Introduction

Welcome to Unduit. We are committed to protecting your privacy and handling your personal information with care and transparency. This Privacy Policy (“Policy”) explains how Unduit LLC (“Unduit,” “we,” “us,” or “our”) collects, uses, shares, and protects your information when you use our IT Asset Management platform and related services (collectively, the “Services”).

This policy applies to:

• Our website at www.unduit.com
• Our platform at app.unduit.com
• Our mobile applications
• Any related services, features, and content we provide

By using our Services, you agree to the collection and use of information in accordance with this Policy.

1. Information We Collect

We collect information to provide, improve, and protect our Services. The types of information we collect include:

A. Information You Provide to Us

Account Information:

• Company name and business details
• Contact person name, email address, and phone number
• Billing address and payment information
• Company size and industry

Asset and Inventory Data:

• Device information (serial numbers, IMEI, asset IDs, model numbers)
• Hardware specifications (processor, RAM, storage, condition)
• Software licenses and installations
• Asset locations and assignments
• Device valuations and grading information

Employee Data (for Asset Recovery and Assignment):

• Names, email addresses, and phone numbers
• Shipping addresses for device recovery or deployment
• Employee IDs and department information
• Cost center and organizational unit assignments

Support and Communications:

• Support tickets, chat messages, and correspondence
• Feedback and survey responses

Integration Data:

• Data imported from integrated systems (HRIS, ticketing, MDM, identity providers, and communication tools)
• API credentials and authentication tokens
• Synchronization preferences

B. Information We Collect Automatically

Usage Information:

• Pages viewed, features used, and time spent in the platform
• Search queries and filter preferences
• Actions taken (orders placed, assets assigned, campaigns created)
• Session duration and interaction patterns

Device and Browser Information:

• IP address and approximate location derived from IP address
• Device type, operating system, and browser type
• Screen resolution and language settings
• Unique device identifiers

Cookies and Similar Technologies:

We use cookies and similar tracking technologies to collect information about your browsing activities. See Section 8 for detailed information about our cookie practices.

C. Information from Third Parties

We may receive information about you from:

• Business partners who refer you to our Services
• Service providers who help us verify business information
• Integrated platforms that you connect to our Services, such as ticketing, MDM, and HRIS systems, identity providers, and communication platforms
• Shipping and logistics carriers providing tracking and delivery updates

2. How We Use Your Information

We use the information we collect for the following purposes:

A. Providing Our Services

• Creating and managing your account
• Processing orders for device recovery, repair, buyback, and deployment
• Managing IT asset inventory and tracking
• Facilitating device shipping, returns, and logistics
• Processing payments and managing billing
• Generating reports and analytics dashboards
• Enabling integrations with third-party platforms

B. Communicating with You

• Sending order confirmations, shipping notifications, and status updates
• Providing customer support and responding to inquiries
• Sending account-related notifications and security alerts
• Delivering educational content, product updates, and feature announcements
• Requesting feedback and conducting surveys

C. Improving Our Services

• Analyzing usage patterns to enhance platform functionality
• Conducting research and development
• Testing new features and identifying and fixing technical issues
• Optimizing user experience and interface design

D. Marketing and Business Development

• Sending promotional communications about our Services (with your consent)
• Understanding customer needs and market trends
• Measuring campaign effectiveness

E. Security and Compliance

• Detecting, preventing, and responding to fraud, abuse, or security incidents
• Enforcing our Terms of Service and other policies
• Complying with legal obligations and responding to legal requests
• Protecting the rights, property, and safety of Unduit, our users, and others
• Conducting audits and maintaining records

3. How We Share Your Information

We share your information in the following circumstances:

A. Service Providers

We engage third-party service providers to help us deliver the Services. These include providers of cloud hosting and infrastructure, payment processing, communications delivery (SMS and email), shipping and logistics, and product analytics. These providers may process information, including Customer Personal Data, on our behalf and only to perform services for us. They are contractually obligated to protect the information and to use it solely for the purposes we specify.

For enterprise customers and others processing personal data through our platform, the specific providers we use to process Customer Personal Data, together with our security commitments and your rights as a data controller, are set out in our Data Processing Agreement (DPA), available at www.unduit.com/dpa. 

B. Other Service Providers (Unduit’s Own Operations)

We also use third-party tools to support our own business operations, including development and collaboration tools, website analytics, and marketing and advertising platforms. These tools process data we collect directly from visitors to unduit.com under Unduit’s own controllership. They do not process Customer Personal Data provided through the platform.

C. Business Partners

With your consent, we may share information with authorized resellers and channel partners, technology integration partners, and co-marketing partners.

D. Legal Requirements

We may disclose information when required by law or when we believe disclosure is necessary to comply with legal obligations, court orders, or government requests; enforce our Terms of Service or other agreements; protect the rights, property, or safety of Unduit, our users, or the public; or detect, prevent, or address fraud, security, or technical issues.

E. Business Transfers

If Unduit is involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

F. With Your Consent

We may share information for any other purpose with your explicit consent.

4. Data Retention

We retain your personal information only where we have an ongoing legitimate business need to do so, for example to provide you with the Services you have requested or to comply with applicable legal, tax, or accounting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it and whether those purposes can be achieved by other means, and applicable legal requirements.

When we no longer have an ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because the information is held in secure backup archives), we will securely store it and isolate it from any further processing until deletion is possible.

5. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access and Portability: request access to the personal information we hold about you and receive a copy in a portable format
• Correction: request correction of inaccurate or incomplete personal information
• Deletion: request deletion of your personal information, subject to legal and contractual exceptions (such as financial records we must retain for tax compliance)
• Objection and Restriction: object to or request restriction of certain processing activities, including direct marketing
• Withdraw Consent: where we process your information based on consent, withdraw that consent at any time
• Lodge a Complaint: lodge a complaint with a data protection authority in your jurisdiction

To exercise these rights, contact us at:

• Email: [email protected]
• Phone: +1 (847) 701-4584
• Mail: Unduit LLC, 5400 Patton Dr Ste 1, Lisle, IL 60532

We will respond to your request within 30 days. We may request additional information to verify your identity before processing your request.

6. Data Security

We implement appropriate technical, administrative, and physical security measures to protect your information against unauthorized access, disclosure, alteration, and destruction.

Our security measures include:

• Encryption: data is encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: role-based access controls and multi-factor authentication
• Network Security: firewalls and continuous security monitoring
• Secure Development: code reviews, vulnerability scanning, and penetration testing
• Physical Security: our cloud infrastructure provider operates secure data centers with restricted access and 24/7 monitoring
• Employee Training: regular security awareness training for all staff
• Incident Response: documented procedures for detecting and responding to security incidents

Compliance Certifications:

• SOC 2 Type II certified
• ISO/IEC 27001:2022 certified

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously work to improve our security practices.

7. International Data Transfers

Unduit is based in the United States, and our primary production infrastructure is hosted in the United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

These countries may have data protection laws that differ from those in your country. However, we take steps to ensure that your information receives an adequate level of protection wherever it is processed.

For transfers from the European Economic Area (EEA), United Kingdom, or Switzerland:

• We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for EEA transfers
• We rely on the UK International Data Transfer Addendum (IDTA) for UK transfers
• We implement supplementary measures to ensure data protection and conduct transfer impact assessments where required

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your browsing activities and to improve your experience with our Services.

A. Types of Cookies We Use

Essential Cookies (Required): necessary for the Services to function and cannot be disabled. These support session management and authentication, security and fraud prevention, and load balancing and performance.

Functional Cookies: enable enhanced functionality and personalization, such as remembering your preferences, settings, and language selection.

Analytics Cookies: help us understand how visitors interact with our website and Services through third-party analytics providers, so we can measure and improve performance.

Marketing and Advertising Cookies: used on our public website (unduit.com) to measure campaign effectiveness, identify business visitors, and deliver relevant advertising through third-party advertising and visitor identification services.

B. How to Control Cookies

Most web browsers allow you to control cookies through their settings. You can set your browser to block all cookies, block third-party cookies only, delete cookies when you close your browser, or notify you before a cookie is set.

You can opt out of interest-based advertising from participating companies through industry opt-out tools:

• Network Advertising Initiative: www.networkadvertising.org/choices
• Digital Advertising Alliance: www.aboutads.info/choices
• European Interactive Digital Advertising Alliance: www.youronlinechoices.eu

Some browsers include a “Do Not Track” (DNT) feature. Our Services do not currently respond to DNT signals because there is no industry standard for how to interpret them.

Important: If you block or delete cookies, some features of our Services may not function properly, and you may need to manually adjust some preferences.

9. Children’s Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected], and we will delete such information from our systems.

10. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: request disclosure of the categories and specific pieces of personal information we collect, the sources of that information, our purposes for collecting it, and the categories of third parties with whom we share it
• Right to Delete: request deletion of personal information we have collected from you, subject to certain exceptions
• Right to Correct: request that we correct inaccurate personal information that we maintain about you
• Right to Limit Use of Sensitive Personal Information: we do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights

You may designate an authorized agent to make requests on your behalf. The agent must provide proof of authorization, and we may require you to verify your identity directly.

To exercise your California privacy rights, contact us using the details in Section 5. We will respond to verifiable requests within 45 days. If we need additional time, we will notify you of the extension and the reason.

11. European and UK Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have specific rights under the General Data Protection Regulation (GDPR) and, for UK residents, the UK GDPR.

A. Legal Basis for Processing

We process your personal information on the following legal grounds: performance of a contract (creating and managing your account, providing the Services, processing orders); our legitimate interests (improving and developing our Services, marketing our Services to businesses, detecting and preventing fraud, and network and information security); compliance with legal obligations; and your consent (such as for marketing communications and certain cookies). You have the right to withdraw consent at any time where we rely on consent as the legal basis.

B. Your GDPR Rights

• Access: obtain confirmation of whether we process your data and request a copy
• Rectification: correct inaccurate or incomplete personal data
• Erasure: request deletion of your personal data (“right to be forgotten”)
• Restriction: restrict processing of your personal data in certain circumstances
• Data Portability: receive your data in a structured, machine-readable format
• Object: object to processing based on legitimate interests or for direct marketing
• Automated Decision-Making: not be subject to decisions based solely on automated processing

For questions about data protection or to exercise your rights, contact us using the details in Section 5. You also have the right to lodge a complaint with your local data protection supervisory authority. For UK residents, the relevant authority is the Information Commissioner’s Office (ICO).

12. Third-Party Services and Links

Our Services may contain links to third-party websites, applications, or services that are not owned or controlled by Unduit. This Privacy Policy does not apply to those third-party services. When you access third-party services, you do so at your own risk, and we encourage you to review their privacy policies before providing your information.

Integrated Services: If you connect third-party services (such as ticketing, HRIS, or MDM tools, identity providers, or communication platforms) to our platform, information will be shared according to your integration settings. We are not responsible for how those third parties use your information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting a notice on our website, sending an email to the address associated with your account, or displaying a prominent notice within our Services.

The “Effective Date” at the top of this policy indicates when it was last updated. Your continued use of our Services after the effective date constitutes acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

14. Information for Specific Services

A. Asset Recovery Services

When you use our asset recovery services:

Employee Data Collection: We collect employee names, addresses, phone numbers, and email addresses to facilitate device returns. This information is provided by you (the employer) and is used solely to coordinate logistics for device recovery.

Employee Consent: You are responsible for obtaining any necessary consent from your employees before providing their information to us. You represent and warrant that you have the legal right to share employee information with us for recovery purposes.

Data Processing Role: For employee recovery data, you are the data controller and we are the data processor. We process this data only on your instructions and in accordance with applicable data protection laws.

Our Data Processing Agreement (DPA) is available to all enterprise customers and those processing personal data through our Services. The DPA covers the categories of personal data processed, sub-processors engaged, technical and organizational security measures, and your rights as a data controller. To request or execute a DPA, please contact [email protected] or your account manager.

B. Physical Asset Handling

When we physically handle your IT assets:

Chain of Custody: We maintain detailed records of asset movement, including tracking numbers, receipt confirmations, and status updates.

Asset Valuation: Any valuations provided are estimates based on current market conditions and device condition assessments. Actual values may vary.

Data Destruction: While we offer data destruction services and provide certificates of destruction, you remain responsible for ensuring devices are properly wiped before shipment. We recommend performing your own data erasure before sending devices to us.

Liability Limits: Our liability for lost, damaged, or misidentified assets during processing is limited as described in our Terms of Service.

C. Buyback and Marketplace Services

When you use our buyback or device marketplace services:

Asset Information: We collect detailed device specifications, condition reports, and valuation data to facilitate transactions.

Financial Transactions: Payment information is processed by our third-party payment processor. We do not store complete payment card details on our servers.

Inventory Updates: Asset status changes and transactions are automatically reflected in your connected ITAM systems (if integrated).

D. Recruitment and Applicants

When you apply for a role at Unduit, we collect the personal information you provide as part of your application, including your name, contact details, CV/résumé, employment and education history, and interview notes and assessments, to evaluate your application and manage our recruitment process.

We process this information on the basis of your consent and our legitimate interest in assessing candidates for employment. If your application is successful, this information becomes part of your employee record. If your application is unsuccessful, we retain it for up to 12 months in case a suitable role arises, after which we securely delete it.

You may withdraw your application or request deletion of your data at any time, and the rights described in Sections 5 and 11 apply to applicants. To make a request, contact us at [email protected]. 

15. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Unduit LLC

• Email: [email protected]
• Phone: +1 (847) 701-4584
• Mail: 5400 Patton Dr Ste 1, Lisle, IL 60532
• Website: www.unduit.com

For support-related inquiries, please contact: [email protected] 

By using our Services, you signify your acceptance of this Privacy Policy. If you do not agree to this Privacy Policy, you should not use our Services. Continued use of the Services following the posting of changes to this Privacy Policy will mean that you accept those changes.

© 2026 Unduit LLC. All rights reserved.