Privacy Notice

Who we are

Summyte Ltd is a company registered in England and Wales under company number 17245857.

Our registered office is: Summyte Ltd, 124 City Road, London EC1V 2NX, United Kingdom.

For personal data covered by this Privacy Notice, Summyte is generally the data controller. Where Summyte processes personal data on behalf of an enterprise customer in providing our products or services, Summyte may act as a data processor, service provider or equivalent role under applicable law. In those circumstances, the relevant customer agreement and Data Processing Agreement will apply.

Privacy contact — For questions about this Privacy Notice or Summyte's handling of personal data: Email: [email protected] | Postal address: Summyte Ltd, 124 City Road, London EC1V 2NX, United Kingdom.

Who this Privacy Notice applies to

This Privacy Notice applies to individuals who visit or interact with www.summyte.com; submit a Request Discussion or other enquiry; contact us by email or other business communication; register for or attend a Summyte event; represent an existing or prospective customer, partner, supplier or investor; receive business development or marketing communications from us; or otherwise interact with Summyte in a professional or business context.

This Privacy Notice does not replace customer-specific contractual terms, Data Processing Agreements or product-specific privacy documentation that apply to personal data processed within a Summyte product or service.

This website is intended for business and professional users and is not directed to children. We do not knowingly collect personal data from children through the website.

Personal data we collect

The personal data we collect depends on how you interact with Summyte.

Identity and contact information — This may include: first and last name; business email address; telephone number; postal address, where provided; and other contact details you choose to provide.

Professional and business information — This may include: company or organisation; job title and department; country or region; professional interests; business relationship information; and information relevant to an enquiry, proposal or business relationship.

Enquiry and communication information — This may include: information submitted through website forms; information contained in emails and other correspondence; meeting and event information; requests, questions and feedback; and information you choose to provide when describing your business requirements or objectives.

Marketing and preference information — This may include: communication preferences; event preferences; consent records; unsubscribe and opt-out requests; and information necessary to manage marketing preferences.

Security and compliance information — We may collect or retain limited information necessary to protect our website and systems, comply with legal obligations, manage disputes and maintain business continuity.

We do not intentionally collect special category or sensitive personal data through this website. Please avoid providing sensitive personal information through website forms unless it is necessary for your enquiry.

How we obtain personal data

We may obtain personal data directly from you when you complete a form, contact us, attend a meeting or event, or otherwise communicate with us; from your organisation, colleagues or representatives; from event organisers, business partners, professional networks, business directories and publicly available business sources, where permitted by applicable law; and from service providers supporting our website, communications, security and business operations.

Where required by applicable law, we will provide appropriate privacy information when personal data is obtained from sources other than you.

How we use personal data

We use personal data for legitimate business purposes and only where we have an appropriate lawful basis under applicable law.

Respond to enquiries — To respond to requests, arrange meetings, provide demonstrations, answer questions and communicate with you about Summyte. Lawful basis where UK/EU GDPR applies: legitimate interests and, where applicable, taking steps at your request before entering into a contract.

Provide information and services — To provide information, proposals, services and account-related communications. Lawful basis where UK/EU GDPR applies: performance of a contract, taking steps before entering into a contract, or legitimate interests.

Develop and manage business relationships — To manage relationships with customers, prospects, partners, suppliers and other professional contacts. Lawful basis where UK/EU GDPR applies: legitimate interests and, where applicable, contractual necessity.

Marketing and events — To send relevant business communications, invitations, product information and event communications where permitted by applicable law. Lawful basis where UK/EU GDPR applies: consent where required, or legitimate interests where permitted.

Operate and secure our website and systems — To maintain website functionality, protect systems, prevent misuse, support business continuity and maintain the security of our services. Lawful basis where UK/EU GDPR applies: legitimate interests and, where applicable, legal obligations.

Legal, regulatory and governance purposes — To comply with applicable law, respond to lawful requests, establish or defend legal claims, resolve disputes, maintain appropriate records, and meet audit, regulatory and governance requirements. Lawful basis where UK/EU GDPR applies: legal obligation and/or legitimate interests, as applicable.

Where we rely on legitimate interests under applicable law, we consider the impact on individuals and balance our interests against their rights and freedoms.

Marketing communications

We may send business and marketing communications where permitted by applicable law.

You can stop receiving marketing communications at any time by: using the unsubscribe option in our emails; replying to a marketing communication; or contacting us at [email protected].

We maintain appropriate records of marketing preferences and opt-out requests so that we can respect your choices and demonstrate compliance where required.

We do not sell personal data for marketing purposes.

Cookies and similar technologies

Our website is intended to use only cookies and similar technologies that are necessary for essential website functionality, security and operation.

We do not intend to use cookies or similar technologies for: behavioural advertising; marketing pixels; cross-site advertising; profiling; or non-essential analytics.

If this changes, we will update this Privacy Notice and, where required by applicable law, provide an appropriate consent or preference mechanism before using non-essential cookies or similar technologies.

You can also manage cookies through your browser settings. Disabling necessary cookies may affect website functionality.

AI and personal data

Summyte develops AI-native enterprise technology. We recognise that responsible data handling is particularly important when AI technologies are involved.

This Privacy Notice primarily covers personal data collected through our website and business interactions. Personal data processed within a Summyte product, trial, proof of concept or customer deployment is governed by the applicable customer agreement, Data Processing Agreement and product-specific documentation.

Unless expressly agreed in writing or otherwise clearly disclosed, Summyte does not use personal data submitted through this website to train public AI models.

Where AI-enabled technologies or third-party AI services are used to support our business operations, we apply appropriate contractual, technical and organisational safeguards.

For customer environments, the use of customer data for AI processing is governed by the applicable contractual terms and data protection arrangements.

Summyte does not use solely automated decision-making, including profiling, through this website that produces legal or similarly significant effects on individuals.

When we share personal data

We may share personal data where necessary to operate our business, provide our services, comply with law or protect our legitimate interests.

Service providers — Third-party providers that support functions such as: website hosting; cloud infrastructure; email and communications; security; customer and business relationship management; support and maintenance; and collaboration and business operations. We require appropriate contractual and other safeguards for service providers where required by applicable law.

Professional advisers — We may share information with lawyers, accountants, auditors, insurers and other professional advisers where reasonably necessary.

Business transactions — Personal data may be disclosed where reasonably necessary in connection with a proposed or actual merger, acquisition, investment, financing, restructuring, sale or other corporate transaction, subject to appropriate confidentiality and data protection safeguards.

Legal and regulatory requirements — We may disclose personal data where required or permitted by applicable law, including to courts, regulators, law enforcement agencies and government authorities.

International data transfers

Summyte is headquartered in the United Kingdom but operates in an international business environment. As a result, personal data may be processed by Summyte or our service providers in countries outside the country in which you are located. This may include transfers, storage or access involving countries outside the United Kingdom or European Economic Area.

Where applicable law requires safeguards for international transfers, we use legally recognised transfer mechanisms and appropriate contractual, technical and organisational measures. Depending on the applicable law and circumstances, these may include: an applicable adequacy decision or adequacy regulation; the UK International Data Transfer Agreement; the UK Addendum to the EU Standard Contractual Clauses; EU Standard Contractual Clauses; binding corporate rules, where applicable; or another legally recognised transfer mechanism.

Where required, we also undertake appropriate assessments and implement additional safeguards to protect personal data. The specific transfer mechanism may depend on the country involved, the parties to the transfer, the nature of the data and the applicable legal requirements.

The ICO's current guidance confirms that UK international-transfer rules can apply both where personal data is sent to a separate overseas organisation and where such an organisation is given access to the data.

How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to meet legal, accounting, security, audit, regulatory or dispute-resolution requirements. The retention period depends on the nature of the information, the purpose for which it was collected and our relationship with you.

Business enquiries and contacts: generally retained while the enquiry or business relationship is active and for a reasonable period afterwards where necessary for legitimate business, legal or compliance purposes.

Marketing preferences and opt-outs: retained for as long as necessary to respect your preferences and demonstrate compliance.

Security and compliance records: retained only for as long as necessary for security, legal and operational purposes.

Contractual, financial and legal records: retained for the periods required by applicable law or reasonably necessary for audit, accounting, tax, governance or legal purposes.

When personal data is no longer required, we will delete it, anonymise it or securely retain it only where there is a continuing legal or legitimate reason to do so.

How we protect personal data

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Depending on the circumstances, these measures may include: access controls and permissions management; authentication and security controls; secure systems and infrastructure; confidentiality obligations; backups and recovery measures; security monitoring; supplier due diligence; and incident response procedures.

No method of transmitting or storing information can be guaranteed to be completely secure. If you believe your interaction with Summyte may no longer be secure, please contact us promptly.

Your privacy rights

Depending on your location and applicable law, you may have rights in relation to your personal data. These may include the right to: be informed about how your personal data is used; access your personal data; request correction of inaccurate or incomplete information; request deletion of your personal data; request restriction of processing; request portability of certain personal data; object to certain processing; object to direct marketing; withdraw consent where processing is based on consent; and obtain information about certain automated decision-making, where applicable.

The availability and scope of these rights vary by jurisdiction and may be subject to legal conditions and exemptions.

To exercise a privacy right, contact [email protected]. We may need to verify your identity before responding to a request. Where UK or EU GDPR applies, we will normally respond within one month of receiving a valid request, subject to any permitted extension for complex or multiple requests.

Additional rights for individuals in the European Economic Area

Where the EU General Data Protection Regulation applies, you may have additional rights and protections under applicable EU law, including rights to access, rectification, erasure, restriction, portability and objection.

You may also have the right to lodge a complaint with the data protection supervisory authority in the country where you live, work or believe an infringement has occurred.

Additional rights for individuals in the United States

Certain US state privacy laws provide additional rights depending on where you live and whether the relevant law applies to Summyte's processing. Depending on the applicable law, these may include rights to: know or access personal information; correct inaccurate personal information; delete personal information; obtain a portable copy of personal information; opt out of certain processing; appeal certain decisions concerning privacy requests; and exercise other rights provided under applicable state law.

Summyte does not sell personal information for monetary consideration and does not use personal information collected through this website for targeted advertising.

US residents may contact [email protected] to exercise applicable privacy rights. We may need to verify requests before responding and may decline or limit requests where permitted by applicable law.

Additional local requirements

Summyte operates internationally and may be subject to privacy and data protection laws in jurisdictions outside the United Kingdom, European Economic Area and United States. Where applicable local law provides additional rights, protections or notice requirements, those requirements will apply to the extent required by law.

Where necessary, Summyte may provide supplemental privacy notices, disclosures or mechanisms for individuals in particular jurisdictions.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our business, technology, services or legal obligations. The latest version will be published on our website with its effective date and last updated date.

Where changes are material and applicable law requires notification, we will take appropriate steps to bring those changes to your attention.

Complaints

If you have concerns about how Summyte processes your personal data, we encourage you to contact us first so that we can try to resolve the issue.

You may also have the right to complain to the relevant data protection supervisory authority in your jurisdiction. For individuals in the United Kingdom, the relevant supervisory authority is the Information Commissioner's Office (ICO). For individuals in the European Economic Area, you may contact the relevant data protection authority in your country.

Contact us

For questions, privacy requests or complaints relating to this Privacy Notice or Summyte's handling of personal data, please contact:

Summyte Ltd, 124 City Road, London EC1V 2NX, United Kingdom

Email: [email protected] | Website: www.summyte.com