This Privacy Notice explains how Progressio AI Limited (“Progressio.ai”, “we”, “us”) handles Personal Data when you visit our Website, communicate with us, or use the Progressio.ai Service.

It applies in accordance with the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR and other applicable data protection laws.

Progressio.ai provides an enterprise software platform for identifying and assessing evidence within existing documentation and records against defined requirements. The Service does not ordinarily require Personal Data as part of that assessment process.

1. Who is responsible for your Personal Data

Progressio.ai acts as Controller for Personal Data that we process for our own purposes, including in connection with the Website, account administration, customer and prospect communications, billing, marketing, security, recruitment and our legal and regulatory obligations.

To the extent that Customer Data submitted or otherwise made available to the Service contains Personal Data, the Customer is the Controller of that Personal Data and Progressio.ai processes it on the Customer’s behalf as Processor under our Data Processing Addendum.

If you are an individual whose Personal Data has been included in Customer Data processed through the Service, you should normally direct questions about that processing to the relevant Customer in the first instance.

2. Personal Data we collect

The Personal Data we collect depends on how you interact with Progressio.ai and may include:

Account and contact data: name, business email address, role, organisation, and account credentials or authentication identifiers used to access the Service.
Communications: messages, attachments and related information when you contact us about the Website, Service, sales, support or other matters, together with any feedback you choose to provide.
Usage and device data: information about how you interact with the Website or Service, such as pages or features accessed, timestamps, IP address, browser type, operating system and similar technical information.
Customer Data: documents, system information, records and other content submitted or otherwise made available by a Customer to the Service. The Service does not ordinarily require Personal Data as part of the assessment process. Where Customer Data contains Personal Data, it is generally incidental to the documentation or records being assessed and is processed by Progressio.ai on behalf of the Customer.
Billing data: business billing information, purchase orders and tax information where relevant to a Customer relationship.
Recruitment data: information you provide if you apply to work with us, including your CV and application information.

Where we ask you to provide Personal Data that is necessary to create or administer an account, enter into or perform a Customer relationship, or comply with a legal obligation, we will indicate this where appropriate. If you do not provide information that is required, we may be unable to provide the relevant Service, respond to your request or enter into or administer the relevant relationship.

The Service is not designed or intended for the processing of special category Personal Data or criminal offence data, and such data is not ordinarily required to use the Service. Customers should not intentionally make such data available to the Service unless it is necessary and lawful for them to do so.

We generally collect Personal Data directly from you or from the organisation you represent. We may also obtain business contact information from publicly available sources or from third parties, for example professional networking platforms, company websites, event organisers or business contacts.

3. How and why we use Personal Data

Where Progressio.ai acts as Controller, we process Personal Data for the following purposes:

Operating and securing the Website and Service: including managing accounts, authentication, troubleshooting, detecting and addressing security issues, and maintaining the operation of our systems. We rely on performance of a contract where applicable and our legitimate interests in operating and securing our business and Service.
Responding to enquiries and managing relationships: including sales enquiries, support requests and communications with Customers, prospective Customers and other business contacts. We rely on performance of a contract where applicable and our legitimate interests in managing our business relationships.
Service, billing and contractual communications: including invoices, account notices, security communications and material changes to contractual or legal documents. We rely on performance of a contract, legitimate interests and legal obligations, as applicable.
Marketing: sending information about Progressio.ai products, services and events to business contacts where permitted by law. We rely on legitimate interests or consent, as applicable. You can unsubscribe from marketing communications at any time.
Understanding and improving the Website and Service: including analysing usage patterns, diagnosing performance issues and informing product development. We rely on our legitimate interests in improving and operating our products and services.
Legal, regulatory and business administration: including complying with legal obligations, responding to lawful requests, protecting our legal rights and maintaining appropriate business records. We rely on legal obligations and legitimate interests, as applicable.
Recruitment: assessing and managing applications to work with Progressio.ai. We rely on legitimate interests and other lawful bases applicable to the recruitment process.

Where Progressio.ai acts as Processor, we process any Personal Data contained in Customer Data only on behalf of the relevant Customer and in accordance with its documented instructions, the Terms and our Data Processing Addendum. The Customer is responsible for determining the lawful basis for that processing.

Progressio.ai does not use Customer Data to train its own models. Where third-party model providers are used, Progressio.ai configures those services so that Customer Data is not used for model training, unless different arrangements are expressly agreed with the Customer.

4. How we share Personal Data

We do not sell Personal Data.

We may share Personal Data in the following circumstances:

Service providers: with third parties that provide infrastructure, hosting, communications, professional, administrative or other services to Progressio.ai. Where these providers process Personal Data on our behalf, they are required to protect it in accordance with applicable data protection law and our contractual arrangements with them.
Sub-processors: where Progressio.ai processes Personal Data on behalf of a Customer, we may engage Sub-processors to support delivery of the Service, including infrastructure, hosting and model providers. Our use of Sub-processors is governed by the Data Processing Addendum. A current list of Sub-processors is available to Customers in accordance with that Addendum.
Within a Customer organisation: where you use the Service through a Customer account, information associated with your account or use of the Service may be visible to authorised administrators or other authorised users within that organisation.
Professional advisers: with lawyers, accountants, auditors and other professional advisers where reasonably necessary, subject to appropriate duties of confidentiality.
Legal, regulatory and security purposes: where disclosure is required by law or legal process, or is reasonably necessary to protect the rights, property or security of Progressio.ai, our Customers, users or others.
Corporate transactions: in connection with a merger, acquisition, financing, reorganisation or sale of all or part of our business or assets, subject to appropriate confidentiality and data-protection safeguards.

5. Hosting and international transfers

The Service’s primary hosting environment is located in Europe.

Where Progressio.ai transfers Personal Data internationally, we take steps to ensure that the transfer is permitted under applicable data protection law. Depending on the circumstances, this may include relying on an applicable adequacy decision or adequacy regulation, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism.

Where Progressio.ai acts as Processor on behalf of a Customer, international transfers of Personal Data are also governed by our Data Processing Addendum.

Information about relevant processing locations and transfer safeguards is available to Customers on request.

6. Security

We use technical and organisational measures designed to protect Personal Data against accidental or unlawful loss, alteration, disclosure or access.

Data processed through the Service is protected using TLS 1.3 encryption in transit and AES-256 encryption at rest.

Access to the production environment is restricted to members of Progressio.ai’s technical team who require access to operate and support the Service. Access to administrative systems and Customer accounts requires authenticated user credentials.

No system can be guaranteed to be completely secure. Users are responsible for protecting their account credentials and for notifying us if they suspect unauthorised access.

7. Retention

We retain Personal Data only for as long as reasonably necessary for the purposes for which it is processed, including to meet legal, contractual, accounting and security requirements.

Customer Data processed through the Service is not retained after the relevant processing is complete, except where retention is required by law or expressly agreed with the Customer.

Audit Results may be retained for the duration of the Customer’s subscription and as otherwise agreed with the Customer. Where a Customer expressly requests that specified excerpts or other source material be retained with Audit Results, those materials remain Customer Data and are retained in accordance with the Customer’s instructions and the applicable contractual terms.

Where Customer Data or Audit Results contain Personal Data, their return, deletion or continued retention is governed by the Data Processing Addendum and applicable data protection law.

Account, billing, support, communications and other Personal Data that Progressio.ai processes as Controller is retained only for as long as reasonably necessary for the relevant purpose, including any applicable legal, accounting, contractual or security requirements.

8. Your rights

Subject to applicable data protection law, you may have the right to:

access Personal Data we hold about you;
request correction of inaccurate or incomplete Personal Data;
request erasure or restriction of processing in certain circumstances;
object to processing based on legitimate interests;
receive certain Personal Data in a portable format where the right to data portability applies; and
withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights in relation to Personal Data for which Progressio.ai acts as Controller, contact us at privacy@progressio.ai.

If your request relates to Personal Data processed by Progressio.ai on behalf of a Customer through the Service, you should normally contact the relevant Customer in the first instance. Progressio.ai will assist the Customer in responding to your request in accordance with our Data Processing Addendum.

If you have concerns about how Progressio.ai has handled your Personal Data, you may make a data protection complaint to us at privacy@progressio.ai. We will acknowledge and handle data protection complaints in accordance with applicable data protection law.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, or, where applicable, another competent supervisory authority.

9. Cookies and similar technologies

Our Website uses cookies and similar technologies for purposes such as providing essential functionality and maintaining security.

We also receive information from our hosting service that helps us understand how the Website is used, including the number of visits and the duration of visits.

Where we use cookies or similar technologies, we do so in accordance with applicable law.

We do not use cookies for cross-site advertising.

You can control or delete cookies through your browser settings. Disabling some cookies may affect the functionality of the Website.

10. Children

The Service is intended for business use and may only be accessed by users aged 18 or over. The Website is not directed at children.

Progressio.ai does not knowingly seek to collect Personal Data from children through the Website or Service. Customer Data may, however, incidentally contain Personal Data relating to a child where that information is included in documentation or records made available by a Customer. In those circumstances, Progressio.ai processes that Personal Data only on behalf of the Customer and in accordance with the Data Processing Addendum.

11. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to the Website, Service, our data-processing practices or applicable law.

When we make a material change, we will update the “Last updated” date at the top of this Privacy Notice and, where appropriate, provide additional notice through the Website, Service or by email.

We encourage you to review this Privacy Notice periodically.

12. Contact us

Progressio AI Limited is the Controller of the Personal Data described in this Privacy Notice where we determine the purposes and means of its processing.

For privacy questions, requests to exercise your data protection rights, or complaints about how we handle your Personal Data, contact us at privacy@progressio.ai.

For security reports, contact security@progressio.ai.

For general enquiries, please use the Contact page on our Website.

Progressio AI Limited is registered in England and Wales under company number 14504332, with its registered office at 9 Hare & Billet Road, London, England, SE3 0RB.