This privacy notice is here to tell you what information we collect about you, what we do with that information and why we do it, who we share it with, and how we protect your privacy.

This notice covers all personal data collected by Artificial Labs Ltd and where we tell other organisations to collect information for us (for example if you are a visitor of our website, or if you are receiving our services). This is the same whether the information is collected by letter, email, face to face, telephone or online. It does not apply to data that we process only on behalf of our customers.

It also explains what data protection rights you have, including the right to object to some of our use of your data – more information on this is set out in the "Your rights" section below.

Personal data is information about a living, identified or identifiable person. This can be obvious information like name and address, or it may be something like an Internet Protocol (IP) address, browser type, etc.

This also includes information you tell us about yourself, information we are given by other people or organisations, or what we learn by having you as a client.

We must take extra care when collecting and using these types of information. Generally the personal data we collect falls into the following categories:

• Identity Information – such as your name and login credentials, and your role within your company.
• Contact Information – such as your email address and phone number.
• Device Information – information about your device or browser, including your IP address.
• Analytics Information – information about your activity in our services, including details of your user experience with our products.

We use personal data in many ways so that we can deliver our services. We can only do this if we have a proper reason or 'legal basis' to do so. In most cases, it is because you have asked us to deliver a service.

We use personal data for the following reasons, and using the following legal bases:

As you see above there are instances where we have a legitimate interest to use your data. Our legitimate interest will vary depending on what we are using your data for, and we explain above what the interest is and how it relates to the processing operations that we are carrying out. Where we process personal data based on a legitimate interest, then – as required by data protection law – we have carried out a balancing test considering what the impact of the processing will be on individuals and to determine whether individuals' interests outweigh our interests in the processing taking place.

The provision of your personal data is generally required, unless we ask for consent, and if you do not provide it we will be unable to provide you with our services.

We do not share your personal information with any people or organisations unless they are providing services to us under contract or where providing that information is allowed by, or required by, law. This may include:

We may share your information with third parties that perform services for us or on our behalf, including data analysis, email delivery, hosting services, customer service, and marketing assistance.

We may also share personal data:

• With auditors or other professional advisers.
• Where we are required by law, including with government or law enforcement bodies, and where requested by regulators.
• Prospective buyers or sellers in the event the business is sold or integrated with another business (in which case your data may be disclosed to our advisers and theirs and passed to any new owners).

We transfer your personal data outside of the UK to provide certain technology systems and for our own internal administration. Some of these countries, including members of the European Economic Area (Ireland, Luxemburg) and the US (commercial organisations participating in the EU-US Data Privacy Framework) have been recognised by the UK Government as providing an adequate level of data protection. We rely on these decisions for transfers to these locations.

We also transfer your personal data to some third countries which have not been recognised in the same way. These include the US. In these cases, we take steps to ensure that your personal data is appropriately protected, including by adopting standard contractual clauses (SCCs) approved by the UK Government. For more information about this you can contact us by using the contact details below.

We regularly use personal data such as Device Data to look at how people are using our services and whether we are performing well. This may be assessments that we do within our services, or we might contact you to ask you for feedback on our services.

This helps us to improve the way we deliver services to you, and to plan the best way to deliver services. As explained above, we rely on our legitimate interests for this.

We may need to use personal information across all our services to help to prevent and detect crime and fraud. The law allows us to use and share personal data so that this can be done. We may be required to share information with organisations like the police or professional bodies like those that regulate a particular type of job, such as solicitors.

Individuals like you (data subjects) have rights under data protection laws to control what information you provide to us and what we can do with it.

You have the following data protection rights:

• You can ask for access to the information we hold about you (and to receive a copy of it) (a Subject Access Request).
• You can ask us to change information you think is inaccurate or incomplete (e.g., we've misspelled your name).
• You can ask us to delete information (sometimes called the right to be forgotten) in some circumstances, such as:
  • where your personal information is no longer needed for the reason it was collected in the first place;
  • where you have removed your consent for us to use your information (where there is no other legal reason for us to use it);
  • where there is no legal reason for the use of your information; or
  • where deleting the information is a legal requirement.
• You can object to our use of your personal data when it is based on our legitimate interests, including for direct marketing purposes or profiling – and we will stop processing it unless we have compelling legitimate grounds which override your right, or it is needed for legal claims.
• You may be able to ask us to port your data to you or a third party in limited circumstances.
• If you have given us your consent to something, you can withdraw that consent at any time – this will not affect the lawfulness of our use of the data based on the consent before you withdrew it.

These rights may be limited, for example:

• The law tells us that we can withhold information from you where it also contains confidential information about other people or may stop us from preventing or detecting crime.
• We may not always be able to change or remove information you believe to be inaccurate but we'll correct factual inaccuracies and may include your comments in the record to show that you disagree with it.
• We cannot always delete your information, for example, if there is a legal reason we need to keep it or where you still expect us to deliver a service to you. But we should tell you why we can't delete what you are asking us to.

We aim to respond to requests within one month unless your request is large or complicated, when we are allowed to take longer to respond to you. More details on your full rights under the data protection law can be found on the ICO website www.ico.org.uk

Alternatively, you can complain to us directly using the contact details set out below – we will acknowledge your complaint within 30 days and investigate your concerns.

Where we process personal data related to providing our services to you, we do this for as long as you are an active customer and for 6 years after this.

Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data so that we can respect your request in future.

When someone visits our website we collect routine internet log information, which allows us to see visitor behaviour patterns. We do this to determine which pages are being viewed as this assists us in improving our website.

Internet log information is collected in a way which doesn't allow us to directly identify you and we do not make any attempt to find out the identities of individuals visiting our site.

The 'data controller' for your personal data is Artificial Labs Limited.

If you have any questions or worries about how the company collects or uses your personal data you can contact us at privacy@artificial.io.

For independent advice about data protection and privacy, you can contact the Information Commissioner's Office (ICO). The ICO oversees how organisations comply with data protection legislation in the UK:

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.

Alternatively, visit www.ico.org.uk or email casework@ico.org.uk

We will update this privacy notice when how we collect and use your information changes. We encourage you to check this privacy notice before providing us with any personal information. We reserve the right to update or change our privacy notice at any time.