Privacy Policy

2. Scope and relationship with other documents

This Privacy Policy covers personal information that we control in connection with:

• the public website at https://www.progressiverobot.com and any associated subdomains and microsites we operate;
• mobile applications, desktop tools, browser extensions, embedded widgets and APIs we publish;
• customer portals, admin consoles, dashboards, ticketing systems and authenticated areas;
• professional services including software development, web development, mobile app development, IT consulting, cloud engineering, network design, server administration, data centre operations, virtualisation, IT operations, IT service management (ITSM), help desk, ITIL-based service support, change management, asset management, project management, security operations, vulnerability assessment, penetration testing, incident response, business-IT alignment, governance and strategy;
• sales, proposals, statements of work, onboarding, invoicing, renewals and account management;
• marketing, newsletters, events, surveys, webinars, social media and analytics;
• recruitment, supplier qualification, partner programmes and business administration.

This policy works alongside our Cookie Policy, Terms and Conditions, Terms of Use, End User Licence Agreement and any contract, statement of work or data processing agreement that applies to your relationship with us. Where there is a conflict between a signed contract and this policy, the contract wins for that relationship.

3. Controller and processor roles

Progressive Robot Ltd is normally the controller of personal information about prospects, customers, suppliers, applicants, website visitors and recipients of marketing communications. Where we process personal information solely on behalf of a customer (for example, when administering a customer’s servers, applications, databases or end-user accounts) we act as processor. In that case the customer is the controller and our processor obligations are governed by the relevant contract or data processing agreement.

4. Categories of personal information we collect

5. Sources of personal information

We may obtain personal information directly from you, from people authorised by your organisation, from devices and browsers, from cookies and similar technologies, from third-party services (CRM, ticketing, analytics, identity providers, calendar/email integrations), from publicly available sources (Companies House, business directories, professional networks, press), from referrals, from payment and app-store providers, from infrastructure and security tools, and from customers who instruct us to deliver services involving their systems or end users.

6. Purposes and lawful bases

7. Cookies, analytics and similar technologies

We use cookies, pixels, tags, beacons, scripts, SDKs, local storage, session storage, device identifiers, tracking URLs and similar technologies for: site operation, security, consent records, preferences, performance monitoring, error reporting, forms, embedded content, marketing measurement and aggregate analytics. Strictly necessary technologies operate without consent because they are required to deliver the website or a service you request. Non-essential technologies are used where we have a lawful basis, including consent where required. See the Cookie Policy for the full breakdown.

8. Sub-processors and recipients

We use trusted service providers (sub-processors) to operate the Services. Categories include:

• Hosting and infrastructure: cloud platforms, content delivery networks, DNS, edge security and email infrastructure providers.
• Communications: email delivery, calendar, video conferencing, helpdesk and ticketing platforms.
• Security: WAF, anti-bot, EDR, SIEM, vulnerability scanning, certificate, secret management and backup providers.
• Productivity: document, code, design, project management and version control platforms.
• Analytics and marketing: analytics, attribution, newsletter and consent platforms (used where lawful).
• Payments and finance: payment processors, accounting, invoicing and bookkeeping providers.
• Professional services: lawyers, accountants, auditors, insurers and consultants.
• App stores and platforms: Apple App Store, Google Play and similar where applicable.

We do not sell personal information for money. We require sub-processors to maintain appropriate security, confidentiality and data-protection commitments.

9. International data transfers

Some sub-processors, support teams or infrastructure may be located outside the United Kingdom or European Economic Area. Where we transfer personal information internationally we rely on appropriate safeguards, including UK adequacy regulations, the European Commission’s adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Agreement (IDTA) or Addendum, transfer risk assessments, supplementary technical and organisational measures, encryption, pseudonymisation and contractual restrictions on onward transfers.

10. Security measures

We use administrative, technical and organisational measures appropriate to the risk, including, where relevant to a given system:

• Identity and access: role-based access control, least-privilege provisioning, joiner-mover-leaver process, MFA on administrative accounts, password complexity and rotation, SSO where supported, periodic access reviews.
• Encryption: TLS in transit, encryption at rest for managed services that support it, encrypted backups, encrypted device storage, secret management for credentials and API keys.
• Network and platform security: firewalls, WAF, anti-DDoS, rate limiting, bot mitigation, segmentation, hardened images, patching, configuration baselines.
• Application security: secure development practices, dependency scanning, code review, vulnerability management, secret scanning, security testing and (where in scope) penetration testing.
• Logging and monitoring: centralised logs for authentication, administrative actions and security events; alerting for suspicious activity; retention appropriate to risk.
• Backups and resilience: regular backups for systems we operate, periodic restore tests where in scope, separation of environments.
• Supplier management: due diligence on key sub-processors, contractual security commitments, periodic review.
• People controls: confidentiality obligations, role-appropriate training, acceptable use policies, leavers process.

No system is fully secure. You are responsible for protecting your own credentials, devices, networks and user permissions.

11. Personal data breaches

We maintain procedures to detect, contain, investigate and respond to personal data breaches. Where we are the controller and the breach is likely to result in a risk to individuals, we will notify the relevant supervisory authority within the timeframes required by law and, where required, affected individuals. Where we act as processor we will notify the controller without undue delay in accordance with the contract.

12. Retention

We keep personal information only for as long as reasonably necessary. Typical (non-binding) ranges, subject to the actual contract, regulatory regime and legitimate business needs, include:

• Enquiries and prospects: up to 24 months after last meaningful contact.
• Customer contract records and project data: duration of the relationship plus 6 years (or longer where required by law or limitation periods).
• Invoices, tax and accounting records: at least 6 years from the end of the financial year.
• Marketing preferences and consent records: while the preference is current plus a reasonable record of the consent.
• Recruitment records for unsuccessful candidates: typically up to 12 months unless we have your consent to keep them longer.
• Security and audit logs: retained for periods appropriate to risk and any regulatory or contractual requirements.
• Backups: retained on backup cycles and overwritten or deleted in line with normal backup processes.

When information is no longer required we delete, anonymise, aggregate or securely archive it.

13. AI, automation and profiling

We may use automation, analytics and AI-assisted tools to support coding, documentation, support triage, monitoring, diagnostics, productivity, content quality and service improvement. Where AI tools are used:

• they are configured, where reasonably practicable, to avoid using your data to train third-party models;
• sensitive, regulated or confidential information should not be submitted to AI tools unless permitted by contract and law;
• outputs are reviewed by a human before being relied on for material decisions;
• we do not intentionally use personal information to make solely automated decisions producing legal or similarly significant effects unless permitted by law with appropriate safeguards and information.

14. Children

Our Services are intended for business users and people aged 16 or over. We do not knowingly collect personal information from children under 16 without appropriate consent. If you believe a child has provided personal information, contact us so we can investigate.

15. Your rights and how to exercise them

Depending on your location and the circumstances, you may have the right to:

• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion (subject to legal and contractual retention rules);
• restrict or object to certain processing;
• data portability for information you provided to us;
• withdraw consent where consent was the lawful basis;
• object to direct marketing at any time;
• not be subject to a solely automated decision with legal or similarly significant effect, subject to legal exceptions;
• complain to a supervisory authority.

How to make a request. Email [email protected] or write to the address above. Please include the details we need to identify you and respond. We may need to verify your identity. We aim to respond within one month and will tell you if we need longer. There is normally no charge unless your request is manifestly unfounded, excessive or repetitive.

16. Marketing choices

You can unsubscribe from marketing emails at any time using the unsubscribe link or by contacting us. We may still send non-marketing service messages about accounts, contracts, security, invoices, technical issues and policy changes. Cookie choices can be changed using the cookie banner and browser settings.

17. Linked services and content

Our Services may link to third-party websites, plugins, app stores, payment platforms, social networks, video providers, maps, fonts and analytics tools. Their privacy and security practices are governed by their own policies. Review those policies before providing them with personal information.

18. Changes to this policy

We may update this policy from time to time. The updated version will be indicated by a new “Last updated” date and will take effect when posted unless stated otherwise. Material changes may also be notified through the website, app, email or other reasonable method.

19. Contact

For privacy questions, requests or complaints, contact Progressive Robot Ltd at [email protected], contact our representative Christopher Holloway at [email protected], call 01244911212, or write to Progressive Robot Ltd, 220 Chester Business Park, Heronsway, Chester, Cheshire CH4 9GB, United Kingdom. You may also lodge a complaint with the Information Commissioner’s Office at https://ico.org.uk.