Privacy Policy — Evaluation Programme

Purpl Pulse Ltd · organisation form · version 2026.08.17.1

This policy explains what we collect while your organisation evaluates our software, why, and what

you can ask us to do about it. It covers the evaluation programme only. It sits alongside the

Evaluation Access Agreement; where the two overlap, the Agreement governs the licence and this policy

governs personal data.

Who we are. Purpl Pulse Ltd is the data controller for the personal data described here. If you

want to reach us about anything in this document, use the contact address you were given with your

access details.

Who this is for. Your employer signed the Agreement and named you in Schedule 1. **We are an

independent controller of your details — not your employer's processor.** That matters: your employer

cannot exercise your rights for you, and it cannot instruct us to hand over your usage as a

performance matter. The Agreement requires your employer to give you this policy before naming you.

If you are reading it for the first time now, that is worth mentioning to whoever named you.

---

The short version

We collect your name, job title, work email and employer because access is granted to named

individuals and we have to know who holds each key.

Your employer gave us those details, not you. This section of the policy is how we tell you

what we then do with them.

We keep a record of the Agreement, your Schedule 2 undertaking, and your acceptances on screen.

It proves who agreed to what, and when.

We collect technical logs so the software runs, stays secure, and gets better.

We do not train any model on your data.

Please do not put real personal data, customer data or production secrets into the software. It

is not the place for them, and the Agreement asks you not to.

We do not sell anything to anyone, and we do not advertise.

---

1 · What we collect

1.1 What your employer tells us when it names you

| What | Why |

|---|---|

| Your full name | Access is granted to named individuals; we have to be able to say who holds each key |

| Your job title | To know the context you are evaluating in, and who to send what to |

| Your work email address | To identify you, to reach you, and to send extension and expiry notices |

| Your employer | It is the party to the Agreement, and it is responsible for your access |

1.2 What we record about the paperwork

| What | Why |

|---|---|

| Your signed Schedule 2 undertaking | It is a direct agreement between you and us; it is evidence of what you agreed |

| Each Schedule 3 notice naming or removing you | So the list of who held access, and when, has a factual answer |

| Which version of any on-screen terms was displayed to you, and a fingerprint of the exact text | So a later question about what was shown to you has a factual answer |

| The date and time of each acceptance | Same |

| The network (IP) address and browser an acceptance came from | Evidence about the circumstances of the acceptance |

| A one-way fingerprint of the key you used | So we can tell whether one key is being used by several people. We do not store the key itself |

1.3 What the software records while you use it

Technical logs — requests made, when, whether they succeeded, and how long they took.

Error and diagnostic information — what failed and where, so we can fix it.

Security events — sign-ins, refused requests, unusual patterns of use.

Usage statistics — which capabilities were exercised, and how often.

Where you have been given access over a private network, that network records which device connected

and when, in the ordinary way such networks do.

1.4 What you put in yourself

Anything you type, upload, draw or store while evaluating — pages, lists, files, briefs, test records.

This is your employer's material, held under the Agreement. We hold it so the software can work.

Please keep real data out. The Agreement asks your organisation not to introduce production

credentials, regulated information, special-category personal data or anybody's real customer records.

This is evaluation software; it has not been through the processes that would make it a safe home for

any of that. If personal data goes in without being agreed with us first, that is outside what this

policy contemplates.

1.5 What we tell your employer

Worth saying plainly, because you are entitled to know before you start:

We will tell your employer if we believe a key is being shared, if we suspend or withdraw

somebody's access, or if the Agreement is being breached. Clause 5 requires it, and your employer is

liable for what its named individuals do.

We will send your employer's senior contact a copy of the Agreement and of Schedule 1 whenever

Schedule 1 changes. Your name is on that list.

We do not otherwise report your individual usage to your employer — not how much you used it,

not what you tried, not what you said in feedback. If we ever need to, we will tell you.

1.6 What we do not collect

We do not use advertising or third-party analytics trackers.

We do not track you across other websites.

We do not collect special-category data (health, beliefs, biometrics and so on) about you.

We do not ask for payment details; the evaluation is free of charge.

The browser extension. Where you evaluate our browser extension, what it observes about the pages

you visit stays on your own machine unless you deliberately send something to a host. Read its own

guide for what it does and does not send.

---

2 · Why we are allowed to hold it, in law

We rely on legitimate interests (UK GDPR Article 6(1)(f)) for all of the above. Our interests are:

protecting technology we own, running a controlled evaluation, keeping a record of who was given

access and who agreed to what, and improving the product. We have weighed those against your

interests and concluded they do not override them, because the data is limited to your professional

identity and your use of the software, you are told about it before you start, and none of it is used

to make decisions about you personally.

Your details reached us from your employer rather than from you. Article 14 requires us to tell you

what we then do with them, and this document is how we do that — which is why the Agreement obliges

your employer to hand it to you before it names you.

Where we ever process personal data on your employer's instructions — which the Agreement says

should not normally happen — your employer is the controller and we are the processor, and we will

agree the details in writing before it starts.

Some records are kept because we may need them to establish or defend a legal claim.

---

3 · How long we keep it

| What | How long |

|---|---|

| The Agreement, Schedule 1 history, your Schedule 2 undertaking and your acceptance records | For as long as we may need to rely on them. Where the Agreement is executed as a deed, at least twelve years after it ends — the limitation period for a claim on a deed in England and Wales. Where it is signed as a simple contract, at least six years |

| Your name, job title, email and employer | While you hold access, then within the records above |

| Technical and security logs | Normally up to 12 months, longer only where a specific security or legal matter requires it |

| Material put into the software | Until the evaluation ends, then deleted with the environment. Keep your own copy of anything you want to keep |

| Correspondence and feedback | While it remains useful to the product, and no longer than necessary |

Those first records are kept longer than everything else on purpose. They are the evidence that access

was granted on the terms it was granted on, and they lose their value the moment they are deleted.

---

4 · Who else sees it

Very few people, and no advertisers.

Inside Purpl Pulse Ltd, only those who need it to run the evaluation.

Your employer, to the extent set out in section 1.5 and no further.

Infrastructure suppliers who host the software on our behalf, as processors under contract. They

hold data to run the service and for no purpose of their own.

Professional advisers — lawyers, accountants, insurers — where genuinely needed, under

confidentiality.

Authorities, where we are required by law or a binding order to disclose something.

We do not sell, rent or trade personal data, and we never will under this programme.

Where any supplier is outside the UK, we make the transfer only on terms UK data protection law

permits — normally the UK International Data Transfer Addendum or an adequacy decision.

---

5 · Models and training

**We do not use your material, or your organisation's confidential information, as training,

fine-tuning or evaluation data for any model — ours or anybody else's — without express permission.**

This is a commitment in the Agreement as well as here, and it is one of the few things in the

Agreement for which our liability is not capped.

We do use aggregated and de-identified information about how the software performed to improve it.

That means counts, timings and failure patterns — not your content, and nothing that identifies you.

---

6 · Security

Access is granted to named individuals only, one key per person, and a key is never reissued to

somebody else.

Where we put you on a private network, the software is not reachable from the public internet.

The Agreement requires a device with full-disk encryption enabled, and requires you to keep your key

to yourself. Those are the two controls most likely to matter in practice, and they are yours to

keep rather than ours.

We keep access logs and review them.

Your key is never written into our records — only a one-way fingerprint of it.

No system is perfectly secure, and this one is explicitly unfinished. Please do not store anything in

it that would hurt if it leaked.

---

7 · Your rights

Under UK data protection law you can ask us to:

Tell you what we hold about you, and give you a copy.

Correct anything inaccurate.

Delete it, where we have no overriding reason to keep it. *We will normally refuse to delete the

Agreement records, your undertaking or the acceptance record while we may still need them to

establish or defend a legal claim, and we will tell you plainly if that is our answer.*

Restrict or object to our processing, given your particular situation.

Receive it in a portable form, where that right applies.

Ask us directly, not through your employer — these are your rights, and they are yours to

exercise. Use the contact address you were given with your access details. We will respond within one

month. We will not charge you, we will not tell your employer that you asked, and we will not treat

you any differently for asking.

If you are not satisfied, you can complain to the Information Commissioner's Office (ico.org.uk),

the UK supervisory authority. We would rather you came to us first so we can put it right.

---

8 · Cookies and similar technologies

The evaluation software sets only what it needs to work:

A session cookie recording that you entered a valid key and accepted the terms shown on screen,

so you are not asked again on every page. It carries your name, email, organisation and which

version was displayed. It does not contain your key. It is signed, so it cannot be forged, and it

expires.

Ordinary sign-in cookies where a component has its own login.

There are no advertising, profiling or cross-site tracking cookies, so there is no consent banner —

these are strictly necessary for a service your organisation asked for.

---

9 · Changes

If we change this policy we will issue a new version and, where the change materially affects you,

tell you. The version at the top is how you tell which one you are reading.

---

*Purpl Pulse Ltd · Privacy Policy, Evaluation Programme, organisation form · version 2026.08.17.1*

This page is the document. Its fingerprint is 52d6834afc2167ad, and that fingerprint is written into any consent you give.