MARSHYOS LTD – PRIVACY POLICY

This privacy policy applies to MarshyOS Ltd Company No. 16993500, with our registered office at 3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE. Our ICO registration number is ZC085281 (we, us or our). We are committed to protecting your privacy. This policy explains how we collect, use and share your personal data. It applies to all personal data we handle, whether we collect it through our website, in person, or through other means.

Information we collect

Identity and contact details

Name, address, email address and phone number

Professional details

Google sign-on credentials and OAuth Tokens

Service related information

Transaction details for products and services you've purchased from us or enquiries about our products and services

Your preferences for our services and your marketing preferences and where relevant information related to loyalty programmes

Prompts, messages, and conversations you submit to MarshyOS for processing

Feedback, complaints and compliments and survey responses

Financial and payment information

Payment details for products and services you've purchased from us (including where relevant, credit reference information) and where relevant banking or payment card information

Digital information

IP address and general location information derived from your IP address

Search and browsing behaviour and user journeys

Website usage patterns

Cookie preferences and tracking

Recordings

Call recordings

Records of meetings and decisions

Professional information (for job applicants and workers)

Employment history

Professional experience

Required authorisations and licences

Professional registrations

Information about your right to work in the UK

Enterprise client data

When you use MarshyOS as part of an enterprise account, your organisation acts as the data controller for any personal data (including special category data such as health information) that you input into the platform. We process this data on behalf of your organisation as a data processor.

How we collect personal data

Directly from you when you: create an account, interact with us, contact us, fill out forms, or submit prompts and conversations to our platform

Automatically when you: visit our website, use our technologies, interact with our online services.

From third parties: service providers (including Google for single sign-on authentication), business partners, organisations or people authorised by you

From your organisation: if you access MarshyOS through an enterprise account, we may receive your information from your employer or organisation

How we use your information

Data protection law requires us to have proper legal reasons for using your personal data. We can only use your information when we have one or more of these legal bases.

Consent - You have clearly agreed to us using your personal data for a specific purpose.

Performance of a contract - We need to use your information to fulfil a contract with you, or because you've asked us to do something before entering into a contract.

Legal duty - We must use your information to comply with the law.

Vital interests - We need to use your information to protect someone's life.

Public interest - We need to use your information to perform a task in the public interest or carry out official functions that have a clear legal basis.

Legitimate interests - We have a genuine business reason to use your information, or a third party does, but only if this doesn't unfairly override your rights and interests. Where we rely on legitimate interests as our legal basis, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms. These assessments consider:

The nature of our legitimate interest

The impact on you

Any safeguards we can implement

Your reasonable expectations

The broader context of our relationship

Note that we may process your personal data for more than one legal basis depending on the specific purpose for which we are using your data. We have listed the reasons we process your data and the legal basis below. Please reach out to us if you need further details about the specific legal basis we are relying on to process your personal data.

Managing your account and providing our services

What we use your information for:

To enable you to access and use our AI-powered clarity platform, including providing login credentials and authentication through Google sign-inTo provide our services to you, including dispatch and delivery of products, event registration, appointment management

To process and respond to your prompts and provide AI-generated scores and recommendations

To provide our services to you

To contact and communicate with you about our services, including responding to support requests and enquiries and for dealing with complaints or claims

Internal record keeping, administrative, invoicing and billing purposes

Legal basis for using this information:

Performance of a Contract

Legal Duty (for billing and record-keeping requirements)

Legitimate interests

Types of information we use:

Identity and contact details

Service related information

Financial Information

Digital information

Client onboarding and verification

What we use your information for:

To assess whether to take you on as a new client, including performing anti-money laundering, anti-terrorism, sanction screening, fraud and other background checks

Legal basis for using this information:

Performance of a Contract

Legal Duty

Public Interest

Legitimate interests

Types of information we use:

Identity and contact details

Financial information

Website enquiries and customer service

What we use your information for:

To contact and communicate with you about any enquiries you make with us via our website

Legal basis for using this information:

Legitimate interests

Types of information we use:

Identity and Contact Data

Digital Information

Business improvement and development

What we use your information for:

Analytics including profiling on our website

Market research and business development

To operate and improve our services, associated applications and associated social media platforms

To analyse usage patterns to improve our AI models and user experience

Legal basis for using this information:

Legitimate interests

Types of information we use:

Digital Information

Service related information (in aggregated or anonymised form where possible)

Marketing and communications

What we use your information for:

To send you promotional information about our events and experiences and information that we consider may be of interest to you

To send you technical notices, updates, and support messages

To run promotions, competitions and offer additional benefits to you

Legal basis for using this information:

Legitimate interests

Types of information we use:

Identity and Contact Data

Digital Information

Recruitment and employment purposes

What we use your information for:

To consider your application if you have applied to work with us and to keep you up to date with its progress

In relation to self-declared disabilities in order for us to make a reasonable adjustments to support your application and any possible future employment

In relation to any diversity or equal opportunities monitoring questionnaire data, to monitor and report on our equality and diversity composition and ensure fairness in the recruitment process

In relation to any right to work information we collect, in order to ensure we comply with the law in employing you

To keep you updated on any other suitable vacancies

Legal basis for using this information:

Legitimate interests

Legal Duty

Consent

Performance of a Contract

Types of information we use:

Identity and Contact Data

Professional Data

Legal compliance

What we use your information for:

Comply with our legal obligations or if otherwise required or authorised by law

Legal basis for using this information:

Legal Duty

Types of information we use:

All relevant Personal Data

Automated decision making and profiling

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Where we use automated decision-making, we will:

Inform you of the logic involved

Explain the significance and envisaged consequences

Provide you with the right to human intervention

Allow you to express your point of view

Enable you to contest the decision

Our disclosures of personal data to third parties

We may disclose personal data to:
Service providers
IT service providers including Anthropic (Claude AI) and Google (Gemini AI, Google Analytics, Google Sign-In/OAuth)
Data storage providers
Web hosting and server providers including Vercel Inc.
Payment processors including Stripe
Marketing and advertising providers
Analytics providers including Google Analytics
Professional advisers
Bankers
Auditors
Insurers and insurance brokers
Legal advisers
Business partners
Our existing or potential agents
Our business partners or contractors
Corporate transactions
If we merge with or are acquired by another company, or sell our business assets:
Your information may be disclosed to our advisers
Your information may be disclosed to the potential purchaser's advisers
Your information may be included in the transferred assets
Legal and regulatory bodies
Courts and tribunals
Regulatory authorities including as required for reporting obligations
Law enforcement officers
Other parties
Third parties you have authorised
Emergency services when necessary
Any other parties as required or permitted by law

Overseas transfers

Where we store and access your information
We store your personal data in the United Kingdom. However, your information may be transferred to locations outside the United Kingdom in these circumstances:

When our service providers are located overseas

When we work with overseas business partners

When using cloud-based services or data storage solutions

When required by law or legal proceedings

Our approach to overseas transfers
When we transfer your personal data outside the United Kingdom, we ensure it receives appropriate protection by:
Only transferring your information to countries that UK data protection law recognises as providing adequate protection for personal data, or
Putting in place a contract with the third party that means they must protect personal data to the same standards as the UK.
Transferring personal data to organisations that are part of specific agreements on cross-border data transfers with the UK.
What this means for you
We only transfer the minimum amount of personal data necessary and require all recipients to:
Protect your information to the same standards required by UK law
Use your information only for the purposes we've agreed
Allow us to monitor how they handle your information
Provide you with the same rights over your information that you have under UK law

Children’s Personal Data

We do not knowingly collect or process personal data from children under 13 years of age without appropriate parental or guardian consent.
If you are under 13, please do not provide personal data to us without first asking your parent or guardian for permission.
If we become aware that we have collected personal data from a child under 13 without verified parental consent, we will take steps to delete that information as quickly as possible.
Parents and guardians have the right to:
Review any personal data we hold about their child
Request correction or deletion of their child's personal data
Refuse or withdraw consent for further collection or use of their child's data
Contact us with any concerns about their child's privacy
If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately using the details provided in this policy.

Data retention

How long we keep your information
We only keep your personal data for as long as we need it to:
Provide our services to you
Meet our legal, tax, accounting or regulatory obligations
Handle any complaints or legal issues that may arise
We may keep your information for longer periods if:
You make a complaint that we need to investigate or respond to
We reasonably believe legal action involving our relationship with you might occur
The law requires us to keep it for specific timeframes
How we decide retention periods
When determining how long to keep your information, we consider:
How much information we have and how sensitive it is
The risk of harm if the information was accessed without permission
Whether we can achieve our purposes in other ways
What legal, regulatory, tax or accounting rules require
The nature of our relationship with you and the services we provide
What happens when we no longer need your information
Once we no longer need your personal data, we will securely delete or destroy it in accordance with our data retention policies and legal requirements.
Your Rights
You can request information about retention periods for your data and ask for early deletion where legally possible.

Your privacy rights and choices

Providing information

You can choose whether to provide personal data to us, however, if you don't provide certain information, we may not be able to provide some services. Let us know if you don’t want to provide information and we will let you know when information is required versus optional.

Right of Access

You have the right to ask us for copies of your personal data. You can request other information such as details about where we get personal data from and who we share personal data with. There are some exemptions which means you may not receive all the information you ask for.

Right to Rectification

You have the right to ask us to correct or delete personal data you think is inaccurate or incomplete.

Right to Erasure (“Right to be forgotten”)

You can request deletion of your personal data in certain limited circumstances as set out in data protection law, such as where the data is no longer necessary or has been unlawfully processed. This right is not absolute and we may be required or entitled to retain your data for legal, regulatory or legitimate business reasons.

Right to Restrict Processing

You can ask us to suspend processing where:

You contest the accuracy of the data

Processing is unlawful but you don't want erasure

We no longer need the data but you need it for legal claims

You've objected to processing pending verification of our legitimate grounds

Right to opt-out of marketing communications

You can opt-out of receiving marketing communications at any time. Each marketing communication will include an unsubscribe option. You can change your marketing preferences by contacting us. We will process your request as soon as practicable.

Right to Data Portability

Where technically feasible, you can receive your personal data in a structured, commonly used format or have it transmitted to another controller where:

Processing is based on consent or contract

Processing is automated

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

How to Exercise Your Rights

To exercise any of these rights, contact us using the details below. We may ask for proof of identity and will respond within one month (extendable to three months for complex requests).

These rights are available under data protection law, though some may not apply in every situation. We'll let you know if any limitations apply when you make a request.

Making a complaint

If you have concerns about how we handle your information.

If you're unhappy with how we've used your personal data, please get in touch with us first using the contact details at the end of this policy. When you contact us:

Give us full details about your complaint

We'll investigate your concerns promptly

We'll respond to you in writing explaining what we found and what we'll do to address your complaint

Your right to complain to the regulator

You can also make a complaint directly to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time.

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

You don't have to contact us first before going to the ICO, but we'd appreciate the opportunity to try to resolve your concerns directly with you.

Protecting your information

We use multiple layers of security to protect your information.

Technical safeguards

256-bit SSL/TLS encryption for all data in transit

Enterprise-grade encryption for data storage and transmission

Encrypted storage for sensitive data at rest

Access controls and authentication requirements

Secure API key management through environment variables

Regular security testing and monitoring

Automated threat detection systems

Operational security

Staff training on security and privacy

Strict access controls based on job requirements

Regular security audits and incident response procedures testing

Physical security

Secure premises with controlled access

Secure disposal of physical documents

Equipment security protocols

Public information

Please note that any information you choose to share publicly on online platforms (such as comments or reviews) can be accessed and used by others. We cannot control or protect information that you make publicly available.

Cookies and analytics

Cookies and pixels

We may use cookies and similar tracking technologies on our website to enhance your browsing experience and improve our services.

What are cookies?

Cookies are small text files that are stored on your device when you visit our website. They help us remember your preferences and understand how you use our site.

Types of cookies we use

Essential cookies: Necessary for the website to function properly

Performance cookies: Help us understand how visitors interact with our website

Functionality cookies: Remember your preferences and settings

Marketing cookies: Used to deliver relevant advertisements and track campaign effectiveness

Cookie consent

When you first visit our website or platform, you will see a cookie notice explaining our use of cookies. You can choose which types of cookies to accept through our cookie preference centre. You’ll find more information about the cookies we use in our cookie pop-up.

Managing your preferences

You can change your cookie preferences at any time by:

Using our cookie preference centre on the website or platform

Adjusting your browser settings to refuse or delete cookies

Visiting our cookie policy for detailed information about specific cookies

Please note that disabling certain cookies may affect the functionality of our website and your user experience. Our full cookie policy can be accessed here marshyos.com/cookie-policy.

Google Analytics

We use Google Analytics to understand how people use our website. This involves cookies that collect information about your browsing activity. You can opt out of Google's advertising features through your Google account settings, browser add-ons, or your device's privacy settings. Google provides various tools and options to control how your data is used for advertising purposes. You can learn more about how Google uses your data and your available options on Google's privacy pages.

When you sign in with another account (like Google)

What we collect

When you use Google single sign-on to connect with us, we'll receive personal data from that provider based on your privacy settings with them. This may include your name, username, profile picture, and other details you've chosen to share.

How we use it

We use this information to create your profile on our platform and give you access to our services.

Your rights

If you connected through Google, you can ask us to delete the personal data we received from Google. To do this, email us at our email below and tell us what information you'd like deleted. If we can't delete certain information, we'll explain why.

Artificial Intelligence (AI) Technologies

MarshyOS is an AI-powered clarity platform built on artificial intelligence and machine learning technologies provided by leading third-party AI providers. AI is fundamental to our core service of delivering decisive, boardroom-ready recommendations with scores for complex corporate issues in pharma, law, biotech and other sectors.

We use AI technologies to:

Process your prompts and queries to generate decisive recommendations and scores

Analyse complex corporate scenarios and provide structured decision-making support

Generate boardroom-ready outputs including figures, analysis and next steps

Calculate scores (our trademarked metric) to indicate confidence levels in recommendations

Conduct analysis and data processing of the information you provide

Improve and optimise our AI models to enhance accuracy and relevance of outputs

Personalise your experience with our services based on your usage patterns

Support quality assurance processes to maintain output quality

Third-party AI providers

We use the following third-party AI services to power MarshyOS:

Anthropic (Claude): For AI processing, analysis and generation of recommendations

Google (Gemini): For AI processing, analysis and generation of recommendations

Both providers process your prompts and conversation data to generate the scores and recommendations that form our core service.

Data protection and security

When we work with third-party AI providers (Anthropic and Google), we ensure they handle your personal data in accordance with UK data protection laws through contractual requirements and appropriate safeguards

Your prompts, queries and conversations are transmitted to and processed by our AI providers to generate responses

We implement appropriate technical and organisational measures to maintain the security and integrity of your personal data during AI processing

Data processed through our AI providers is subject to their respective privacy policies and data protection measures

Your rights and our commitments

Any information generated or inferred about you by AI technologies is treated as personal data, and you maintain all the rights outlined in this privacy policy.

Transparency and control

We'll inform you when AI is used to make decisions that may significantly affect you

We maintain human oversight and review of significant AI-generated decisions

Our staff are trained to understand AI limitations and verify outputs before relying on them

We implement processes to verify the accuracy of AI-generated outputs

Security and accuracy

We use appropriate technical and organisational measures to maintain the security and integrity of your personal data during AI processing

We regularly test and monitor AI outputs for accuracy and reliability

We implement processes to identify and address potential issues with AI-generated outputs

We continuously work to improve our AI models and their performance

Risk mitigation

We regularly assess and document risks associated with using AI to process personal data

We implement appropriate measures to address identified risks

We continuously monitor AI performance and regularly review the impact of our AI systems

We maintain oversight of our third-party AI providers' data protection practices

Amendments

We may update this policy at any time by posting the revised version on our website or platform. We recommend that you review our website or platform regularly to stay current with any policy changes.

Our contact details

Privacy contact email: Support@marshyos.com