is mostly about the first one. See Our two roles below.
Who we are
Mythic Software Limited ('we', 'us', 'our') is a company registered in England and Wales, company number 13449176, registered office 71-75 Shelton Street, Covent Garden, London, England, WC2H 9JQ. Clockwork CRM is our product.
We are regulated under the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations 2003.
For any privacy question, contact privacy@mythic.software.
Our two roles
1. We are the controller for personal information we collect for our own purposes. That means visitors to this website, people who enquire about or buy Clockwork CRM, and the named users on a customer's account. We decide why and how that information is used. The rest of this policy describes that processing.
2. We are the processor for the personal information our customers put inside their own Clockwork CRM instance: their contacts, their clients, their correspondence. We did not collect that data, we have no purpose of our own for it, and we only act on our customer's documented instructions. Our customer is the controller of it.
So if a business uses Clockwork CRM and you want to know what they hold about you, or you want it corrected or erased, the request goes to them, not to us. If you contact us instead, we will not answer on their behalf, but we will tell them without undue delay and point you in their direction.
The terms governing that second role are published in full in our Data Processing Agreement.
The personal information we collect and use
As controller, we collect:
- Contact and account details: name, job title, employer, email address, telephone number, and postal address where you buy from us
- Account credentials and access data for users of Clockwork CRM: username, password (stored hashed, never in readable form), two-factor authentication settings and activity logs
- Billing information: billing name and address, and our payment processor's tokens and transaction identifiers. We never receive or store card numbers
- Correspondence you send us, including support requests
- Website usage information, described under Cookies below
Information you give us about other people. If you give us information about someone else, you confirm you are entitled to do so and that they know their information will be handled as described here.
Cookies and similar technologies
A cookie is a small text file placed on your device when you visit a website. We use cookies on this website to keep it working and to understand how it is used.
For details see our cookie policy. For general information, see aboutcookies.org.
Worth knowing: the website analytics built into Clockwork CRM itself are cookieless and first-party. They set no tracking cookie, never store raw IP addresses or user agent strings, and send nothing to an analytics provider. See our security page.
How we use your personal information, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Provide Clockwork CRM, manage your account and authenticate your users | Performance of a contract |
| Take payment and keep accounting records | Performance of a contract, and legal obligation for tax records |
| Provide support and respond to your enquiries | Performance of a contract, or legitimate interests in answering people who contact us |
| Keep the service secure, investigate incidents and prevent misuse | Legitimate interests in protecting the service and its users |
| Improve the product and understand how the website is used | Legitimate interests, and consent where cookies are involved |
| Send marketing about our products | Consent, or legitimate interests where you are an existing customer |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you may object at any time.
Who your information may be shared with
We share personal information with service providers who help us run the service, under contracts requiring them to protect it and to use it only on our instructions. The full list, including what each one does and the country they do it in, is published at sub-processors.
We may also disclose information where we are required to by law, or to law enforcement in connection with an investigation into unlawful activity.
We do not sell your personal information, and we do not share it for anyone else's marketing.
Transfers outside the United Kingdom
Clockwork CRM is hosted in the United Kingdom. Databases, file storage, backups, call transcription and system email are all configured to UK regions.
A small number of our providers operate outside the UK:
- Germany (EU) for application error monitoring. The UK has adequacy regulations covering the EEA, so this is not a restricted transfer
- United States for the optional AI features, used only when a user chooses to invoke one, and for telephony and spam protection on public forms
- Support access by our hosting and email providers may come from outside the UK
Where a transfer is a restricted transfer under Chapter V of the UK GDPR, it is covered by an appropriate safeguard, being the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
How long we keep it
| Information | Retained for |
|---|---|
| Billing name and address, invoices and payment records | 6 years, to satisfy UK tax law |
| Your Clockwork CRM account and the data in it | For as long as your subscription is active, then as set out under termination below |
| Marketing contact details and preferences | Until you unsubscribe, then we keep a suppression record so we do not contact you again |
| Security and application logs | Up to 93 days |
| Backups | Expire on rotation, within 90 days |
If you end your Clockwork CRM subscription, your instance is suspended for one calendar month, during which you can reactivate it, and is then deleted. We can provide a complete extract of your data free of charge on request, and will confirm deletion in writing. The full detail is in clause 10 of our Data Processing Agreement.
Marketing
We may send you information about our products and services. We ask whether you want marketing at the point we first collect your details, and every marketing email has an unsubscribe link. You can opt out at any time, and we will act on it promptly. There may be a short period while an already-queued message finishes sending.
Keeping your information secure
We limit access to personal information to those who need it, and everyone handling it is under a duty of confidentiality. Technical measures include encryption in transit and at rest, a separate database with unique credentials for every customer, two-factor authentication available to every user, and access to production restricted to named individuals with multi-factor authentication.
Our measures are described in detail on our security page.
We have a documented procedure for security incidents, and we will notify you and the regulator where we are required to do so. No transmission over the internet can be guaranteed completely secure, but we take the protection of your information seriously.
What rights do you have?
Under the UK GDPR you have the following rights, free of charge. In summary, the right to:
- Be informed about how we use your personal information, which this policy is intended to do
- Access your personal information, and receive a copy
- Have mistakes in your information corrected
- Have your information erased, in certain circumstances
- Receive information you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another organisation, in certain circumstances
- Object at any time to the use of your information for direct marketing
- Object to other processing based on legitimate interests, in certain circumstances
- Restrict our processing of your information, in certain circumstances
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions
For more on each right and when it applies, see the Information Commissioner's guidance on individual rights.
To exercise any of these rights, email privacy@mythic.software, telling us which right you want to use and what information your request relates to. We respond within one month.
We will only ask you for proof of identity if we have a genuine reason to doubt who you are, and if we do we will ask for the least we need. We will not ask for identity documents as a matter of routine.
If the data is held by a business that uses Clockwork CRM, we are the processor and not the controller, so the request needs to go to that business. See Our two roles.
Complaints
If you are unhappy with how we have handled your personal information, please tell us first at privacy@mythic.software so we can try to put it right.
You also have the right to complain to the Information Commissioner's Office at any time. See ico.org.uk/make-a-complaint, or call 0303 123 1113.
Clockwork CRM Voyager browser extension
Clockwork CRM Voyager is our optional browser extension for Chrome and Firefox, available to Clockwork CRM customers and used alongside your existing Clockwork CRM account.
What it accesses
When you are signed in to LinkedIn and viewing a profile, company or conversation, the extension reads that page using your own LinkedIn session, so it sees only what you can already see. It does this only on linkedin.com, and only so that you can add or update the matching record in your CRM.
What it does with your data
The information you choose to sync (such as a contact's name, role, employer and photo, and the messages in a conversation) is sent only to your own Clockwork CRM instance. We do not receive a copy of it, and it is never shared with or sold to any third party. The extension contains no advertising or analytics tracking.
What it stores
To keep you signed in, the extension stores your Clockwork CRM sign-in tokens and your extension settings locally in your browser. These are not transmitted to anyone other than your own Clockwork CRM instance.
Your control
Syncing only happens when you choose it, or when you turn on the optional automatic options. You can disable those options or remove the extension at any time, and you can manage the synced records in your CRM as normal.
Changes to this policy
This privacy policy was published on 01/12/2020 and last updated on 16/09/2026.
We may change it from time to time, so please check back occasionally. If we make a material change we will tell customers by email.
Contacting us
For anything in this policy, email privacy@mythic.software, or get in touch.