Privacy Notice for SaaS Users

Last Updated: 20/10/2026

1. Introduction

This Privacy Notice explains how Pentagull Ltd ("Pentagull", "we", "us", or "our") collects, uses, stores, and protects personal information when you use our software-as-a-service ("SaaS") products and related services.

This notice applies to individuals who access or use our SaaS applications, whether directly or through an organisation that has subscribed to our services.

2. Who We Are

Pentagull Ltd is a company registered in England and Wales.

Registered Office:
Technology Management Centre
Faraday Way
Blackpool FY2 0JW
United Kingdom

For privacy-related enquiries, please contact us at:
Email: support@pentagull.co.uk
Telephone: 0845 680 7167

3. Our Role

Depending on how our services are used, Pentagull may act as:

Data Processor

Where your employer, organisation, or another customer provides your information to our platform, that organisation is the Data Controller and Pentagull acts as a Data Processor on its behalf.

Data Controller

Pentagull acts as Data Controller for information we collect directly to:

  • Create and manage user accounts
  • Provide customer support
  • Maintain service security
  • Manage billing and contractual relationships
  • Meet legal obligations

4. Information We Collect

Account Information

We may collect:

  • Name
  • Email address
  • Username
  • Job title
  • Organisation name
  • Telephone number

Service Usage Information

We may collect:

  • Login activity
  • IP address
  • Device and browser information
  • Session information
  • Audit logs
  • Feature usage data

Customer Data

Our customers may store information within our applications. The categories of personal data processed depend on how the customer chooses to use the service.

Support Information

When you contact us, we may collect:

  • Correspondence
  • Support tickets
  • Call notes
  • Diagnostic information relevant to resolving issues

5. How We Use Personal Information

We process personal information to:

  • Provide and maintain our services
  • Authenticate users
  • Manage user accounts
  • Deliver customer support
  • Monitor system performance and security
  • Investigate incidents and prevent misuse
  • Communicate service updates
  • Comply with legal obligations
  • Improve our services

6. Legal Basis for Processing

Where UK GDPR applies, we process personal data under one or more of the following lawful bases:

Contract

Processing necessary to provide the services requested by you or your organisation.

Legitimate Interests

Processing necessary for:

  • Platform security
  • Fraud prevention
  • Service administration
  • Product improvement
  • Customer support

Legal Obligation

Processing necessary to comply with applicable laws and regulatory requirements.

Consent

Where required, we will obtain consent before undertaking specific processing activities.

7. Sharing Information

We do not sell personal information.
We may share information with:

  • Infrastructure and security providers
  • Regulators, law enforcement, or courts where legally required

All suppliers handling personal data on our behalf are subject to appropriate contractual safeguards.

8. International Transfers

We do not share any information outside of the United Kingdom.

9. Security

We implement appropriate technical and organisational measures to protect personal information, including:

  • Role-based access controls
  • Encryption in transit
  • Secure authentication controls
  • Security monitoring and logging
  • Regular system maintenance and patching

While we take reasonable steps to protect information, no method of transmission or storage can be guaranteed to be completely secure.

10. Data Retention

We retain personal information only for as long as necessary to:

  • Provide services
  • Meet contractual obligations
  • Resolve disputes
  • Comply with legal requirements

Customer data is normally deleted or anonymised following termination of services in accordance with contractual agreements and retention schedules.

11. Your Rights

Where applicable, you have the right to:

  • Access your personal information
  • Correct inaccurate information
  • Request deletion
  • Restrict processing
  • Object to processing
  • Receive your information in a portable format
  • Withdraw consent where consent is relied upon

If your organisation controls your data within our service, requests relating to that information should usually be directed to your organisation first.

12. Cookies and Similar Technologies

Our applications may use cookies and similar technologies for:

  • Authentication
  • Security
  • Session management
  • User preferences
  • Performance monitoring

13. Children's Privacy

Our services are intended for business use and are not directed at children under the age of 13.

14. Changes to This Notice

We may update this Privacy Notice from time to time. Material changes will be communicated through the service, by email, or by other appropriate means.

15. Complaints

If you have concerns about how we handle personal information, please contact us in the first instance using the contact details outlined in this policy.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).