Privacy Notice
About this notice
Purbrook Software Solutions Limited ("Purbrook", "we", "us" or "our") is committed to protecting your privacy. This notice explains what we do with personal information across everything we operate, and what your rights are. Whichever of our services you use, Purbrook Software Solutions Limited is the organisation responsible for your personal data.
This notice covers:
- Purbrook (getpurbrook.com): business management software
- Our main website and any other service we operate that links to this notice
The Schedule at the end of this notice sets out the detail specific to Purbrook: the data it handles, why, who it is shared with and how long it is kept. Please read this core notice together with that Schedule.
This notice has been produced in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, in each case as amended by the Data (Use and Access) Act 2025, together with the Privacy and Electronic Communications Regulations 2003 (PECR).
Who we are and how to contact us
Purbrook Software Solutions Limited
Post: 147 Pavilion Road, Worthing, West Sussex, BN14 7EG
Telephone: 01903 861233
General enquiries: info@purbrooksoftwaresolutions.com
Data protection enquiries and complaints: privacy@purbrooksoftwaresolutions.com
Company No. 14996555
ICO registration No. ZC009049
We are not required to appoint a statutory Data Protection Officer. Responsibility for data protection sits with the company directors, who can be reached using the details above.
The two roles we act in
This distinction matters, because it determines who you should approach about your data.
As a controller. We decide why and how we use information about the people and organisations who buy from us and use our software, including account holders, their staff, prospective customers and website visitors. We are the controller for that data, and this notice explains that processing.
As a processor. Purbrook is a tool that our business customers use to handle information about other people. When our customer uploads or generates data about a third party in our software, that customer decides why and how it is used. They are the controller; we act only on their documented instructions under a data processing agreement.
If your personal data was handled by an organisation using our software, rather than by us directly, that organisation is responsible for it, and their own privacy notice explains that processing. We can help direct you to them, but we cannot make decisions about data we hold only on their behalf. The Schedule below identifies which role applies to which data.
What data we collect
The categories of personal data we may hold as controller are:
- Names, job titles and business contact details
- Account registration and access information, including credentials
- Client and organisation details
- Records of correspondence, queries, compliments and complaints
- Records of meetings and decisions
- Transaction and billing data
- Marketing preferences
- Technical data such as browser, operating system and device information
- IP addresses and usage data showing how you interact with our services
- Information collected for security, fraud prevention and abuse monitoring
The Schedule at the end of this notice sets out any further categories specific to Purbrook.
We do not collect special category data, or data about criminal offences. None of the categories above falls into those classes, we do not ask for any, and we have no use for any. Where a customer records such data in software we provide, they are the controller for it and this notice does not cover it. The Schedule explains the position.
Why we use your data
As controller, we use personal data to:
- provide, operate, support and improve our products
- create and administer accounts, and authenticate users
- take payment and maintain financial records
- respond to queries, provide technical support and handle complaints
- keep our services secure and prevent fraud, abuse and misuse
- meet our legal, regulatory and contractual obligations
- send service messages, and to send marketing about our products where you have agreed or we are otherwise permitted to do so
Lawful bases
We rely on one or more of the following under Article 6 of the UK GDPR.
Consent. You have given us permission after we explained what we would do. You can withdraw consent at any time.
Contract. We need the information to enter into or perform a contract with you.
Legal obligation. We need the information to comply with the law.
Legitimate interests. The processing benefits you, us or someone else without causing undue risk of harm. We rely on this for account administration, service improvement, security and fraud prevention, and business-to-business marketing. Before relying on it we carry out and record a balancing assessment weighing our interests against your rights.
Recognised legitimate interests. The Data (Use and Access) Act 2025 introduced a category of recognised legitimate interests, set out in Annex 1 to the UK GDPR, for which no balancing assessment is required. We may rely on this in limited circumstances only:
- disclosing personal data to a public body (including a police force or other law enforcement authority) where that body has told us the data is needed for a task carried out in the public interest;
- where processing is necessary for detecting, investigating or preventing crime, or apprehending or prosecuting offenders;
- where processing is necessary to respond to an emergency or to safeguard an individual at risk.
We do not rely on this basis for routine service delivery, analytics or marketing.
We do not process special category data, or criminal offence data, as a controller. Where a customer records such data in software we provide, that customer is the controller for it. They identify the condition they need under Article 9 or Article 10 and Schedule 1 of the Data Protection Act 2018, and their own privacy notice explains it. Our obligations to them are contractual, and are set out in our agreement with them rather than in this notice.
Who we share data with
We do not sell or rent personal data.
We share data with the following categories of recipient:
- Cloud hosting and infrastructure providers who run our systems
- Payment processors who take and reconcile payments
- Communication providers who deliver email on our behalf
- Professional advisers, including accountants, insurers, auditors and lawyers, where necessary
- Regulators, law enforcement and public authorities where required by law, court order, or to prevent serious harm
- Our business customers, where we hold data as their processor and are returning it to them
The Schedule names the specific processors used for Purbrook.
All processors act under written data processing agreements requiring them to meet UK GDPR standards, to process data only on our instructions, and to apply appropriate security.
Data retention
We keep personal data only as long as we need it. Our standard periods as controller are:
| Data | Retention |
|---|---|
| Account data | For as long as you hold an account with us |
| Billing and payment records | 6 years from the end of the financial year they relate to (tax and accounting requirements) |
| Support correspondence | 3 years from your last contact with us |
| Data protection complaint records | 3 years from closure |
| Service and security logs | 12 months |
| Sign-in records | 12 months |
| Marketing preferences | Until you object or withdraw consent. We then keep a suppression record indefinitely, so that we do not contact you again |
Periods specific to Purbrook are set out in the Schedule. This includes data we hold as processor, which is governed by our agreement with the relevant customer.
When data is no longer needed we securely delete or anonymise it.
Data security
We apply appropriate technical and organisational measures, including:
- encryption of data in transit (TLS) and at rest
- secure authentication with hashed credentials
- role-based access control, so only authorised staff can reach customer data
- regular security review and vulnerability testing
- infrastructure hosted with reputable providers
- documented incident response and breach notification procedures
No system is completely secure. If you believe your data has been compromised, contact us immediately using the details above.
Automated decision-making and profiling
We do not carry out profiling, and we do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Parts of our software operate automatically, for example validating the information you enter, applying the limits of your plan, and applying security and rate-limiting rules. Some of these rules affect access: where an account is unpaid or a trial has ended, our software may suspend access automatically until the position is settled. Rules of that kind read facts such as a date or a payment status, and they apply terms already agreed in your contract with us. None of them assesses your personal characteristics, and none of them involves profiling. The Schedule sets out any rule of this kind that applies.
Where our business customers use our software to reach decisions about individuals, those customers are the controllers for those decisions, and their own privacy notice explains how they make them.
Your rights
Under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, you have the right to:
- access a copy of the personal data we hold about you
- rectification of inaccurate data
- erasure of your data, subject to legal retention requirements
- restrict how we use your data
- portability, meaning you can receive your data in a portable format
- object to processing in certain circumstances, including direct marketing at any time
- withdraw consent where we rely on it
- complain to us, and to the Information Commissioner's Office, as set out below
To exercise any of these, contact us using the details above. There is no charge.
How we handle your request. We respond within one month of receiving a request. Two things are worth knowing:
- Reasonable and proportionate searches. When responding to an access request we are required to carry out a reasonable and proportionate search. We are not obliged to search every system without limit, but we will search wherever it is reasonable to expect your data to be held.
- Requests for clarification. If we reasonably need more information to identify the data you want or to locate it, we will ask. The one-month period pauses from when we ask until you reply. If your request is complex, or you have made several, we may extend by up to two further months. We will tell you within the first month if that happens, and explain why.
We may charge a reasonable fee, or decline to act, if a request is manifestly unfounded or excessive. We will explain our reasoning if that ever applies.
If your request concerns data we hold as processor for one of our business customers, we will tell you promptly and, where we can, direct you to the right organisation.
Cookies
We use very little here, so we can be specific.
Our main website (purbrooksoftwaresolutions.com) sets no cookies. It uses no analytics, no advertising pixels, no session recording and no third-party trackers. It loads no fonts, scripts or images from anyone else. If you send us a message through the contact form, the details you type are transmitted to us and nothing is stored on your device.
The Purbrook application sets one cookie, and it is a functional one.
| Name | Purpose | Type | Lasts |
|---|---|---|---|
sidebar_state | Remembers whether you collapsed the navigation sidebar, so it stays how you left it | Functional / preference | 7 days |
The application also uses browser storage on your own device. This is not cookies, and none of it is sent to us:
| Stored | Purpose | Where |
|---|---|---|
| Your sign-in session | Keeps you signed in while you work. Closing the browser signs you out | Session storage |
purbrook:last-activity | The shared clock behind the 15-minute inactivity sign-out, so every open tab agrees | Local storage |
purbrook:timer | Keeps a running time-tracking timer going if you reload or change page | Local storage |
purbrook:deck:* | The order you arranged your dashboard cards in | Local storage |
nav:open:*, report-open:* | Which navigation groups and report sections you left open | Local storage |
| A daily marker | Stops the daily reminder sweep running more than once a day across your open tabs | Local storage |
One further item is placed by the platform rather than by us. Firebase, the Google service the application runs on, creates a small database on your device named firebase-heartbeat-database. It records the dates on which the software was used, so that Firebase can report to Google which version of its own software is in use. It holds no information about you and no identifier for you, and it is part of the platform rather than something we add or can switch off.
There are no analytics, advertising or tracking cookies, and no third-party cookies. That is why you are not asked to accept a cookie banner: nothing we set requires your consent under the Privacy and Electronic Communications Regulations. If that ever changes, we will ask you properly first.
You can clear this storage through your browser at any time. Clearing it will sign you out and reset those preferences; nothing else is affected.
International transfers
Your data is primarily stored and processed in the UK and the EEA. Where we transfer personal data outside the UK, we do so only where:
- the destination is covered by UK data bridge (adequacy) regulations, assessed under the data protection test introduced by the Data (Use and Access) Act 2025, meaning the standard of protection is not materially lower than under UK law; or
- the transfer is made under appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment; or
- a specific exception in the UK GDPR applies.
We apply additional technical safeguards, including encryption, wherever data leaves the UK.
Children's data
Our services are business-facing. They are not directed at, nor intended for, individuals under 18. We do not knowingly collect data from children. If we become aware that we have, we will delete it promptly.
Changes to this notice
We may update this notice to reflect changes in our practices or in the law. We will notify account holders of material changes by email or by posting a notice on the relevant site. The date at the top tells you when it was last revised.
How to complain
If you have concerns about how we have used your personal data, please tell us. You can complain:
- by email to privacy@purbrooksoftwaresolutions.com
- by telephone on 01903 861233
- by post to Purbrook Software Solutions Ltd, 147 Pavilion Road, Worthing, West Sussex, BN14 7EG
You do not need to use any particular form of words, and you do not need to identify the specific part of the law you think we have breached.
What happens next. We will acknowledge your complaint within 30 days of receiving it. We will then take appropriate steps to respond, including any enquiries we consider appropriate, and tell you the outcome without undue delay.
If you are still unhappy. You can complain to the Information Commissioner's Office. The ICO may ask you to raise the matter with us first, so it helps to complain to us before approaching them.
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
Complaining to the ICO does not affect your right to seek a remedy through the courts.
Schedule: Purbrook
getpurbrook.com
Our role. We are the controller for the account, billing, support and technical data described below, relating to the organisation that opens a Purbrook workspace and the people it invites. We are the processor for everything a customer puts into their workspace about other people: their clients, contacts, suppliers, staff, members and service users. For that second set the customer is the controller. They decide what goes in and why, and our obligations to them are set out in section 14 and Annex A of the Purbrook BMS Terms and Conditions, not in this notice.
Additional data we hold as controller
- Name, email address, and the job title or user type an administrator assigns
- Workspace name and organisation details
- Password, stored only as a secure hash. We never see it in readable form
- Two-factor authentication status, and the secret behind it
- Sign-in records: dates, times, and whether the attempt succeeded
- Settings and preferences, including dashboard layout and notification choices
- Billing contact name and email, company name and address, VAT number, invoice history, amounts and payment status
- Card type, last four digits and expiry date, received from Stripe. Card details are entered on Stripe's own hosted pages and stay with Stripe. We never see or store a full card number
- IP address, browser type and version, device and operating system
- Server logs: pages and functions requested, timestamps and error reports
- Records of the emails we have sent you, and whether they were delivered
We do not collect special category data. Nothing we hold in our own right, listed above, is special category data or data about criminal offences. We do not ask for any, and we have no use for any.
Data our customers keep in their own workspace
We are only the processor for this, and it is not covered by this notice. A workspace holds whatever its owner chooses to record. The modules available include clients, contacts, a sales pipeline, onboarding, contracts, a calendar, tasks, time tracking, notes, internal messages, complaints, invoices, payments and reports, together with an optional membership set covering members, events, governance, communications, publications, accreditation and audits. Customers can also define their own record types and their own fields. Notes, case records, messages and correspondence logs accept free text, and files can be attached to records, so we cannot list what any given workspace contains.
A customer may choose to record special category data in their workspace, and some will: Purbrook can be set up for charity and advice-service casework, or as a support desk. Where that happens the customer is the controller, not us. They decide what goes in and why, identify any condition they need under Article 9 or Article 10, and explain it in their own privacy notice. We hold it only on their documented instructions under section 14 and Annex A of the Purbrook BMS Terms and Conditions, we do not use it for any purpose of our own, and we do not use it or any other customer data to train machine-learning models.
Additional recipients
| Provider | What they do | Where data is held |
|---|---|---|
| Google Cloud / Firebase (Google Cloud EMEA Ltd) | Hosting, database, file storage, authentication, application infrastructure | United Kingdom (London) and the EEA (Netherlands) |
| Stripe (Stripe Payments UK Ltd) | Card payments, subscriptions and invoicing. Stripe is a controller in its own right for payment data; see Stripe's own privacy policy | UK, EEA and United States, under Stripe's own safeguards |
| Namecheap (Private Email) | Transmits the email Purbrook sends: invitations, password resets, address verification and notifications. Every send carries the recipient's name and email address, the name of the colleague who acted, and the customer organisation's name. Subject lines are always generic. Where a customer's own administrator has switched on "include client detail in email alerts", which is off unless they turn it on, the body of a notification also carries the title of a task or event, an event's type and its linked client, the text of a reminder or automation message, which normally names the client and the item, and the subject line of an internal message. An event's location, its "With / about" note, any notes, and the body of an internal message are never sent, on any setting | United States |
Additional retention
| Data | How long |
|---|---|
| Your account details, while your workspace is open | For as long as you hold an account with us |
| Your workspace's contents, after the agreement ends | 30 days, then permanently deleted. This is the same promise as clause 21.2 of the Purbrook BMS Terms and Conditions; the two must always match |
| Backups | Deleted within our backup cycle, a further 30 days |
| Deleted records inside Purbrook | Moved to a recycle bin and permanently removed 30 days later. A permanent deletion made deliberately from the recycle bin cannot be undone |
| Billing and accounting records | 6 years from the end of the financial year they relate to, as tax law requires |
| Support correspondence | 3 years from your last contact with us |
| Server and security logs | 12 months |
| Sign-in records | 12 months |
Security measures specific to Purbrook
In addition to the measures in the core notice: separation between workspaces is enforced on our servers on every single request, so one customer's data cannot be reached from another's; passwords are stored only as secure hashes, so nobody at Purbrook can see or retrieve yours and we will never ask you for it; two-factor authentication is available to everyone, and an organisation can require it across its whole workspace; sign-in lasts only for the browser session, with automatic sign-out after 15 minutes of inactivity and a warning first; and we ask you to confirm your identity again before sensitive actions such as exporting all data or permanently deleting records.
Automated processing in Purbrook
Purbrook applies some rules without a person involved. It checks entries as you type them, enforces the user and storage limits of your plan, and applies security and rate-limiting rules. One rule goes further and we set it out because it affects access: where a free trial ends and no payment has been made, Purbrook will, overnight, suspend every account in that workspace except the account of the person who registered it, so that they can sign in and settle the subscription. Nothing about this assesses an individual. It reads a date and a payment status, and it applies an agreed term of the contract. Access is restored as soon as payment is made. It is not a decision based on your personal characteristics, and we carry out no profiling.
If your data is held in someone's Purbrook workspace
If an organisation records information about you in Purbrook, that organisation is the controller and decides what it keeps and why. Requests to see, correct or delete that information must go to them, and their own privacy notice explains how they handle it. We hold that data only on their instructions and we are not permitted to disclose or amend it on your behalf. If you approach us, we will tell you promptly and, where we can, direct you to the right organisation.