Purple Engage Privacy Notice

This Privacy Notice explains how Purple WiFi Limited processes personal data in connection with Purple Engage.

1. Who we are

Purple Engage is provided by Purple WiFi Limited, company number 06444980, whose registered office is Annie Kenney Mill, Hudson Street, Chadderton, Oldham OL9 7FQ, United Kingdom (Purple, we, us or our).

For questions about this notice or your personal data, contact us at support@purple.ai.

2. Two different roles

Purple's role depends on whose personal data is involved.

Engage account users, billing contacts and prospective customers

For personal data about people who create, administer or use an Engage account, or who are our business contacts, Purple is normally an independent controller.

Contacts of an Engage customer

If a business uses Engage to store or use your contact details, that business is normally the controller. It decides why your data is collected and used, what communications are sent and how long the data is kept. Purple acts as a processor for that business under the Purple Engage Data Processing Addendum.

The business's own privacy notice applies to its use of your data. Please contact that business first to exercise your privacy rights or ask about a message you received.

3. Personal data we collect about Engage users

We may collect and process:

• Account and business information, including name, work email address, job title, company and account role.
• Authentication and security information, including login events, IP address, browser or device information and security logs.
• Subscription and billing information, including plan, invoices, payment status, tax information and payment-provider references.
• Service activity and audit information, including feature use, settings changes, exports, approval decisions and support-access records.
• Support correspondence and feedback that you send to us.
• Product analytics and cookies or similar technologies where used and permitted.

We collect this information from the account user, the Customer that administers the account, Purple group systems, the device or browser used to access Engage, payment providers and service providers that support Engage.

4. Why we use account-user data

Purpose	Lawful basis
Create and administer accounts, provide the Service, provide support and process billing	Performance of a contract and our legitimate interests in operating the Service
Protect security, investigate misuse, keep audit trails and prevent fraud	Legitimate interests and, where applicable, legal obligation
Improve Service reliability, usability and performance	Legitimate interests, subject to applicable cookie and similar-technology rules
Send service, security, billing and legal notices	Performance of a contract, legal obligation and legitimate interests
Send Purple product marketing to business contacts	Legitimate interests or consent where required. You may opt out at any time.
Meet tax, accounting, legal and regulatory obligations	Legal obligation and legitimate interests in establishing, exercising or defending claims

We do not make decisions about an account user based solely on automated processing that have legal or similarly significant effects, unless we tell the user otherwise and provide the protections required by law.

5. How we share account-user data

We share personal data only where necessary with:

• Purple group companies that support identity, account administration, finance, security, legal or customer support;
• service providers that host, secure, analyse, communicate or support Engage;
• payment providers that process payments;
• professional advisers, insurers, auditors, regulators and authorities where required or appropriate; and
• a buyer or prospective buyer of Purple's business, subject to appropriate confidentiality safeguards.

Where a Customer chooses to connect a third-party service, the Customer controls that connection and the third party's own terms and privacy information apply.

6. International transfers

Purple may process account-user data in the United Kingdom, European Economic Area, United States and other locations where Purple or its service providers operate. Where a transfer is restricted by applicable law, we use a lawful transfer mechanism, such as an adequacy decision, EU Standard Contractual Clauses, UK International Data Transfer Agreement or UK Addendum, and supplementary measures where appropriate.

7. How long we keep data

We keep account-user personal data only for as long as necessary for the purposes described in this notice.

• We keep account data while the Customer has an Engage account and for up to 30 days after account closure, unless a longer period is required by law.
• We keep audit records for two years.
• We keep billing and tax records for the period required by applicable law, which may be up to seven years in the United Kingdom.
• We keep security, support and analytics records for the periods needed to protect the Service, investigate incidents and meet legal obligations.

For Customer contact data, the Customer chooses the retention period in Engage. Purple processes and deletes that data in accordance with the Customer's instructions and the Data Processing Addendum.

8. Cookies and similar technologies

Engage uses strictly necessary technologies to authenticate users, maintain sessions, prevent fraud and protect the Service.

Where Engage uses non-essential analytics, advertising or similar technologies, we provide the required information and obtain consent where applicable before setting or accessing them. You can manage your preferences through the cookie controls made available in Engage.

9. Your rights as an Engage user

Depending on applicable law, you may have rights to request access, correction, deletion, restriction, portability or objection, and to withdraw consent where processing relies on consent.

To exercise a right, contact support@purple.ai. We may need to verify your identity before responding.

You may also complain to the UK Information Commissioner's Office or the data-protection authority where you live or work.

10. If you are a contact of an Engage customer

A business using Engage may collect, upload or receive information about you, such as your name, email address, telephone number, preferences, consent choices, venue or event activity, survey responses, purchase or loyalty information, messages and engagement events.

That business decides why it collects and uses this information. Purple processes it only on the Customer's instructions to provide Engage. Purple does not use a Customer's contact data to market Purple's own products to that person.

Marketing messages sent through Engage should identify the Customer and provide an effective unsubscribe or preference-management route. Suppression information may be retained where necessary to ensure that a person is not contacted again contrary to their choice.

11. Children's data and special-category data

Engage is a business service and is not directed at children. Customers must not use Engage to process children's data or special-category data unless they have a valid lawful basis, give any required notices and comply with the laws that apply to them.

12. Changes to this notice

We may update this Privacy Notice to reflect changes to the Service, law or our processing. For material changes, we will give account owners reasonable advance notice through Engage or by email. The current version and effective date will remain available on this page.