Privacy Policy
Last Updated: October 2026
Data Controller: Puapi Ltd
Registered Address: 18 Charlecote Gardens, Sydenham, Leamington Spa, England, CV31 1GE
Email: info@puapi.com
Phone: 0333 335 5580
Puapi Ltd (“we”, “our”, “us”) is committed to protecting the privacy and security of your personal information. We are a data controller under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
In short: We are responsible for the personal information you share with us, and we take this responsibility seriously.
Information You Provide Directly: - Contact Information: Name, email address, postal address, telephone number
- Account Information: Username, password, account preferences
- Communication Data: Messages, feedback, queries, or other information you provide when contacting us
- Transaction Information: Payment details, purchase history, order information
- Marketing Preferences: Your preferences for receiving marketing communications
Information We Collect Automatically: - Technical Data: IP address, browser type and version, operating system, device information
- Usage Data: Pages visited, features used, time spent on the website, date and time of visits, referral source
- Location Data: Approximate location derived from your IP address
- Cookie Data: Information collected through cookies and similar technologies
In short: We collect information you give us and information we gather automatically when you use our website.
We collect your personal data through: - Direct interactions:When you contact us, create an account, subscribe to our newsletter, or purchase our services
- Automated technologies: Via cookies and similar technologies when you visit our website
- Third parties: From analytics providers, advertising networks, search information providers, and payment processors
We use your personal data for the following purposes:
· To provide and manage our services (Contact, Account, Transaction data). Legal basis: Performance of contract.
· To process and deliver your orders (Contact, Transaction data). Legal basis: Performance of contract.
· To manage our relationship with you (Contact, Account, Communication data). Legal basis: Contract / Legitimate interests.
· To administer and protect our business and website (Technical, Usage data). Legal basis: Legitimate interests.
· To deliver relevant content and advertisements (Technical, Usage, Marketing Preferences data). Legal basis: Legitimate interests.
· To use data analytics to improve our website and services (Technical, Usage data). Legal basis: Legitimate interests.
· To send marketing communications (Contact, Marketing Preferences data). Legal basis: Consent / Legitimate interests.
· To comply with legal obligations (All categories as required). Legal basis: Legal obligation.
Our Legitimate Interests include: running our business, preventing fraud, maintaining security, improving services, and marketing to existing customers.
In short: We use your data to provide services, improve your experience, comply with the law, and (if you allow us) to send you updates and offers.
We may share your data with: - Service providers: IT support, payment processors, delivery companies, marketing agencies
- Professional advisers: Lawyers, bankers, auditors, and insurers
- Government authorities: HM Revenue & Customs, regulators, and other authorities as required by law
- Business transfers: In the event of a merger, acquisition, or sale
We require all third parties to respect the security of your data and not use it for their own purposes.
If we transfer your personal data outside the UK, we ensure it is protected through: - Adequacy decisions by the UK Government
- UK Government-approved standard contractual clauses
- Other safeguards as required by law
In short: Even if your data is stored outside the UK (e.g., on cloud servers), it will still be protected.
· Account information: Until account deletion + 1 year
· Transaction records: 7 years (tax and accounting requirements)
· Marketing data: Until consent withdrawn + 1 year
· Website analytics: 26 months
· Communication records: 3 years
In short: We keep your data only as long as needed for legal, business, or service reasons.
Under UK data protection laws, you have the right to: - Be informed about how we use your data
- Access your personal data
- Correct inaccurate or incomplete data
- Request deletion of your data (in certain cases)
- Restrict how we use your data
- Receive your data in a portable format
- Object to certain uses (e.g., marketing)
- Withdraw consent at any time
In short: You are always in control of your personal information.
We take steps to protect your data, including: - Encryption of data in transit and at rest
- Regular security assessments and updates
- Access controls and staff training
- Incident response procedures
We will notify you and the ICO if a serious data breach occurs.
We do not use automated decision-making or profiling that would have legal or significant effects on you. If this changes, we will update this policy.
We use cookies to improve your experience. For details, please see our [Cookie Policy].
We may update this Privacy Policy from time to time. We will notify you by: - Posting the updated policy on our website
- Updating the “Last Updated” date above
- Emailing you if there are significant changes
Data Protection Enquiries:
Email: info@puapi.com
Post: 18 Charlecote Gardens, Sydenham, Leamington Spa, England, CV31 1GE
You can make a complaint to the Information Commissioner’s Office (ICO):
- Website: www.ico.org.uk
- Phone: 0303 123 1113
- Live chat: Available on the ICO website
We would appreciate the chance to resolve your concerns before you contact the ICO, so please contact us first.
If a Puapi Marketing user chooses to connect Google Calendar, Puapi Marketing requests read-only access to the user’s calendar list and calendar events. This access is used only to let the user select a calendar and import its meetings into their private Puapi Marketing Planner.
Puapi Marketing may store the selected calendar identifier and name, event title, description, start and end times, location, meeting link, status, Google event identifier, and encrypted OAuth access and refresh tokens.
Google Calendar information is isolated to the Puapi Marketing account that connected it. We do not create, modify or delete events in Google Calendar. We do not sell Google user data, use it for advertising, share it with other consultants, or use it to train artificial intelligence models.
Imported events are retained for a rolling period covering the previous 12 months and the next 12 months. Older imported events are automatically deleted. Users can disconnect Google Calendar through Planner → Connections. Disconnecting removes the stored Google authorization tokens and Google-imported event copies. Users can also revoke access through their Google Account. Deleting the Puapi Marketing account removes its Google connection and imported calendar data.
Our handling of information received from Google APIs follows the Google API Services User Data Policy and its Limited Use requirements.
For privacy questions or deletion requests, contact info@puapi.com.
