Privacy notice

1. Who we are

plene.ai ltd is a company registered in England and Wales, company number 12279132, registered office Suite 22, Trym Lodge, 1 Henbury Road, Westbury-on-Trym, Bristol BS9 3HQ. We are the data controller for the personal data described in this notice. ^*

^*ICO

You can contact us about anything in this notice at hello@plene.ai or by post at the registered office. We have not appointed a data protection officer because we are not required to, but the director responsible for data protection can be reached at the same address.

2. What data we collect and where it comes from

This website. If you allow analytics cookies, Google Analytics 4 collects your approximate location (derived from a truncated IP address), device and browser type, the pages you view, how long you spend on them, what you click and where you arrived from. Google Tag Manager loads the analytics script. Neither loads until you accept the cookie banner. Our hosting provider keeps standard web server logs, including full IP addresses, for security.

The contact form. Your name, company, work email address, phone number if you give it, what you are interested in, your message, the page you sent it from and the site that referred you.

Phone calls. Our phone line is answered 24 hours a day by Katie, our AI assistant. Calls are transcribed as they happen; no audio recording is kept. We collect the number you call from, the date, time and length of the call, the transcript, and the notes the assistant makes, which will include your name, company and reason for calling if you give them. You are told at the start of every call that it is answered by an AI assistant and transcribed, as UK GDPR's right to be informed requires.^* If you do not want the call transcribed, end the call and email us instead.

^*ICO

Email and meetings. Whatever you include in correspondence with us, and notes we take in meetings and calls with you.

Client engagements. When we prepare a report or a bid for a client we process the material the client gives us, which may include employees' names, roles, qualifications and CVs, and details of the client's customers and suppliers.

Public registers. Our reports use information published by Companies House about companies and their officers and persons with significant control, and information in published procurement notices, which may name buyer contacts. This is personal data about people who are not our clients. We use it only for the purpose it was published for: understanding a company's filings and ownership, and identifying who to contact about a procurement.

We do not collect special category data (such as health or ethnicity) and we ask you not to send it to us. We do not knowingly collect data from anyone under 18; our services are for businesses.

3. Why we use it and our lawful basis

Where we rely on legitimate interests we have considered whether our use of your data is what you would reasonably expect and whether it affects your rights, and concluded that it does not override them. You can object to any processing based on legitimate interests (section 8).^*

^*ICO

Marketing. We may occasionally email you about our services if you have enquired, worked with us, or are a business contact whose role is relevant to what we do. For people at limited companies and other corporate bodies we rely on legitimate interests; for sole traders and partnerships we ask for consent first. Every such email includes an unsubscribe link, and you can also opt out by replying or emailing hello@plene.ai; we act on that immediately and keep a record so you are not contacted again.^* If we use a third-party mailing platform to send these emails, it will be named in section 5. We do not sell your data and we do not share it with advertisers.

^*ICO

4. How long we keep it

• Call transcripts and notes: 12 months from the date of the call, then deleted.
• Contact form submissions and email enquiries: 12 months from the last contact, then deleted, unless an engagement follows or you have agreed to hear from us.
• Marketing opt-outs: kept indefinitely, as a suppression record, so we do not contact you again.
• Client engagement material: for the length of the engagement and 12 months after it ends, then deleted. Anonymised worked examples derived from an engagement may be kept longer, with all names and identifying details removed.
• Analytics data: 14 months in Google Analytics (its retention options are 2 or 14 months; we choose the longer so year-on-year comparison is possible), then deleted automatically.^{* *}Google
• Server logs: 30 days.
• Contracts, invoices and records we are legally required to keep: 6 years after the end of the financial year they relate to.

5. Who we share it with

Our phone assistant, Katie, is software we built and run ourselves, on our own servers in the United Kingdom, using language models we host locally. No third party operates her or transcribes the calls, and your side of the conversation, the transcript and the call notes never leave the UK. She is not a processor; she is us.

One exception is her voice. The sentences Katie speaks are generated as text on our servers and turned into speech by a speech synthesis provider in the United States. Only the text of her own replies is sent, and only when a sentence has not been voiced before (common phrases are kept in a local cache and reused). Nothing you say, and no transcript, is ever sent to that provider. A reply can occasionally include a name or company you have given, which is why we list the provider here as a processor and cover the transfer in section 6.

For everything else we use the following processors, each under a written contract that meets UK GDPR Article 28:

• Google (Google Analytics 4 and Google Tag Manager) for website analytics, only if you consent.
• Amazon Web Services for hosting this website and the service behind the contact form. EU (London) region.
• Our team messaging service, which receives contact form submissions and call summaries so that the team can respond.
• Our email and document provider.
• Mailing platform: none at present. If we adopt one for service emails it will be named here before it is used.
• Our accountants, and professional advisers where necessary.

We may disclose data if required to by law, a court or a regulator. We do not otherwise share personal data with third parties. If the business is sold or merged, data may be transferred to the new owner under the same terms as this notice.

6. International transfers

Our phone assistant, its language models and all call transcripts and notes are hosted on our own servers in the United Kingdom and do not leave it. The text of the assistant's own spoken replies is sent to a speech synthesis provider in the United States, as described in section 5. Other processors based in, or storing data in, the United States are Google (analytics, only if you consent) and the messaging and email services we use to handle enquiries. Where personal data leaves the UK we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Copies of the relevant safeguards are available on request.^*

^*ICO

7. Cookies

This website sets no cookies until you make a choice on the prompt, because analytics cookies are not essential and need your consent.^* If you choose "Allow", Google Analytics sets cookies (_ga and _ga_*, lasting up to 2 years) to recognise repeat visits.^** Your choice is stored in your browser for 12 months. If you choose "No thanks", nothing is set and nothing is loaded from Google.

^*ICO ^**Google

To change your mind, clear this site's data in your browser settings and the banner will appear again. You can also block cookies for all sites in your browser, and Google offers a browser add-on that opts you out of Google Analytics everywhere.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectification of data that is inaccurate or incomplete.
• Erasure of your data where we no longer need it or you withdraw consent, subject to any legal requirement to keep it.
• Restriction of processing while a dispute about accuracy or lawfulness is resolved.
• Portability of data you gave us and that we process by automated means under consent or contract, in a machine-readable format.
• Object to processing based on legitimate interests, including the transcription of calls. Where the processing is direct marketing, we must stop as soon as you object, without exception.
• Withdraw consent at any time where we rely on it, without affecting processing that has already taken place.

To exercise any of these, email hello@plene.ai. We will respond within one month, and will tell you if we need longer for a complex request. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity before releasing data.^*

^*ICO

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.^* We would appreciate the chance to resolve it first.

^*ICO

9. Our use of AI, and automated decision-making

We use AI systems in two places: an assistant that answers our phone line, and tools that read documents and produce first drafts of our reports and bid responses. We align our use of these systems with the transparency and human oversight principles of the EU AI Act, whose Article 50 requires people to be told when they are interacting with an AI system, whether or not the law strictly requires it of a UK company.^* In practice that means:

^*EU AI Act

• You are always told when you are dealing with AI. The phone assistant says at the start of every call that it is an AI assistant and that the call is being transcribed. It does not present itself as a person.
• No AI system makes a decision about you. The assistant takes details and books appointments; it does not accept, decline or prioritise enquiries. Every enquiry is read by a person before anything is done with it. The tools used in our reports produce analysis and drafts; the findings, recommendations and anything sent in a client's name are reviewed and decided by a person. Nothing we do involves automated decision-making with legal or similarly significant effects on you, within the meaning of UK GDPR Article 22.^{* *}ICO
• A person is accountable for every output. Each report and each submission has a named person on our side who has read it and is responsible for it.
• AI systems are logged and can be reviewed. We keep records of what the assistant was told and what it said (the transcript) and of the sources behind each figure in a report, so that any output can be traced and challenged.
• You can opt out. If you do not want to speak to the assistant, end the call and email us; if you do not want AI tools used on material you give us as a client, tell us and we will agree how the work is done.

We do not use AI for profiling, for emotion recognition, or for any purpose the EU AI Act classes as prohibited or high-risk.

10. Security

Data is encrypted in transit and at rest with the providers listed above. Access within plene.ai is limited to the people who need it to respond to you or deliver an engagement, and is protected by multi-factor authentication. If a breach were to put your rights at risk we would notify you and the ICO as UK GDPR requires.

11. Changes to this notice

We will update this page if our processing changes, and the date at the top will change with it. Significant changes will be flagged on the contact page for a month after they take effect.