Privacy Policy

1. Introduction

This Privacy Policy explains how Pericls Ltd ("Pericls", "we", "us", or "our") collects, uses, stores, shares, and protects personal data when you use our regulatory compliance intelligence platform available at https://app.pericls.com and our website at https://www.pericls.com (together, the "Service").

We are committed to protecting your privacy and processing your personal data in accordance with the UK General Data Protection Regulation ("UK GDPR", as retained under the Data Protection Act 2018), the EU General Data Protection Regulation (EU) 2016/679 ("EU GDPR"), the Privacy and Electronic Communications Regulations 2003 ("PECR"), the ePrivacy Directive 2002/58/EC, and all applicable data protection legislation. References to "GDPR" in this policy refer to both the UK GDPR and the EU GDPR as applicable.

Please read this Privacy Policy carefully. By accessing or using the Service, you acknowledge that you have read and understood this policy. If you do not agree with our data practices, please do not use the Service.

---

2. Data Controller

The data controller responsible for your personal data is:

Pericls Ltd
A company incorporated in England and Wales, company number 16288279
Registered office: Charterhouse Millburgh Hall, Graffham, Petworth, England, GU28 0QH

• Email: legal@pericls.com
• Website: https://www.pericls.com

---

3. Data Protection Officer (DPO)

We have appointed a Data Protection Officer whom you may contact regarding any questions about this Privacy Policy or the processing of your personal data:

Data Protection Officer
Pericls Ltd
London, United Kingdom
Email: dpo@pericls.com

---

4. Personal Data We Collect

4.1 Data You Provide Directly

4.2 Data Collected Automatically

4.3 Data from Third Parties

4.4 Special Categories of Data

We do not intentionally collect special categories of personal data (as defined in GDPR Article 9), such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation.

If you upload documents to the Service that contain special category data, you are solely responsible for ensuring a lawful basis for such processing under Article 9(2) GDPR.

---

5. How We Use Your Personal Data (Purposes and Legal Bases)

We process your personal data only where we have a valid legal basis under Article 6(1) GDPR. The table below sets out each processing purpose alongside its corresponding legal basis:

5.1 Legitimate Interest Assessment

Where we rely on legitimate interest as a legal basis, we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms. You may request details of these assessments by contacting our DPO at dpo@pericls.com.

---

6. AI and Automated Processing

6.1 Use of Large Language Models (LLMs)

The Service uses third-party AI/LLM providers to deliver core functionality, including:

• Regulatory text analysis and summarisation
• Compliance gap identification
• Generating regulatory intelligence reports
• Document analysis and requirement extraction

Content you submit for analysis may be processed by:

• OpenAI (GPT models) — based in the United States
• Anthropic (Claude models) — based in the United States
• Google (Gemini models) — based in the United States

6.2 Important Safeguards

• We have executed Data Processing Agreements with each AI provider.
• Your data is not used to train the foundation models of any AI provider.
• We transmit only the minimum content necessary for the requested analysis.
• AI-generated outputs are provided as analytical assistance and do not constitute legal advice.
• No solely automated decisions with legal or similarly significant effects are made about you based on AI processing (Article 22 GDPR).

6.3 Your Rights Regarding Automated Processing

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. As our AI features provide analytical assistance rather than automated decisions, Article 22 does not apply; however, you may contact us at dpo@pericls.com with any concerns.

---

7. Data Recipients and Sub-Processors

We share your personal data with the following categories of recipients:

7.1 Sub-Processors

We use third-party service providers ("sub-processors") to help deliver the Service. Each sub-processor processes data only on our instructions and subject to a Data Processing Agreement.

For the complete and current list of sub-processors, including transfer mechanisms, see our Sub-Processor List.

7.2 Other Recipients

We may also share personal data with:

• Professional advisors (legal, accounting, auditing) — bound by professional confidentiality obligations
• Law enforcement or regulatory authorities — where required by law or valid legal process
• Business transfer parties — in connection with a merger, acquisition, or sale of assets, subject to the acquiring entity assuming our obligations under this Privacy Policy

We do not sell your personal data to any third party.

---

8. International Data Transfers

The Service is hosted in the European Union (Germany), where your account data, organisation data, uploaded documents, and analysis results are stored. However, certain personal data may be transferred to, stored in, and processed in countries outside the United Kingdom and the European Economic Area ("EEA") — in particular the United States — by the sub-processors listed in Section 7.1 (payment, email delivery, analytics, error monitoring, and AI/LLM analysis).

8.1 Transfer Mechanisms

Where personal data is transferred outside the UK or the EEA, we ensure an adequate level of protection through one or more of the following mechanisms:

8.2 Transfer Impact Assessments

We conduct Transfer Impact Assessments for each international transfer to evaluate the legal framework of the recipient country and determine whether supplementary measures are required to ensure an essentially equivalent level of protection for your personal data.

You may request a copy of the applicable transfer mechanisms by contacting dpo@pericls.com.

---

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

After the applicable retention period, personal data is securely deleted or irreversibly anonymised.

---

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• Encryption in transit: All data transmitted between your browser and our servers uses TLS 1.2 or higher.
• Encryption at rest: Database contents and stored documents are encrypted at rest using AES-256.
• Access controls: Role-based access control, principle of least privilege, multi-factor authentication for internal systems.
• Password security: Passwords are hashed using bcrypt with appropriate work factors; plaintext passwords are never stored.
• Infrastructure security: Managed hosting with SOC 2 Type II certified providers, automated security patching, network isolation.
• Monitoring: Continuous security monitoring, intrusion detection, and automated alerting.
• Incident response: Documented incident response procedures with defined escalation paths.
• Employee training: Regular data protection and security awareness training for all staff.

For further details on our security measures, please contact security@pericls.com.

---

11. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

11.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about the processing.

11.2 Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected and incomplete data completed. You can update most account information directly through the Service settings.

11.3 Right to Erasure (Article 17)

You have the right to request deletion of your personal data where:

• The data is no longer necessary for its original purpose
• You withdraw consent (where consent was the legal basis)
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

This right does not apply where processing is necessary for compliance with a legal obligation or for the establishment, exercise, or defence of legal claims.

11.4 Right to Restriction of Processing (Article 18)

You have the right to restrict processing where:

• You contest the accuracy of the data (for a period allowing verification)
• The processing is unlawful and you oppose erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification of legitimate grounds

11.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON or CSV) and to transmit that data to another controller, where processing is based on consent or contract and is carried out by automated means.

11.6 Right to Object (Article 21)

You have the right to object to processing based on legitimate interest (Article 6(1)(f)). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

You have an absolute right to object to processing for direct marketing purposes at any time.

11.7 Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. See Section 6.3 for details on how this applies to our Service.

11.8 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. You can withdraw consent by:

• Adjusting your cookie preferences via our consent banner
• Updating your communication preferences in account settings
• Contacting us at dpo@pericls.com

11.9 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: dpo@pericls.com
• Subject line: "Data Subject Request — [Right Type]"

We will respond to your request within 30 days of receipt. If the request is complex or we receive a high volume of requests, we may extend this period by a further 60 days, and we will notify you of any extension within the initial 30-day period.

We may ask you to verify your identity before processing your request to protect your personal data from unauthorised access.

11.10 Right to Lodge a Complaint

If you believe that our processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
United Kingdom

• Website: https://ico.org.uk
• Complaints: https://ico.org.uk/make-a-complaint/data-protection-complaints/data-protection-complaints/
• Phone: 0303 123 1113

If you are located in the EU/EEA, you may also lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence or place of work.

---

12. Cookies and Tracking Technologies

We use cookies and similar technologies on our Service. A summary is provided below; for full details, please see our Cookie Policy.

You can manage your cookie preferences at any time through our cookie consent banner or by adjusting your browser settings.

---

13. Children's Privacy

The Service is designed for business use and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without valid parental consent, we will take steps to delete that data promptly. If you believe we have inadvertently collected data from a child, please contact us at dpo@pericls.com.

---

14. Third-Party Links

The Service may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of such third parties. We encourage you to review the privacy policies of any third-party sites you visit.

---

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will update the "Last Updated" date at the top of this policy.
• We will notify you by email (to the address associated with your account) or by a prominent notice within the Service at least 30 days before the changes take effect.
• Where required by law, we will obtain your consent to material changes.

We encourage you to review this Privacy Policy periodically.

---

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

General Enquiries:
Email: legal@pericls.com

Data Protection Officer:
Email: dpo@pericls.com

Customer Support:
Email: support@pericls.com

Postal Address:
Pericls Ltd
Charterhouse Millburgh Hall, Graffham, Petworth
England, GU28 0QH

---

17. Document History

---

This Privacy Policy is provided in English. If there is any conflict between a translated version and the English version, the English version shall prevail.