{"id":1398,"date":"2024-11-27T13:56:43","date_gmt":"2024-11-27T13:56:43","guid":{"rendered":"https:\/\/dev.primeai.co.uk\/?page_id=1398"},"modified":"2026-07-24T07:10:52","modified_gmt":"2026-07-24T07:10:52","slug":"policies-privacy","status":"publish","type":"page","link":"https:\/\/www.prime-ai.com\/en\/policies-privacy\/","title":{"rendered":"Privacy Policy – PRIME AI"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Policies - Privacy Policy<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Last updated: 23 July 2026<\/strong><\/p>

1. About this Privacy Policy<\/h2>

This Privacy Policy explains how Prime AI Limited collects, uses, shares and protects Personal Data.<\/p>

It applies when you:<\/p>

  • visit a website operated by Prime AI;<\/li>
  • contact us or request information;<\/li>
  • request a demonstration or trial;<\/li>
  • create an account or subscribe to a Service;<\/li>
  • communicate with our sales, support or technical teams;<\/li>
  • attend or participate in a meeting, event or demonstration;<\/li>
  • receive marketing communications from us;<\/li>
  • apply for a role with Prime AI;<\/li>
  • use a Prime AI product directly; or<\/li>
  • interact with a Prime AI service deployed through one of our customers.<\/li><\/ul>

    This Privacy Policy should be read together with our Terms of Service, Data Processing Addendum, Cookie Settings and Infrastructure Sub-processors information.<\/p>

    2. Who we are<\/h2>

    Prime AI Limited is registered in England and Wales under company number 11599467<\/strong>.<\/p>

    Our registered office is:<\/p>

    Prime AI Limited<\/strong>
    Oakwood Lodge
    Thornden Wood Road
    Herne Bay
    CT6 7NX
    United Kingdom<\/p>

    In this Privacy Policy, \u201cPrime AI,\u201d \u201cwe,\u201d \u201cour\u201d<\/strong> and \u201cus\u201d<\/strong> refer to Prime AI Limited.<\/p>

    Our privacy contact is:<\/p>

    You can contact us through the Contact Us page on the Prime AI website.<\/p>

    3. Our Services<\/h2>

    Prime AI provides software, application programming interfaces, artificial intelligence services and related technology, including:<\/p>

    • Persistent Device ID and Risk Signals API;<\/li>
    • device intelligence and refund-abuse prevention services;<\/li>
    • Clothing Size Finder;<\/li>
    • Shoe Size Finder;<\/li>
    • Bra Size Finder;<\/li>
    • Visual Search;<\/li>
    • Virtual Try-On;<\/li>
    • AI Photoshoot and image visualisation services;<\/li>
    • Shopify and other e-commerce applications;<\/li>
    • analytics and reporting functionality;<\/li>
    • custom artificial intelligence and software-development services; and<\/li>
    • related technical support and professional services.<\/li><\/ul>

      References to the \u201cServices\u201d<\/strong> in this Privacy Policy mean these products and services.<\/p>

      4. When Prime AI is a Controller or Processor<\/h2>

      Our legal role depends on why and how Personal Data is processed.<\/p>

      4.1 Prime AI as a Controller<\/h3>

      Prime AI generally acts as a Controller when we process Personal Data for our own purposes, including:<\/p>

      • operating our websites;<\/li>
      • responding to enquiries and demonstration requests;<\/li>
      • administering customer accounts and subscriptions;<\/li>
      • managing contracts, billing and payments;<\/li>
      • communicating with business contacts;<\/li>
      • providing customer support;<\/li>
      • marketing Prime AI\u2019s Services;<\/li>
      • protecting our websites, systems, Services and API credentials;<\/li>
      • detecting misuse of Prime AI systems;<\/li>
      • meeting legal and regulatory obligations;<\/li>
      • recruiting employees and contractors; and<\/li>
      • establishing, exercising or defending legal claims.<\/li><\/ul>

        When Prime AI is the Controller, this Privacy Policy applies directly to our processing.<\/p>

        4.2 Prime AI as a Processor<\/h3>

        Prime AI generally acts as a Processor when a business customer deploys a Prime AI Service on its website, application or platform and instructs Prime AI to process Personal Data on its behalf.<\/p>

        For example, Prime AI may act as a Processor when:<\/p>

        • a retailer uses our sizing or fit-recommendation technology;<\/li>
        • a customer uses the Persistent Device ID and Risk Signals API;<\/li>
        • a retailer offers Visual Search or Virtual Try-On;<\/li>
        • a customer submits images for AI Photoshoot or visualisation;<\/li>
        • a Shopify merchant installs a Prime AI application; or<\/li>
        • Prime AI processes information according to a customer\u2019s configuration and instructions.<\/li><\/ul>

          In these circumstances:<\/p>

          • the Prime AI customer is normally the Controller;<\/li>
          • the customer determines why the Personal Data is processed and how outputs are used;<\/li>
          • Prime AI processes the data according to the customer\u2019s instructions and our Data Processing Addendum; and<\/li>
          • the customer\u2019s own privacy policy should explain its use of Prime AI.<\/li><\/ul>

            Questions concerning decisions made by a Prime AI customer should normally be directed to that customer.<\/p>

            Prime AI may be unable to identify an individual from a technical identifier without additional information held by the customer. Where appropriate, we may forward a request to the relevant customer.<\/p>

            4.3 Prime AI as an independent Controller for limited Service information<\/h3>

            Even where Prime AI otherwise acts as a Processor, we may act as an independent Controller for limited information needed to:<\/p>

            • administer customer accounts;<\/li>
            • manage billing and contractual records;<\/li>
            • protect the security of the Services;<\/li>
            • investigate misuse of Prime AI infrastructure;<\/li>
            • comply with legal obligations; and<\/li>
            • maintain aggregated or de-identified service statistics.<\/li>
            • \u00a0<\/li><\/ul>

              5. Personal Data we collect<\/h2>

              The Personal Data we collect depends on how you interact with Prime AI and which Services are used.<\/p>

              5.1 Identity and business information<\/h3>

              We may collect:<\/p>

              • your name;<\/li>
              • job title;<\/li>
              • employer or business name;<\/li>
              • business address;<\/li>
              • company registration information;<\/li>
              • professional profile information;<\/li>
              • department or business function; and<\/li>
              • information about your authority to represent an organisation.<\/li><\/ul>

                5.2 Contact information<\/h3>

                We may collect:<\/p>

                • business email address;<\/li>
                • telephone number;<\/li>
                • postal address;<\/li>
                • social-media or professional-network profile;<\/li>
                • communication preferences; and<\/li>
                • other contact information you provide.<\/li><\/ul>

                  5.3 Account and subscription information<\/h3>

                  We may collect:<\/p>

                  • account name and identifier;<\/li>
                  • username;<\/li>
                  • account permissions;<\/li>
                  • API plan and usage allowance;<\/li>
                  • subscription status;<\/li>
                  • approved domains and applications;<\/li>
                  • intended use case;<\/li>
                  • technical contact details;<\/li>
                  • API credential metadata;<\/li>
                  • login and authentication information; and<\/li>
                  • account administration records.<\/li><\/ul>

                    We do not ask you to send passwords to Prime AI support personnel.<\/p>

                    5.4 Transaction and billing information<\/h3>

                    We may collect:<\/p>

                    • billing name and address;<\/li>
                    • company registration and tax information;<\/li>
                    • invoice information;<\/li>
                    • payment status;<\/li>
                    • subscription history;<\/li>
                    • transaction reference numbers; and<\/li>
                    • limited payment metadata received from our payment provider.<\/li><\/ul>

                      Where card payments are available, payment-card details are normally collected and processed directly by the relevant payment provider. Prime AI does not ordinarily receive or store the complete payment-card number.<\/p>

                      5.5 Enquiry, sales and communication information<\/h3>

                      We may collect:<\/p>

                      • information submitted through our contact, demonstration or trial forms;<\/li>
                      • email and messaging correspondence;<\/li>
                      • meeting notes;<\/li>
                      • technical and commercial requirements;<\/li>
                      • requested products and integrations;<\/li>
                      • support requests;<\/li>
                      • feedback;<\/li>
                      • survey responses;<\/li>
                      • information about proposed projects; and<\/li>
                      • communications through LinkedIn or other business platforms.<\/li><\/ul>

                        5.6 Meeting and demonstration recordings<\/h3>

                        We may record certain demonstrations, meetings or support sessions for:<\/p>

                        • training;<\/li>
                        • quality assurance;<\/li>
                        • documenting customer requirements;<\/li>
                        • resolving technical matters; or<\/li>
                        • maintaining an accurate record of agreed actions.<\/li><\/ul>

                          We will provide notice before recording where reasonably practicable. You may ask us not to record or to stop recording unless recording is necessary for a specific legal or security purpose.<\/p>

                          5.7 Website and technical information<\/h3>

                          When you visit our websites or access our Services, we may collect:<\/p>

                          • IP address;<\/li>
                          • browser type and version;<\/li>
                          • operating system;<\/li>
                          • device type;<\/li>
                          • screen and language settings;<\/li>
                          • approximate location derived from IP address;<\/li>
                          • referring website;<\/li>
                          • pages viewed;<\/li>
                          • links selected;<\/li>
                          • date and time of access;<\/li>
                          • session duration;<\/li>
                          • website interaction information;<\/li>
                          • error and diagnostic information;<\/li>
                          • cookie and consent preferences;<\/li>
                          • security logs; and<\/li>
                          • other technical request information.<\/li><\/ul>

                            We may use analytics and behavioural-insight services, including Google Analytics and Microsoft Clarity, subject to your cookie choices and applicable law.<\/p>

                            5.8 Information from professional and public sources<\/h3>

                            For business development and B2B marketing, we may collect professional information from:<\/p>

                            • company websites;<\/li>
                            • public professional profiles;<\/li>
                            • LinkedIn;<\/li>
                            • business directories;<\/li>
                            • industry publications;<\/li>
                            • event-participant information;<\/li>
                            • referrals;<\/li>
                            • data suppliers; and<\/li>
                            • publicly available corporate records.<\/li><\/ul>

                              This may include a person\u2019s name, job title, employer, professional contact information and publicly available information about their business responsibilities.<\/p>

                              We do not intentionally collect private or non-business information from these sources for B2B marketing.<\/p>

                              5.9 Information received from customers and platform providers<\/h3>

                              Our customers, partners and e-commerce platforms may provide us with:<\/p>

                              • store name and domain;<\/li>
                              • store-owner or administrator contact details;<\/li>
                              • application installation details;<\/li>
                              • platform identifiers;<\/li>
                              • technical configuration information;<\/li>
                              • product catalogue information;<\/li>
                              • customer-support information;<\/li>
                              • transaction or return information;<\/li>
                              • pseudonymous account or session identifiers; and<\/li>
                              • information required to provide the relevant Service.<\/li><\/ul>

                                Where Prime AI processes this information on behalf of a customer, the customer remains responsible for ensuring that the information is collected and shared lawfully.<\/p>

                                6. Persistent Device ID and Risk Signals API<\/h2>

                                6.1 What the Service does<\/h3>

                                The Persistent Device ID and Risk Signals API provides device and session intelligence for legitimate purposes such as:<\/p>

                                • website and account security;<\/li>
                                • fraud prevention;<\/li>
                                • abuse prevention;<\/li>
                                • account-recreation detection;<\/li>
                                • multiple-account detection;<\/li>
                                • free-trial abuse prevention;<\/li>
                                • promotion and referral abuse prevention;<\/li>
                                • bot and automation detection;<\/li>
                                • suspicious-session review;<\/li>
                                • refund and return-abuse prevention; and<\/li>
                                • risk management.<\/li><\/ul>

                                  6.2 Information processed<\/h3>

                                  Depending on the customer\u2019s implementation, the Service may process:<\/p>

                                  • IP address and network information;<\/li>
                                  • browser type and version;<\/li>
                                  • operating-system and device information;<\/li>
                                  • screen, language, locale and timezone information;<\/li>
                                  • browser and device configuration attributes;<\/li>
                                  • online, device, session and request identifiers;<\/li>
                                  • timestamps and request metadata;<\/li>
                                  • the website domain or application making the request;<\/li>
                                  • device and session consistency information;<\/li>
                                  • private or incognito browsing indicators;<\/li>
                                  • VPN and data centre network indicators;<\/li>
                                  • bot, script, headless-browser and automation indicators;<\/li>
                                  • developer tools activity indicators;<\/li>
                                  • browser tampering or manipulation indicators;<\/li>
                                  • timezone and network inconsistencies;<\/li>
                                  • confidence scores;<\/li>
                                  • risk levels;<\/li>
                                  • recommended-action fields; and<\/li>
                                  • API usage and security records.<\/li><\/ul>

                                    The precise information collected depends on the technical integration and Service configuration selected by the customer.<\/p>

                                    6.3 Persistent identifiers and risk signals<\/h3>

                                    The Service may combine technical device and browser attributes to generate:<\/p>

                                    • a persistent or pseudonymous device identifier;<\/li>
                                    • a session identifier;<\/li>
                                    • an indication that a device may have been seen previously;<\/li>
                                    • device and session consistency signals;<\/li>
                                    • suspicious behaviour indicators;<\/li>
                                    • confidence information; and<\/li>
                                    • a risk classification or recommended action.<\/li><\/ul>

                                      These outputs are technical indicators. They are not proof of identity, fraud, criminal activity or misconduct.<\/p>

                                      6.4 Customer responsibility<\/h3>

                                      When the Service is deployed by a Prime AI customer:<\/p>

                                      • the customer determines the purpose and legal basis for the processing;<\/li>
                                      • the customer decides whether consent or another legal condition or exception applies;<\/li>
                                      • the customer is responsible for providing appropriate privacy information;<\/li>
                                      • the customer determines how risk signals are interpreted;<\/li>
                                      • the customer determines whether to allow, review, challenge, restrict or block an activity; and<\/li>
                                      • the customer is responsible for providing any required human review, explanation or appeal process.<\/li><\/ul>

                                        Prime AI does not instruct customers to treat an individual risk signal as conclusive.<\/p>

                                        6.5 Prime AI\u2019s use of Service data<\/h3>

                                        When acting as a Processor, Prime AI uses the information only as necessary to:<\/p>

                                        • provide the Service;<\/li>
                                        • generate identifiers and risk signals;<\/li>
                                        • maintain and secure the Service;<\/li>
                                        • investigate technical errors or misuse;<\/li>
                                        • provide customer support;<\/li>
                                        • comply with documented customer instructions; and<\/li>
                                        • meet applicable legal obligations.<\/li><\/ul>

                                          Prime AI does not sell Subscriber Personal Data or use Persistent Device ID customer data for unrelated advertising or cross-customer marketing profiles.<\/p>

                                          We may use aggregated or de-identified information to evaluate performance, maintain security and improve our Services, provided that the information does not identify a customer or individual.<\/p>

                                          6.6 Use on Prime AI\u2019s own websites<\/h3>

                                          Prime AI may use device and session intelligence on its own websites for purposes including:<\/p>

                                          • protecting our websites and forms;<\/li>
                                          • preventing automated misuse;<\/li>
                                          • detecting suspicious activity;<\/li>
                                          • safeguarding demonstrations, trials and API access;<\/li>
                                          • investigating security incidents; and<\/li>
                                          • testing and demonstrating the Service.<\/li><\/ul>

                                            Where this activity involves storing information on or accessing information from a user\u2019s device, we apply the requirements of applicable privacy and electronic-communications laws, including any applicable consent requirement or statutory exception.<\/p>

                                            7. Sizing and fit-recommendation Services<\/h2>

                                            Depending on the relevant Service and customer configuration, our sizing Services may process:<\/p>

                                            • height;<\/li>
                                            • weight;<\/li>
                                            • age range;<\/li>
                                            • selected sex or gender category where relevant to the sizing model;<\/li>
                                            • body measurements;<\/li>
                                            • garment or footwear measurements;<\/li>
                                            • size selections;<\/li>
                                            • fit preferences;<\/li>
                                            • questionnaire responses;<\/li>
                                            • product information;<\/li>
                                            • pseudonymous customer or session identifiers;<\/li>
                                            • purchase and return information supplied by the customer;<\/li>
                                            • submitted photographs; and<\/li>
                                            • sizing recommendations and confidence information.<\/li><\/ul>

                                              The Services are designed to provide product sizing and fit recommendations. They are not designed to diagnose health conditions or infer Special Category Personal Data.<\/p>

                                              Where a retailer provides information to Prime AI for this purpose, Prime AI normally acts as its Processor.<\/p>

                                              8. Visual Search, Virtual Try-On and image Services<\/h2>

                                              8.1 Visual Search<\/h3>

                                              Visual Search may process:<\/p>

                                              • images uploaded by users or customers;<\/li>
                                              • product photographs;<\/li>
                                              • image metadata;<\/li>
                                              • pseudonymous session identifiers;<\/li>
                                              • search queries; and<\/li>
                                              • interaction information.<\/li><\/ul>

                                                The image may be analysed to identify visual characteristics and return similar products or content.<\/p>

                                                8.2 Virtual Try-On and visualisation<\/h3>

                                                Virtual Try-On and related visualisation Services may process:<\/p>

                                                • user-submitted photographs;<\/li>
                                                • product and garment images;<\/li>
                                                • model images;<\/li>
                                                • image metadata;<\/li>
                                                • garment or product details;<\/li>
                                                • session identifiers; and<\/li>
                                                • generated visual outputs.<\/li><\/ul>

                                                  Images may be securely transmitted to an authorised technology provider solely to generate the requested visual result.<\/p>

                                                  Unless otherwise agreed with the customer, images used only for transient visual processing are not retained by Prime AI after the result is generated, except where temporary retention is necessary for:<\/p>

                                                  • delivering the result;<\/li>
                                                  • resolving an error;<\/li>
                                                  • protecting the security of the Service;<\/li>
                                                  • complying with customer instructions; or<\/li>
                                                  • meeting a legal obligation.<\/li><\/ul>

                                                    These Services are not intended to perform facial recognition or biometric identification.<\/p>

                                                    8.3 Rights to submitted images<\/h3>

                                                    Anyone submitting an image to Prime AI must ensure that they:<\/p>

                                                    • are entitled to use and submit the image;<\/li>
                                                    • have provided any required privacy notice;<\/li>
                                                    • have obtained any required permission or consent; and<\/li>
                                                    • do not submit an image in breach of another person\u2019s rights.<\/li>
                                                    • \u00a0<\/li><\/ul>

                                                      9. How and why we use Personal Data<\/h2>

                                                      We use Personal Data for the following purposes and legal bases.<\/p>

                                                      9.1 Responding to enquiries and arranging demonstrations<\/h3>

                                                      We use contact, professional and communication information to:<\/p>

                                                      • respond to enquiries;<\/li>
                                                      • understand requirements;<\/li>
                                                      • arrange meetings;<\/li>
                                                      • provide proposals;<\/li>
                                                      • demonstrate Services; and<\/li>
                                                      • take steps requested before entering into a contract.<\/li><\/ul>

                                                        Our legal bases are:<\/p>

                                                        • taking steps at your request before entering into a contract; and<\/li>
                                                        • our legitimate interests in responding to business enquiries and developing commercial relationships.<\/li><\/ul>

                                                          9.2 Providing and administering the Services<\/h3>

                                                          We use account, contact, technical, usage and configuration information to:<\/p>

                                                          • create and administer accounts;<\/li>
                                                          • provide access to the Services;<\/li>
                                                          • issue and manage API credentials;<\/li>
                                                          • monitor plan allowances;<\/li>
                                                          • configure integrations;<\/li>
                                                          • provide technical documentation;<\/li>
                                                          • deliver support;<\/li>
                                                          • communicate operational information; and<\/li>
                                                          • manage renewals and cancellations.<\/li><\/ul>

                                                            Our legal bases are:<\/p>

                                                            • performance of a contract;<\/li>
                                                            • taking steps before entering into a contract;<\/li>
                                                            • compliance with legal obligations; and<\/li>
                                                            • our legitimate interests in administering and improving our Services.<\/li><\/ul>

                                                              9.3 Billing, payments and financial administration<\/h3>

                                                              We use billing, transaction and account information to:<\/p>

                                                              • process payments;<\/li>
                                                              • issue invoices;<\/li>
                                                              • manage subscriptions;<\/li>
                                                              • collect amounts due;<\/li>
                                                              • maintain accounting records;<\/li>
                                                              • prevent payment fraud; and<\/li>
                                                              • comply with tax and financial obligations.<\/li><\/ul>

                                                                Our legal bases are:<\/p>

                                                                • performance of a contract;<\/li>
                                                                • compliance with legal obligations; and<\/li>
                                                                • our legitimate interests in managing our business and recovering amounts owed.<\/li><\/ul>

                                                                  9.4 Security, fraud prevention and misuse detection<\/h3>

                                                                  We use technical, account, device, session, network and security information to:<\/p>

                                                                  • authenticate users;<\/li>
                                                                  • protect accounts and API credentials;<\/li>
                                                                  • detect suspicious activity;<\/li>
                                                                  • prevent automated misuse;<\/li>
                                                                  • investigate security events;<\/li>
                                                                  • enforce usage restrictions;<\/li>
                                                                  • protect Prime AI, our customers and other users; and<\/li>
                                                                  • establish, exercise or defend legal claims.<\/li><\/ul>

                                                                    Our legal bases are:<\/p>

                                                                    • our legitimate interests in protecting our business, customers, systems and Services;<\/li>
                                                                    • performance of a contract;<\/li>
                                                                    • compliance with legal obligations; and<\/li>
                                                                    • establishment, exercise or defence of legal claims.<\/li><\/ul>

                                                                      Where separate electronic-communications rules apply to storage or access technologies, we also comply with any applicable consent requirement or statutory exception.<\/p>

                                                                      9.5 Analytics and Service improvement<\/h3>

                                                                      We may use website, technical, support and usage information to:<\/p>

                                                                      • understand how our websites and Services are used;<\/li>
                                                                      • identify technical problems;<\/li>
                                                                      • improve usability;<\/li>
                                                                      • measure Service performance;<\/li>
                                                                      • develop new features;<\/li>
                                                                      • conduct testing;<\/li>
                                                                      • maintain compatibility; and<\/li>
                                                                      • produce aggregated statistics.<\/li><\/ul>
                                                                        \u00a0<\/div>

                                                                        Our legal bases are:<\/p>

                                                                        • our legitimate interests in operating and improving Prime AI;<\/li>
                                                                        • performance of a contract; and<\/li>
                                                                        • consent where required for non-essential cookies or similar technologies.<\/li><\/ul>

                                                                          9.6 Business-to-business marketing<\/h3>

                                                                          We may use professional contact information to:<\/p>

                                                                          • send relevant information about Prime AI Services;<\/li>
                                                                          • invite business contacts to demonstrations or events;<\/li>
                                                                          • follow up on previous conversations;<\/li>
                                                                          • communicate product developments; and<\/li>
                                                                          • identify organisations that may reasonably benefit from our Services.<\/li><\/ul>

                                                                            Our legal bases are:<\/p>

                                                                            • our legitimate interests in marketing relevant B2B Services and developing our business; and<\/li>
                                                                            • consent where consent is required by applicable electronic-marketing law.<\/li><\/ul>

                                                                              You may object to direct marketing or unsubscribe at any time. Every marketing email should include an unsubscribe method.<\/p>

                                                                              We may retain a limited suppression record after an opt-out to ensure that further marketing is not sent.<\/p>

                                                                              9.7 Email engagement information<\/h3>

                                                                              Our business emails may contain technologies that provide information about:<\/p>

                                                                              • whether an email was delivered;<\/li>
                                                                              • whether it was opened;<\/li>
                                                                              • whether a link was selected; and<\/li>
                                                                              • the general device or email client used.<\/li><\/ul>

                                                                                We use this information to assess communications, maintain security and improve relevance.<\/p>

                                                                                Where consent is required, these technologies are used only with the necessary consent. You may disable image loading in your email client or object to this processing.<\/p>

                                                                                9.8 Legal and regulatory compliance<\/h3>

                                                                                We may use and disclose Personal Data to:<\/p>

                                                                                • comply with laws and lawful requests;<\/li>
                                                                                • respond to courts, regulators and public authorities;<\/li>
                                                                                • maintain required business and tax records;<\/li>
                                                                                • investigate complaints;<\/li>
                                                                                • protect legal rights;<\/li>
                                                                                • conduct due diligence; and<\/li>
                                                                                • establish, exercise or defend legal claims.<\/li><\/ul>
                                                                                  \u00a0<\/div>

                                                                                  Our legal bases are:<\/p>

                                                                                  • compliance with legal obligations;<\/li>
                                                                                  • our legitimate interests in protecting our legal and commercial position; and<\/li>
                                                                                  • establishment, exercise or defence of legal claims.<\/li><\/ul>

                                                                                    9.9 Corporate transactions<\/h3>

                                                                                    We may process and disclose relevant information when considering or completing:<\/p>

                                                                                    • an investment;<\/li>
                                                                                    • financing;<\/li>
                                                                                    • corporate reorganisation;<\/li>
                                                                                    • acquisition;<\/li>
                                                                                    • merger;<\/li>
                                                                                    • sale of assets; or<\/li>
                                                                                    • transfer of part or all of our business.<\/li><\/ul>
                                                                                      \u00a0<\/div>

                                                                                      Our legal basis is our legitimate interest in managing and developing our business.<\/p>

                                                                                      Any recipient will be required to protect Personal Data appropriately.<\/p>

                                                                                      9.10 Recruitment<\/h3>

                                                                                      Where you apply to work with Prime AI, we may use:<\/p>

                                                                                      • your name and contact details;<\/li>
                                                                                      • curriculum vitae;<\/li>
                                                                                      • employment and education history;<\/li>
                                                                                      • interview notes;<\/li>
                                                                                      • references;<\/li>
                                                                                      • right-to-work information; and<\/li>
                                                                                      • other information you provide.<\/li><\/ul>

                                                                                        Our legal bases are:<\/p>

                                                                                        • taking steps before entering into an employment or contractor agreement;<\/li>
                                                                                        • compliance with employment and legal obligations; and<\/li>
                                                                                        • our legitimate interests in assessing candidates and managing recruitment.<\/li><\/ul>
                                                                                          \u00a0<\/div>

                                                                                          10. Cookies and similar technologies<\/h2>

                                                                                          10.1 Technologies we use<\/h3>

                                                                                          Our websites and Services may use:<\/p>

                                                                                          • cookies;<\/li>
                                                                                          • local storage;<\/li>
                                                                                          • pixels and web beacons;<\/li>
                                                                                          • analytics tags;<\/li>
                                                                                          • scripts;<\/li>
                                                                                          • session-replay technologies;<\/li>
                                                                                          • device and browser signals; and<\/li>
                                                                                          • other storage and access technologies.<\/li><\/ul>

                                                                                            10.2 Strictly necessary and permitted technologies<\/h3>

                                                                                            Some technologies are necessary or legally permitted for purposes such as:<\/p>

                                                                                            • operating requested website functionality;<\/li>
                                                                                            • maintaining security;<\/li>
                                                                                            • authenticating users;<\/li>
                                                                                            • preventing fraud or abuse;<\/li>
                                                                                            • remembering privacy choices;<\/li>
                                                                                            • balancing traffic; and<\/li>
                                                                                            • maintaining a user\u2019s selected settings.<\/li><\/ul>

                                                                                              Where an applicable legal exception permits these technologies without consent, we may use them after providing the required information.<\/p>

                                                                                              10.3 Analytics and non-essential technologies<\/h3>

                                                                                              We seek consent before using non-essential analytics, advertising or similar technologies where consent is required.<\/p>

                                                                                              Non-essential technologies should not be activated before the required consent has been obtained.<\/p>

                                                                                              You can use our Cookie Settings tool to:<\/p>

                                                                                              • accept optional technologies;<\/li>
                                                                                              • reject optional technologies;<\/li>
                                                                                              • choose individual categories; and<\/li>
                                                                                              • change or withdraw your choices.<\/li><\/ul>

                                                                                                Withdrawing consent does not affect processing carried out lawfully before withdrawal.<\/p>

                                                                                                10.4 Browser controls<\/h3>

                                                                                                You may also block or delete cookies using your browser settings. Blocking necessary technologies may prevent parts of a website or Service from functioning correctly.<\/p>

                                                                                                The current technologies, providers, purposes and durations should be listed in the Cookie Settings tool or accompanying Cookie Policy.<\/p>

                                                                                                11. Who we share Personal Data with<\/h2>

                                                                                                We may share Personal Data with the following categories of recipients where reasonably necessary.<\/p>

                                                                                                11.1 Service providers and Subprocessors<\/h3>

                                                                                                These may include providers of:<\/p>

                                                                                                • website and cloud hosting;<\/li>
                                                                                                • data-centre and infrastructure services;<\/li>
                                                                                                • security and monitoring;<\/li>
                                                                                                • email and communications;<\/li>
                                                                                                • customer relationship management;<\/li>
                                                                                                • analytics;<\/li>
                                                                                                • session replay;<\/li>
                                                                                                • payment processing;<\/li>
                                                                                                • accounting;<\/li>
                                                                                                • customer support;<\/li>
                                                                                                • electronic signatures;<\/li>
                                                                                                • image processing;<\/li>
                                                                                                • artificial intelligence and visualisation;<\/li>
                                                                                                • software development; and<\/li>
                                                                                                • professional services.<\/li><\/ul>

                                                                                                  Providers processing Subscriber Personal Data on our behalf are subject to contractual data-protection and confidentiality obligations.<\/p>

                                                                                                  Our current Service Subprocessors should be identified on the Infrastructure Sub-processors page.<\/p>

                                                                                                  11.2 Prime AI customers<\/h3>

                                                                                                  Where an individual interacts with a Service deployed by one of our customers, we may provide the customer with:<\/p>

                                                                                                  • recommendations;<\/li>
                                                                                                  • identifiers;<\/li>
                                                                                                  • risk signals;<\/li>
                                                                                                  • technical outputs;<\/li>
                                                                                                  • search results;<\/li>
                                                                                                  • visual outputs;<\/li>
                                                                                                  • analytics; and<\/li>
                                                                                                  • information necessary to operate the Service.<\/li><\/ul>

                                                                                                    The customer determines how it uses those outputs.<\/p>

                                                                                                    11.3 Platform and integration providers<\/h3>

                                                                                                    Where a Service is supplied through Shopify or another platform, information may be shared with or received from that platform as necessary to:<\/p>

                                                                                                    • install and authenticate the application;<\/li>
                                                                                                    • provide the integration;<\/li>
                                                                                                    • manage billing;<\/li>
                                                                                                    • deliver requested functionality; and<\/li>
                                                                                                    • maintain security.<\/li><\/ul>

                                                                                                      The platform\u2019s own privacy policy also applies to its processing.<\/p>

                                                                                                      11.4 Professional advisers<\/h3>

                                                                                                      We may share information with:<\/p>

                                                                                                      • lawyers;<\/li>
                                                                                                      • accountants;<\/li>
                                                                                                      • auditors;<\/li>
                                                                                                      • insurers;<\/li>
                                                                                                      • banks;<\/li>
                                                                                                      • tax advisers; and<\/li>
                                                                                                      • other professional advisers.<\/li><\/ul>

                                                                                                        11.5 Public authorities and legal recipients<\/h3>

                                                                                                        We may disclose information where reasonably necessary to:<\/p>

                                                                                                        • comply with law;<\/li>
                                                                                                        • respond to a lawful request;<\/li>
                                                                                                        • protect rights or safety;<\/li>
                                                                                                        • investigate fraud or security incidents;<\/li>
                                                                                                        • enforce our agreements; or<\/li>
                                                                                                        • establish, exercise or defend legal claims.<\/li><\/ul>

                                                                                                          11.6 Corporate transaction recipients<\/h3>

                                                                                                          Information may be shared with potential investors, buyers, sellers, lenders or advisers involved in a proposed or completed corporate transaction, subject to appropriate confidentiality protections.<\/p>

                                                                                                          12. International transfers<\/h2>

                                                                                                          Prime AI is established in the United Kingdom and provides Services internationally.<\/p>

                                                                                                          Personal Data may be processed in:<\/p>

                                                                                                          • the United Kingdom;<\/li>
                                                                                                          • the European Economic Area; and<\/li>
                                                                                                          • other countries in which authorised service providers operate.<\/li><\/ul>

                                                                                                            Where Personal Data is transferred to a country not covered by an applicable adequacy decision or regulation, we use an appropriate legal safeguard where required.<\/p>

                                                                                                            Safeguards may include:<\/p>

                                                                                                            • the European Commission\u2019s Standard Contractual Clauses;<\/li>
                                                                                                            • the United Kingdom International Data Transfer Agreement;<\/li>
                                                                                                            • the United Kingdom Addendum to the Standard Contractual Clauses;<\/li>
                                                                                                            • contractual, technical and organisational supplementary measures; or<\/li>
                                                                                                            • another legally recognised transfer mechanism.<\/li><\/ul>
                                                                                                              \u00a0<\/div>

                                                                                                              You may contact us for further information about the safeguard relevant to your Personal Data.<\/p>

                                                                                                              13. How long we retain Personal Data<\/h2>

                                                                                                              We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected, including legal, contractual, accounting, security and dispute resolution requirements.<\/p>

                                                                                                              Our usual retention approach is as follows.<\/p>

                                                                                                              13.1 Enquiries and sales correspondence<\/h3>

                                                                                                              We normally retain enquiry, proposal, demonstration and sales correspondence for up to three years after the last meaningful interaction, unless:<\/p>

                                                                                                              • a contract is entered into;<\/li>
                                                                                                              • the information is required for a longer legal period;<\/li>
                                                                                                              • the individual objects earlier; or<\/li>
                                                                                                              • there is a continuing legitimate business relationship.<\/li><\/ul>

                                                                                                                13.2 Customer contracts and account records<\/h3>

                                                                                                                We normally retain customer agreements, order records and material account correspondence for the duration of the relationship and for up to six years afterwards where reasonably necessary for legal, tax, audit or contractual purposes.<\/p>

                                                                                                                13.3 Billing and tax records<\/h3>

                                                                                                                We retain invoices, transaction records and relevant accounting information for the period required by applicable tax, accounting and company law.<\/p>

                                                                                                                This will commonly be at least six years from the end of the relevant accounting period.<\/p>

                                                                                                                13.4 Support records<\/h3>

                                                                                                                We normally retain support requests and associated technical information for up to three years after the request is closed, unless a longer period is necessary because of:<\/p>

                                                                                                                • an ongoing customer relationship;<\/li>
                                                                                                                • a recurring technical issue;<\/li>
                                                                                                                • a security incident;<\/li>
                                                                                                                • a dispute; or<\/li>
                                                                                                                • a legal obligation.<\/li><\/ul>

                                                                                                                  13.5 Marketing information<\/h3>

                                                                                                                  We retain marketing information until:<\/p>

                                                                                                                  • you unsubscribe;<\/li>
                                                                                                                  • you object;<\/li>
                                                                                                                  • the information is no longer accurate;<\/li>
                                                                                                                  • there has been no meaningful engagement for a reasonable period; or<\/li>
                                                                                                                  • we determine that continued contact is no longer appropriate.<\/li><\/ul>

                                                                                                                    We may retain a minimal suppression record after an opt-out to prevent further marketing.<\/p>

                                                                                                                    13.6 Website analytics and cookies<\/h3>

                                                                                                                    Retention periods for analytics identifiers, cookies and similar technologies are stated in the Cookie Settings tool or applicable provider settings.<\/p>

                                                                                                                    13.7 Security and device information on Prime AI systems<\/h3>

                                                                                                                    Prime AI normally retains website security logs, access records and device or session intelligence used for Prime AI\u2019s own security purposes for:\u00a0360 days.\u00a0<\/p>

                                                                                                                    We may retain relevant information for longer where necessary to investigate an incident, prevent repeated abuse, comply with law or establish, exercise or defend legal claims.<\/p>

                                                                                                                    13.8 Subscriber Personal Data processed for customers<\/h3>

                                                                                                                    Where Prime AI acts as a Processor, retention is governed by:<\/p>