1. Who we are

upleashed® is a company registered in the Isle of Man under Company Number 021517V. Our registered address is Cronk Sumark View, Carrick Park, Sulby, IM7 2EY. We are the creators of pulseAI, a digital tool available via mobile app and web platform. pulseAI helps individuals and organisations identify, assess, and develop skills in a structured, data-driven way. We also provide training, consultancy, and support services focused on workforce development.

This Privacy Policy explains how we collect, use, and protect your personal data when you use any of our services. These include the pulseAI app, our website at https://upleashed.com , and any direct interactions you may have with our team. Our Data Protection Officer is Dr. Alex J. Martin-Smith, who you can reach at dpo@upleashed.com . For general queries or help, please visit our support page at https://upleashed.com/support/ .

2. Scope and application

This Privacy Policy applies to all personal data collected and processed by upleashed® across its services. This includes data collected through our website at https://upleashed.com , through the pulseAI app (on mobile or web), and during the provision of consultancy, training, or support services. It covers how we collect, store, use, and share your information, and the choices and rights you have regarding your personal data.

This policy applies to all users of upleashed® services, whether you are accessing our tools independently or as part of an organisation. It also applies to any communications you have with us, such as emails, support requests, or participation in research and surveys. Where we process data on behalf of an organisation (such as your employer), this policy applies in conjunction with that organisation’s own data protection responsibilities.

3. What information we collect

upleashed® collects a range of personal data to provide and improve our services. The type of data we collect depends on how you interact with us, whether through the pulseAI app, our website, or other services such as consultancy or training. We collect only the information that is necessary for the purposes explained in this policy. The categories of information we may collect include:

Identity Data: such as your name, job title, and organisation name.
Contact Data: such as your email address and telephone number.
Technical Data: including your IP address, browser type, device type, operating system, and session logs.
Account Data: such as your username, encrypted password, account preferences, and profile settings.
Usage Data: including login times, features used within pulseAI, assessment progress, and how long you spend on specific tools or pages.
Transactional Data: such as records of purchases, billing address, and details of services accessed. We do not store full payment card numbers.
Support and Communication Data: including help requests, survey responses, email threads, and any feedback you provide.
Optional Data: such as industry, region, or team size, which may be shared voluntarily to personalise your experience or support your organisation's reporting.

We do not intentionally collect sensitive or special category data, such as health or biometric information. If you choose to share this type of data with us voluntarily, we will only use it with your clear and informed consent.

4. How we collect information

upleashed® collects personal data in a number of ways, depending on how you use our services. Most of the information we collect is provided directly by you, while some is generated automatically or received through your organisation if they manage your access to our services. We collect data through the following sources:

Directly from you: when you sign up for an account, fill in a form, contact us, or participate in training, assessments, or surveys.
Automatically through your device: when you use our website or the pulseAI app, we collect technical and usage data using secure logging and cookie-based technologies.
From your employer or organisation: if your access to pulseAI is arranged by your employer or another organisation, they may provide basic details such as your name, role, and email address to set up your account.
Through communications: if you email us, call us, or chat with our support team, those interactions may be logged to help us resolve your queries and improve our service.
From publicly available sources: in limited cases, we may supplement account data with publicly available professional information, such as LinkedIn or official company websites, to confirm role or organisational context.

At all times, we ensure that the way we collect and store data is consistent with your rights and in line with data protection law.

5. Purpose and legal basis for processing

upleashed® processes your personal data only when there is a lawful reason to do so. We rely on several legal bases under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, depending on the context and nature of your interaction with our services. We process your data for the following purposes and under these legal bases:

To provide our services: we use your data to create and manage your account, deliver the pulseAI app and related tools, support your skills assessments, and ensure secure access. This is necessary for the performance of a contract.
To manage payments and transactions: we use your financial and contact data to process purchases and issue invoices. This is also based on contractual necessity.
To communicate with you: we send service-related messages, respond to enquiries, and manage support requests based on our legitimate interest in running an effective service.
To improve our services: we analyse usage patterns to understand how people use our tools and to guide feature development. This is based on our legitimate interest in product improvement.
To comply with legal obligations: we retain records to meet tax, accounting, and regulatory requirements.
To send you marketing and optional communications: we only do this if you have given clear, active consent. You can withdraw consent at any time by using the unsubscribe link in any email or by contacting us.

In each case, we ensure that your data is handled responsibly and that your privacy rights are respected. Where we rely on legitimate interests, we carry out a careful balancing test to confirm that our interests do not override your rights or freedoms.

6. How we use your information

upleashed® uses your personal data to deliver our services, support your account, and improve your experience with the pulseAI platform and related offerings. Every use of your data is based on a clear legal basis, as outlined in the previous section. We may use your data to:

Register and manage your user account, including account security and authentication.
Provide access to the features of pulseAI, including skills assessments, team reports, and benchmarking tools.
Communicate service updates, notify you of changes to our platform, and respond to your support requests.
Process payments, generate invoices, and maintain accurate financial records.
Monitor usage patterns to improve our products, resolve bugs, and develop new features.
Tailor content and recommendations to suit your role, organisation, or sector.
Invite you to provide feedback, participate in surveys, or hear about new features or services (with your consent).
Meet our legal and regulatory responsibilities, including fraud prevention and audit requirements.

We will never use your data for purposes that are unrelated to these activities, and we do not sell or rent your information to third parties. Any use of your data is always limited to what is necessary, relevant, and proportionate.

7. Data retention

upleashed® retains your personal data only for as long as it is needed to fulfil the purposes outlined in this policy, including legal, regulatory, and operational requirements. We apply clear and proportionate retention periods to ensure that your data is not kept for longer than necessary.

If you are an active user of our services, we will retain your personal data for the duration of your account. Once your account becomes inactive or is deleted, we will typically retain associated data for up to 10 years to meet our legal and financial obligations, including audit and tax requirements. In some cases, such as dispute resolution or regulatory compliance, we may be required to retain data for a longer period.

Certain types of data, such as technical logs or analytical usage records, are kept for shorter periods and are either deleted or anonymised when no longer needed. Where data has been anonymised, it is no longer considered personal data and may be retained indefinitely for statistical or research purposes.

If you wish to request deletion of your personal data sooner, you may do so at any time. We will review your request and delete data where permitted by law and where no overriding obligation exists.

8. Cookies and tracking

upleashed® uses cookies and similar tracking technologies to support the proper functioning of our website and web-based services, including the browser version of pulseAI. Cookies are small text files placed on your device to help us remember your preferences, maintain secure sessions, and understand how people use our site. We use cookies to:

Enable essential features such as secure login and session management.
Remember your settings and improve usability during repeat visits.
Collect anonymous usage data to help us improve performance and troubleshoot issues.

We do not use cookies for advertising, remarketing, or behavioural tracking. No third-party advertising cookies are set on our site or in the pulseAI web platform. Where analytics tools are used, they are configured to avoid identifying individuals, and cookies are only placed with your consent.

You can control or disable cookies at any time through your browser settings. You may also be presented with a cookie banner or settings tool when you first visit our website, allowing you to manage your preferences.

9. App-specific data collection

When you use the pulseAI mobile app, upleashed® collects limited data to ensure the app works correctly and securely. We do not use third-party tracking tools or advertising services, and no personal data is sold, profiled, or used for cross-app tracking. The data collected through the app includes:

User login credentials and authentication tokens (stored securely).
Usage data such as which features you use, how often you log in, and which assessments you complete.
Device information such as operating system type, app version, and basic device identifiers for support and diagnostics.
Push notification preferences, so we can inform you of important updates if enabled. You can switch off notifications at any time in your device settings.

We do not use any third-party software development kits (SDKs), analytics services, or advertising identifiers in the pulseAI mobile app. All data collected through the app is processed by upleashed® in line with this privacy policy and UK data protection laws.

10. Sharing of information

upleashed® treats your personal data with the utmost care and does not sell or rent it to any third parties. We only share your information where necessary to deliver our services, support our business operations, or comply with the law. We may share your data with:

Trusted service providers who help us operate our services, such as secure cloud hosting providers, payment processors, and email delivery services. These companies only access your data to perform their role, and they are contractually bound to protect it.
Your employer or organisation, if they have arranged access to pulseAI on your behalf. In these cases, we may share usage data and relevant insights with your organisation, but only in accordance with their internal policies and our agreement with them.
Regulators, authorities, or legal bodies, where required by law or court order. We will always assess the legitimacy and necessity of such requests before disclosing any information.
Professional advisers, such as legal or accounting firms, where required to support our business or defend our legal rights.

In every case, we ensure that appropriate safeguards are in place and that your data is only shared when absolutely necessary and lawful.

11. International data transfers

upleashed® primarily stores and processes your personal data within the United Kingdom (UK) and the European Economic Area (EEA). However, in some cases, we may need to transfer data outside these regions; for example, if we use secure cloud services or technical partners located in other countries. When we transfer data internationally, we take all necessary steps to ensure your information remains protected. This includes:

Using countries that have been recognised by the UK government or European Commission as providing an adequate level of data protection.
Entering into Standard Contractual Clauses (SCCs) approved by the Information Commissioner’s Office or European Commission, which require recipients to protect your data to UK and EU standards.
Conducting due diligence and risk assessments on any third-party vendors involved in international transfers.
Applying additional technical and contractual safeguards where required.

You can contact us at any time to request more information about how your data is protected when transferred outside the UK or EEA.

12. Children’s data

upleashed® does not design or market its services to children under the age of 13. The pulseAI app and related services are intended for use by professionals and organisations, and we do not knowingly collect or process personal data from children.

If we become aware that a child under 13 has submitted personal data to us, whether through an app registration, form submission, or other channel; we will take immediate steps to delete that information and, if necessary, contact a parent or guardian to inform them of the action taken.

If you believe that we may have mistakenly collected data from a child under 13, please contact our Data Protection Officer immediately at dpo@upleashed.com.

13. Your rights

As a user of upleashed® services, you have a number of important rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. These rights give you greater control over your personal data and how it is used. You have the right to:

Access your personal data and receive a copy of the information we hold about you.
Correct any inaccurate or incomplete data.
Request deletion of your data where it is no longer needed or where you withdraw your consent.
Restrict how your data is used, for example, while a complaint is being reviewed.
Object to certain types of processing, such as marketing or profiling, where applicable.
Request data portability, allowing you to move your data to another service provider in a commonly used format.
Withdraw your consent at any time, where processing is based on your prior agreement.

To exercise any of these rights, please contact our Data Protection Officer at dpo@upleashed.com or visit our support page at https://upleashed.com/support/. We may need to verify your identity before fulfilling your request. In most cases, we will respond within one month.

14. Account deletion

You can delete your pulseAI account at any time if you no longer wish to use our services. This can be done in one of two ways:

In the app: Open the pulseAI app, log in, go to the menu, and select Delete Account.
By contacting support: Submit a request through our support page at https://upleashed.com/support/ or email us at dpo@upleashed.com .

Once we receive your request, we will confirm your identity and begin the deletion process. Your personal data will be permanently removed from our systems, unless we are required to retain certain records to meet legal, financial, or regulatory obligations. In such cases, only the minimum necessary data will be retained for the required period, and it will not be used for any other purpose.

15. Data security

upleashed® is committed to keeping your personal data secure at all times. We use a combination of technical, organisational, and administrative measures to prevent unauthorised access, accidental loss, misuse, or disclosure of your information. Our security measures include:

ISO 27001-aligned controls, ensuring rigorous internal data security processes.
SSL encryption (powered by GeoTrust and DigiCert) to protect data in transit between your device and our servers.
Active Cyber Essentials accreditation (UK standard, as of 19th December 2023), demonstrating compliance with essential cyber hygiene practices.
Strict access controls, including role-based permissions and secure logins, to ensure only authorised personnel can access your data.
Regular reviews, staff training, and system monitoring to identify and respond to potential threats.

We also maintain cyber insurance through American International Group UK Limited, providing an additional layer of protection in the event of a serious incident. Our systems are reviewed and updated regularly to ensure they remain resilient against evolving risks.

16. Automated decision-making

upleashed® does not use your personal data to carry out automated decision-making that has a legal or similarly significant effect on you. This means that we do not make decisions using algorithms or profiling alone without any human involvement.

All decisions relating to your account, assessments, or services are either made by you directly or involve oversight and judgment from a member of our team. If this changes in future, we will update this policy and provide clear notice, including your right to request human review.

17. Data protection reviews

upleashed® regularly reviews its data protection policies, security practices, and privacy procedures to ensure full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant app store requirements from Apple and Google. These reviews include:

Internal audits of how we collect, use, and store personal data.
Assessment of third-party providers to ensure they meet the same high standards of data protection.
Ongoing staff training to keep our team up to date with responsibilities and best practices.
Policy updates and system checks, particularly when we introduce new services, technologies, or face changes in law.

By carrying out these regular assessments, we help ensure that your data is always handled lawfully, securely, and transparently.

18. Changes to this policy

upleashed® may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or best practices. When we make changes, we will update the Last Updated date at the top of this page and publish the revised version on our website.

If the changes are significant; for example, if they affect your rights or how we process your data, we will provide additional notice. This may include sending you an email, placing a banner in the pulseAI app, or prompting you to review the new terms when you next log in.

We encourage you to review this Privacy Policy regularly to stay informed about how we protect your data and respect your rights. Your continued use of our services after a change has been made will be treated as acceptance of the updated policy.

19. Contact us

If you have any questions, concerns, or requests related to this Privacy Policy or how your data is handled, please get in touch. We are committed to responding promptly and handling your information with care and transparency. You can contact our Data Protection Officer:

Name: Dr. Alex J. Martin-Smith
Email: dpo@upleashed.com
Support: https://upleashed.com/support/
Postal address: upleashed® Limited, Cronk Sumark View, Carrick Park, Sulby, IM7 2EY, Isle of Man

We are here to help and will always do our best to address your data protection queries thoroughly and respectfully.

Privacy policy.