Privacy Policy

This Privacy Policy explains how Pluggiq Limited ("Pluggiq", "we", "us" or "our") collects, uses, shares and protects personal data when you visit our website at pluggiq.com (and any associated domains, including pluggiq.netlify.app) (the "Website"), contact us, book a call, subscribe to our updates, create an account, buy our services, or otherwise interact with us.

We are not required to appoint a Data Protection Officer, but Kunal Parnami is responsible for overseeing our compliance with data protection law and for dealing with any questions about this Privacy Policy.

We handle personal data in accordance with the laws that apply throughout the United Kingdom, including:

• the UK General Data Protection Regulation ("UK GDPR"), as retained in UK law by the European Union (Withdrawal) Act 2018;
• the Data Protection Act 2018;
• the Data (Use and Access) Act 2025, which amends the UK GDPR, the Data Protection Act 2018 and PECR; and
• the Privacy and Electronic Communications Regulations 2003 ("PECR"), which govern cookies and electronic marketing.

Data protection is a reserved matter, so these laws apply equally in England, Wales, Scotland and Northern Ireland, and the Information Commissioner's Office ("ICO") is the regulator for the whole of the UK. Where this policy refers to periods set by other laws (for example, limitation periods for legal claims), those periods can differ between England and Wales, Scotland and Northern Ireland, and we apply the rules relevant to you. Nothing in this policy affects your statutory rights.

Pluggiq acts in two different capacities, and it matters which one applies to you:

• As a controller. We decide how and why personal data is used when you visit our Website, enquire about our services, book a call, subscribe to updates, use the live chat, create an account or pay for our services. This Privacy Policy mainly covers this activity.
• As a processor. When an accounting, bookkeeping or other professional practice (a "Client Practice") uses our AI agents ("Plugs", such as Scout, Pip and Neil) and related services, we process personal data about that practice's own clients, staff and contacts on the practice's behalf and on its instructions. In that situation the Client Practice is the controller, and its own privacy notice applies. Section 10 explains more.

4.1 Information you give us

4.2 Information we collect automatically

4.3 Information we receive from other sources

• Public sources, such as Companies House, the websites of accounting practices and professional directories, for example to confirm the details of a business that has contacted us.
• Professional networking sites (such as LinkedIn), where you have a public business profile or have interacted with us.
• Referrals from people or businesses who recommend us and pass on your business contact details.
• Service providers we use, such as our payment processor (confirming that a payment has been made) and our scheduling tool (confirming a booking).

4.4 Special category and criminal offence data

We do not ask for, and ask you not to send us, "special category" data (for example, information about health, racial or ethnic origin, religious beliefs or political opinions) or information about criminal convictions through our Website, contact form or live chat. If you provide it anyway, we will only use it where the law allows, or we will delete it. Where our Plugs process identity documents or anti-money laundering (AML) checks for a Client Practice, we do so as a processor, under the Client Practice's lawful basis and our data processing agreement with it (see section 10).

4.5 If you do not provide personal data

Where we need personal data to respond to you, to provide an account or to perform a contract with you, and you do not provide it, we may be unable to respond to your enquiry, create your account or provide the services.

We must have a lawful basis under Article 6 of the UK GDPR for each use of personal data. The table below sets out what we do, and why.

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms, taking into account that the individuals we deal with are mainly business contacts. You can ask us for more information about this assessment, and you have the right to object (see section 15).

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of anything we did before you withdrew it.

We will only use your personal data for a new purpose if it is compatible with the original purpose, if you consent, or if the law otherwise allows it. We will tell you before we do so where required.

Cookies are small text files placed on your device. We also use similar technologies such as local storage, pixels and scripts. Under PECR, we must ask for your consent before placing cookies that are not strictly necessary.

• Strictly necessary cookies make the Website work, keep it secure, remember your cookie choices, keep you logged in to your account and allow our payment provider to prevent fraud. These do not require consent.
• Analytics cookies help us understand how visitors use the Website (for example, which pages are most visited). We only set these with your consent.
• Functional cookies support features such as live chat and the call-booking widget, and remember choices you make. Where they are not strictly necessary for a service you have requested, we ask for your consent.
• Marketing cookies (if used) help us measure the effectiveness of campaigns. We only set these with your consent.

When you first visit the Website, a cookie banner lets you accept or reject non-essential cookies. You can change your choices at any time using the "Cookie settings" link in the Website footer, or by adjusting your browser settings. Blocking some cookies may affect how the Website works.

Details of the specific cookies we use, including the provider, purpose and how long each cookie lasts, are available on request by emailing kunal@pluggiq.com.

We send marketing emails, newsletters and product updates in line with PECR:

• If you sign up to our newsletter or updates, we will send them to you with your consent.
• If you are an existing customer or have negotiated with us to buy our services, we may send you information about similar services of ours (the "soft opt-in"), with a clear chance to opt out every time.
• If you use a corporate email address (for example, name@yourpractice.co.uk), we may send you relevant business-to-business marketing on the basis of our legitimate interests, always identifying ourselves and giving you an easy way to opt out.

You can unsubscribe at any time by clicking the "unsubscribe" link in any marketing email or by emailing kunal@pluggiq.com. We will keep a minimal record of your email address on a suppression list so that we do not contact you again. We never sell your personal data, and we do not share it with third parties for their own marketing.

Our Website offers live chat, which may be answered by a member of our team or by an AI-assisted chatbot. We will make clear when you are interacting with an automated assistant, and you can ask to speak to a person. Chat messages are recorded so that we can respond, follow up and improve the quality of our answers.

Please do not share sensitive personal data, client files, financial account details, passwords or identity documents through live chat. The chatbot provides general information only and does not make decisions about you.

Payments for our services are processed by Revolut Business. Where you pay by card or through a payment link, your payment details are entered directly into Revolut's secure systems; we do not see or store your full card number or security code. We receive confirmation of payment and limited transaction details (such as the amount, date, payer name and the last four digits of the card). Revolut may also use your data for its own fraud-prevention, anti-money laundering and regulatory purposes as an independent controller, under its own privacy notice.

When a Client Practice uses our Plugs and related services, we may process personal data about that practice's clients, their directors, employees and contacts, and the practice's own staff. This can include names and contact details, financial records and source documents, tax and accounting information, information obtained from Companies House and HMRC through authorised connections, correspondence, and identity and verification information for AML checks.

• The Client Practice is the controller and decides the purposes of the processing. We act as its processor under a written data processing agreement that meets Article 28 of the UK GDPR.
• We only process that data on the Client Practice's documented instructions, and we keep it confidential and secure.
• We do not use Client Practice data, or data about its clients, to train AI models, and we require our AI and technology sub-processors to contractually commit not to do so.
• Our Plugs are designed so that nothing is filed, sent or paid without human approval from the Client Practice.
• We use sub-processors only with the Client Practice's authorisation and under contracts that impose equivalent data protection obligations.
• At the end of our services, we delete or return the data in accordance with the data processing agreement, unless the law requires us to keep it.

If you are a client of a practice that uses Pluggiq and you want to exercise your data protection rights, please contact that practice directly. If you contact us, we will pass your request to the practice and help it respond.

We do not make decisions about you based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you. Our AI tools assist people; a human reviews and approves outputs before they are acted on.

If this changes, we will tell you in advance and provide the safeguards required by Articles 22A to 22D of the UK GDPR (as inserted by the Data (Use and Access) Act 2025), including the right to be informed about the decision, to make representations, to obtain human intervention and to contest the decision.

We share personal data only where necessary, and only with:

• Service providers acting as our processors, who provide Website hosting, cloud infrastructure, email and newsletter delivery, customer relationship management, call scheduling, live chat, analytics, AI model services, IT support and security. They may only use personal data on our instructions and under contract.
• Payment providers, to process payments (see section 9).
• Professional advisers, such as our accountants, lawyers, auditors and insurers, under duties of confidentiality.
• Regulators, HMRC, law enforcement, courts and other public authorities, where we are required or permitted by law.
• Potential buyers, investors or successors, and their advisers, in connection with a sale, merger, investment or restructuring of our business, under confidentiality obligations. If ownership changes, the new owner may use your data in line with this policy.
• Client Practices, where you are a client or contact of that practice and we process data on its behalf (see section 10).
• Anyone else, with your consent or at your request.

We aim to store and process personal data in the United Kingdom or the European Economic Area (EEA). The UK recognises the EEA as providing adequate protection for personal data.

Some of our service providers may be based in, or access data from, countries outside the UK and EEA (for example, the United States). Where personal data is transferred outside the UK, we make sure it is protected by one of the following safeguards:

• the country is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for US organisations certified under it);
• the ICO's International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment; or
• another transfer mechanism or exception permitted under the UK GDPR.

You can contact us for more information about the safeguards we use and, where applicable, a copy of them.

We keep personal data only for as long as necessary for the purposes set out in this policy, including to meet legal, accounting and reporting requirements. When data is no longer needed, we securely delete or anonymise it.

Under UK data protection law you have the following rights, subject to certain conditions and exemptions:

• Right to be informed about how your personal data is used (this policy).
• Right of access: to receive a copy of your personal data and information about how it is used. We will carry out reasonable and proportionate searches to respond.
• Right to rectification: to have inaccurate data corrected and incomplete data completed.
• Right to erasure ("right to be forgotten"): to have your data deleted in certain circumstances.
• Right to restrict processing: to ask us to limit how we use your data, for example while we check its accuracy.
• Right to data portability: to receive data you provided to us in a structured, commonly used, machine-readable format, or have it transmitted to another organisation, where processing is based on consent or contract and carried out by automated means.
• Right to object: to processing based on legitimate interests, and an absolute right to object to direct marketing at any time.
• Rights related to automated decision-making, as described in section 11.
• Right to withdraw consent at any time, where we rely on consent.
• Right to complain to us and to the ICO (see section 16).

To exercise any of these rights, email kunal@pluggiq.com with the subject line "Privacy", or write to us at our registered office. We may need to verify your identity before responding. There is normally no fee. We will respond within one month of receiving your request (or of receiving any information we need to verify your identity). If your request is complex or you have made several requests, we may extend this by up to two further months and will tell you why. We may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive.

If you are unhappy with how we have handled your personal data, please complain to us first at kunal@pluggiq.com (subject line "Privacy complaint") or by post to our registered office. In line with the Data (Use and Access) Act 2025, we will acknowledge your complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed of progress, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, which covers England, Wales, Scotland and Northern Ireland:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• The ICO also has regional offices for Scotland, Wales and Northern Ireland; contact details are available on the ICO website.

The ICO generally expects you to have raised your complaint with us first. You may also have the right to seek a remedy through the courts of England and Wales, Scotland or Northern Ireland.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration, including:

• encryption of data in transit (TLS/HTTPS) and at rest where supported by our providers;
• role-based access controls, so that only authorised staff who need access have it, with documented permissions;
• multi-factor authentication and hashed passwords;
• audit logging and monitoring, and the ability to pause or switch off any AI agent immediately (a "kill switch");
• confidentiality obligations for our team and contractors, and due diligence on our service providers; and
• a process for identifying, managing and, where required, reporting personal data breaches to the ICO within 72 hours and notifying affected individuals without undue delay.

No method of transmission over the internet is completely secure, but we work hard to protect your data and review our measures regularly.

Our Website and services are designed for businesses and professionals and are not directed at children. We do not knowingly collect personal data from anyone under 18 through our Website. If you believe a child has provided us with personal data, please contact us and we will delete it.

Our Website may contain links to third-party websites, plug-ins and services (for example, LinkedIn or our booking calendar). We are not responsible for their privacy practices. Please read their privacy notices before providing personal data to them.

Please let us know if your personal data changes during your relationship with us, so that the information we hold remains accurate and up to date.

We may update this Privacy Policy from time to time to reflect changes to our services, our service providers or the law. The "Last updated" date at the top shows when it was last changed. Where changes are significant, we will notify you by email (if we have your address) or by a notice on our Website before they take effect.

If you have any questions about this Privacy Policy or how we handle personal data, or you would like this policy in an alternative format (for example, large print), please contact us: