Privacy Notice

AppleBoar Ltd ("AppleBoar", "we", "us") is committed to protecting personal data. This notice explains how we handle personal data across our business when we act as a controller, meaning when we decide how and why personal data is used. It covers people such as prospective and current clients and their contacts, individuals named in our work, suppliers, and people who contact us.

Where we instead process personal data on a client's behalf as their processor, for example when building or running a solution over the client's own data, that processing is governed by our client agreement and data processing agreement rather than this notice.

AppleBoar Ltd is the controller of the personal data described in this notice.

• Company number: 16929126 (registered in England and Wales)
• Registered office: 41 New Cross Street, Swinton, Manchester, England, M27 4TU
• Website: appleboar.com
• Contact for privacy matters: hi@appleboar.com
• ICO registration number: ZC151964

We are a small business and are not required to appoint a Data Protection Officer. Any privacy query can be sent to the contact above.

Depending on your relationship with us, we may process:

• Identity and contact details: name, job title, employer, email address, telephone number, and your LinkedIn or other professional profile.
• Relationship and correspondence data: our emails and messages with you, meeting notes and transcripts, enquiries, and records of our dealings.
• Engagement data: information you or your organisation give us to deliver our services, which may include the names and contact details of colleagues that appear in our notes, reports and recommendations.
• Financial and transactional data: billing contact details, invoices and payment records.
• Supplier and sub-contractor data: contact and payment details of people we work with.
• Website and enquiry data: information you provide if you contact us or book a call.
• Website usage data: the pages you view, the site you came from, and your browser, device and IP address, processed by our analytics in a cookieless mode (see Cookies and analytics).

We obtain this data directly from you, from the organisation you work for, from publicly available professional sources (such as LinkedIn or a company website), and as it is generated through our dealings with you. We do not generally seek or process special category data (such as health or ethnicity).

We process personal data for the following purposes, on these legal bases:

• Providing our services and managing an engagement: performance of our contract with you, or our legitimate interests in delivering services where you are not the contracting party.
• Producing reports, notes and recommendations that may name individuals at a client: our legitimate interests in providing professional advice.
• Communicating with you and responding to enquiries: legitimate interests, or steps to enter into a contract.
• Marketing our services to business contacts: legitimate interests in promoting our business.
• Understanding and improving how our website is used: legitimate interests.
• Invoicing, accounting and keeping tax records: legal obligation, and performance of our contract.
• Managing suppliers and sub-contractors: performance of a contract, or legitimate interests.
• Keeping records to establish, exercise or defend legal claims: legitimate interests.

Where we rely on legitimate interests, we have considered the impact on you and do not use your data in ways that override your rights. You can ask us about this at any time.

We may contact business contacts about our services by email, LinkedIn or similar channels, on the basis of our legitimate interests in business-to-business marketing. You can ask us to stop at any time, by replying to any message or contacting us using the details below, and we will. We do not sell your personal data or share it with third parties for their own marketing.

Our website uses PostHog for analytics in a cookieless mode. It does not set cookies or store any information on your device, so we do not show a cookie banner and no consent is needed for storage.

In this mode we process a limited amount of technical data to understand how the site is used: the pages you view, the site you came from, your browser and device type, and your IP address (used transiently to count visits and approximate location, not stored on your device). We rely on our legitimate interests in understanding and improving our website, and you can object at any time. We do not use this data to identify you personally or to track you across other websites. Our analytics data is hosted in the European Economic Area (Frankfurt) and is not transferred outside the UK or EEA.

Our website does not set any non-essential cookies.

We use trusted service providers who process personal data on our behalf, under contracts that require them to protect it. These include providers of:

• email, document storage and productivity tools (Google Workspace);
• customer relationship management and pipeline tools (Attio);
• accounting and invoicing (Intuit / QuickBooks);
• notes, task and collaboration tools (Notion, Linear, Miro);
• meeting transcription and voice tools (Granola, Wispr Flow);
• website analytics (PostHog);
• website contact-form storage and enquiry handling (Airtable);
• AI tools that help us draft and deliver work (such as Anthropic and Google), used on terms that do not allow your data to be used to train their models; and
• hosting and infrastructure providers that support the solutions we build (Supabase, AWS).

We may also share personal data with our sub-contractors (for example a software engineer), and with our professional advisers, insurers, or authorities where the law requires. We do not sell your personal data.

We are based in the UK and prefer to keep personal data in the UK or EEA. Some of our service providers may process personal data outside the UK, including in the United States. Where that happens, we rely on an approved safeguard under UK data protection law, such as the UK Extension to the EU-US Data Privacy Framework, UK adequacy regulations, or the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. You can ask us for more detail about the safeguards that apply.

We keep personal data only as long as we need it:

• engagement records, meeting recordings, transcripts and deliverables: for the duration of the engagement and normally for 6 years afterwards (to match the period in which a legal claim could be brought);
• financial and tax records: 6 years, as required by law;
• prospect and marketing data: until you ask us to stop or it is no longer needed.

We then delete or anonymise the data.

Under UK data protection law you have the right to: be informed about how we use your data; request a copy of it; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to processing (including objecting to direct marketing); request portability of data you provided to us; and, where we rely on consent, withdraw it at any time.

To exercise any of these, contact us using the details below. We will respond within one month, and there is normally no charge.

We use AI tools to help us draft content, build solutions and run our business. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. Outputs that involve personal data are reviewed by a person before we rely on them.

We may update this notice from time to time. The current version, and its date, will always be shown at the top of this page.

For any privacy matter, contact us at hi@appleboar.com. If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it.

You also have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF