Privacy Policy — Pixels Insights

1. Who is responsible for your data

When you use Pixels Insights as a member of staff of a Pixels First customer, that customer is normally the data controller for the stock, sales, staff-activity and other business records held in its account. The customer decides why and how those records are used. Pixels First normally acts as a data processor for that data and processes it on the customer's documented instructions.

Pixels First is the data controller for the limited personal data that we determine is necessary to operate and protect our own service, such as account provisioning, service and session security, support records, billing administration and service-improvement diagnostics.

Pixels First Ltd, company number 10257942.
Privacy correspondence: 19 Moulton St, Cheetham Hill, Manchester M8 8FQ, United Kingdom.
Email: privacy@pixelsfirst.co.uk.

2. What we collect and access

• Account and identity data — your work email address or staff ID, display name, role, and the depot or store to which you are assigned.
• Authentication and security data — sign-in timestamps, session tokens, and device identifiers used to authenticate you and keep sessions secure.
• App activity and audit data — work actions carried out in the app, such as barcode scans, counts, audits, stock in and out, adjustments, transfers, purchase orders and goods receipt, together with relevant time, reference, store/location and user details.
• Business records — product, cost, price, stock, supplier, sales, VAT and cash figures belonging to your employer or the relevant Pixels First customer. These records are generally business data, but they may be personal data where they identify or can be linked to an individual.
• Device and technical data — device model, operating-system version, app version, language, crash reports and error logs.
• Support data — information you provide when contacting support, which may include messages, screenshots and call or case notes.

Camera permission

Pixels Insights may request access to the device camera solely so that you can scan barcodes. Camera images used for barcode scanning are not stored by Pixels Insights or transmitted to Pixels First as photographs or video.

Data we do not use for advertising

Pixels Insights is not used for behavioural advertising or advertising profiling. Based on the app's intended functionality, we do not collect your contacts, browsing history or device location through Pixels Insights.

3. Why we use personal data and our lawful bases

Customer-controlled business data

For personal data contained in a customer's Pixels First account, the customer determines the purpose and lawful basis for the processing. Pixels First processes that data on the customer's instructions under its service arrangements with the customer.

Data for which Pixels First is the controller

Where Pixels First acts as controller, we use personal data only where there is an appropriate lawful basis. Depending on the processing, this may include:

• Providing and administering the service — our legitimate interests, and those of our customers, in providing the contracted Pixels First service to authorised users.
• Authentication, fraud prevention and account security — our legitimate interests in protecting users, customers, systems and business information.
• Support and fault resolution — our legitimate interests in responding to support requests and maintaining a reliable service.
• Reliability and product improvement — our legitimate interests in improving the service using proportionate technical diagnostics, including aggregated or de-identified information where appropriate.
• Legal and regulatory obligations — compliance with a legal obligation where we are required to retain information or respond to a lawful request.

Where we rely on legitimate interests, we consider the necessity and proportionality of the processing and the impact on individuals. You may contact us for more information about how we have assessed those interests.

4. Who we share personal data with

Depending on the data and the context, information may be shared with:

• Your employer or organisation — the Pixels First customer whose account you are authorised to use, including its administrators and authorised head-office users.
• Hosting and infrastructure providers — suppliers that operate servers, databases or related infrastructure for us under contractual data-protection terms.
• Support, error-monitoring and communications providers — service providers used to operate, support and protect the service.
• Professional advisers, auditors and insurers — where reasonably necessary for professional, legal, audit or insurance purposes.
• Public authorities, regulators or law enforcement — where disclosure is required or permitted by law.
• A purchaser or successor — if all or part of our business is sold, transferred or reorganised, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal data, and we do not share personal data with advertising networks or data brokers for behavioural advertising.

5. International transfers

Our primary hosting is in the United Kingdom or the European Economic Area. If a service provider processes personal data in a country outside the United Kingdom, we use an appropriate transfer mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, and additional safeguards where appropriate.

You may contact us to ask for more information about relevant providers and international-transfer safeguards.

6. Retention and deletion

We do not keep personal data for longer than reasonably necessary for the purpose for which it is processed, subject to contractual, legal, accounting, security and dispute-resolution requirements.

• Account and authentication records — normally for the life of the account and for up to 12 months after deactivation, unless a longer period is required for security, legal or dispute purposes.
• Stock, audit and sales records — retained under the relevant customer's retention policy. Records supporting accounting or tax obligations may commonly need to be retained for several years.
• Support correspondence — normally for up to 24 months after the support issue is closed.
• Crash and error logs — normally for up to 90 days.
• Backups — normally retained on a rolling cycle for up to 35 days.

Account and data deletion requests

Pixels Insights does not provide self-service account creation. If your account was issued by your employer or another Pixels First customer, you may ask that organisation's administrator to deactivate your access or make an appropriate deletion request. You may also contact privacy@pixelsfirst.co.uk.

Where the customer is the controller, Pixels First will action deletion or restriction of customer-controlled data on the customer's lawful instruction, subject to any applicable legal or contractual retention requirement. Data in rolling backups is removed as those backups expire in the normal course of the backup cycle.

7. Security

We use technical and organisational measures designed to protect personal data. These include encryption in transit using TLS and encryption at rest on our servers, access controls based on role and business need, multi-factor authentication for relevant administrative access, audit logging, system patching, security testing and incident-response procedures.

If Pixels First is acting as a processor and becomes aware of a personal data breach affecting customer-controlled data, we notify the relevant controller without undue delay and assist the controller with its obligations. Where Pixels First is the controller, we assess whether a breach is notifiable and, where required, notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it. We notify affected individuals where the law requires us to do so.

Please keep your sign-in credentials confidential, secure your device, and promptly tell your administrator or our support team if a device is lost or you suspect unauthorised access.

8. Your data protection rights

Depending on the circumstances and the lawful basis for processing, UK data-protection law may give you rights including access to your personal data, rectification, erasure, restriction, data portability, and the right to object to certain processing. You also have protections in relation to certain significant decisions made solely by automated means. Not all rights apply in every situation.

Pixels Insights does not use personal data to make solely automated decisions about you that produce legal or similarly significant effects.

If the relevant data is held in your employer's or organisation's Pixels First account, please raise your request with that organisation first because it is normally the controller. We will support the controller in responding to valid requests. You can also contact privacy@pixelsfirst.co.uk.

Where Pixels First is responsible for responding to a request, we will respond without undue delay and normally within one month after the applicable response period begins. Where permitted by law, the period may be extended by up to a further two months for complex or numerous requests, and we will explain the reason for any extension.

If you are unhappy with how personal data has been handled, you can complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would welcome the opportunity to address your concern first.

9. Local storage and similar technologies

The app does not use advertising cookies or third-party advertising trackers. It stores security/session information and local preferences on your device so that authorised sessions can be maintained and app settings can persist.

If you visit a Pixels First website, that website may use cookies or similar technologies under the privacy and cookie information applicable to that website.

10. Children

Pixels Insights is a workplace tool and is not intended for children under 16. We do not knowingly provide Pixels Insights accounts to children under 16.

11. Changes to this policy

We may update this policy when the app, our processing practices or applicable legal requirements change. When we do, we will update the version number and date shown at the top of this page and publish the revised policy. We will provide additional notice of material changes where appropriate and obtain consent where consent is required by law.

12. Contact us