At a Glance

This Privacy Statement applies to Customers Admins and Managers who hold a named account on the PepTalk Platform. It explains what personal data we collect, why we collect it, and your rights in relation to it. Field workers and end users who interact with the Platform via a Kiosk, QR code, or hyperlink do so entirely anonymously. No personal data is collected from those interactions.

Who we are: The applicable PepTalk entity as set out in Clause 1 below, determined by your organisation’s location.

Who this applies to: Customer Admins and Managers with a named PepTalk account only.

What we collect: Name, work email address, and Platform usage data associated with your named account.

Why we collect it: To provide and maintain your access to the Platform and to improve our services.

Who we share it with: Our sub-processors (e.g. hosting providers). We do not sell your data or share it with third parties for marketing.

How long we keep it: For the duration of your organisation’s subscription, plus up to 24 months thereafter.

Your rights: Access, rectification, erasure, restriction, portability, and objection. Contact us at privacy@peptalk.com.

Supervisory authority: Data Protection Commission, Ireland (www.dataprotection.ie) or your local supervisory authority.

‍

1. Who We Are

The data controller in respect of your personal data is the PepTalk entity that contracted with your organisation, as set out below:

EU and all non-US territories: Langley Resources Limited, trading as PepTalk (“PepTalk EU”). Registered in Ireland. Registered office: Block 1, Ground Floor, Millbank Business Park, Lower Lucan Road, Lucan, Co. Dublin, Ireland.

United States: PepTalk USA Inc. (“PepTalk US”). Incorporated in New York. Office: 575 5th Avenue, WeWork, 14th Floor, New York, NY 10017.

In these Terms, “PepTalk”, “we”, “us”, and “our” refer to the applicable entity above. The applicable entity is determined by the Order Form agreed with your organisation. Where no entity is specified, PepTalk EU applies by default. For GDPR purposes, the data controller is the applicable PepTalk entity above. Questions or requests relating to your personal data should be directed to privacy@peptalk.com.

‍

2. Who This Statement Applies To

This Privacy Statement applies only to Customer Admins and Managers who have been issued a named account on the PepTalk Platform by their organisation. It does not apply to field workers, contractors, trade partners, or any other individuals who interact with the Platform via a Kiosk, QR code, or hyperlink. Those interactions are entirely anonymous — no personal data is collected, stored, or processed in connection with them.

‍

3. Personal Data We Collect

In connection with your named account, we collect and process the following personal data:

Account data: Your name and professional email address, provided by your organisation when your account is set up.

Usage data: Records of your login activity and use of the Platform dashboard, collected automatically to maintain platform security and performance.

Communications: Any correspondence you send us in connection with support queries or account administration.

‍

We do not collect any special categories of personal data (as defined under GDPR), biometric data, financial data, or health information. We do not collect personal data from individuals interacting with the Platform anonymously via Kiosk, QR code, or hyperlink. We do not knowingly collect personal data from anyone under the age of 18.

‍

4. Why We Process Your Data

We process your personal data on the following legal bases:

Performance of a contract: Processing necessary to provide the Platform to your organisation and to give you access to your named account under your organisation’s subscription.

Legitimate interests: Maintaining platform security, monitoring usage for performance purposes, and improving our services using anonymised and aggregated data.

Legal obligation: Where processing is required to comply with applicable Irish, EU, or US law.

‍

5. How We Use Your Data

We use your personal data to:

- create and manage your named account on the Platform;

- provide you with access to the Customer Dashboard and associated management tools;

- maintain the security and performance of the Platform;

- respond to support queries or account administration requests from you; and

- improve and develop the Platform using anonymised and aggregated data derived from usage patterns.

We do not use your personal data for marketing to you as an individual, and we do not sell your personal data to any third party.

‍

6. Sharing Your Data

We do not share your personal data with third parties except in the following limited circumstances:

Sub-processors: We engage third-party service providers (e.g. cloud hosting, platform infrastructure) who process personal data on our behalf. All sub-processors are bound by data processing agreements consistent with GDPR. A current list is available at www.peptalkhq.com/legal/subprocessors.

Legal disclosure: Where required by applicable law, court order, or regulatory authority.

Business transfer: In the event of a merger, acquisition, or asset sale, your data may transfer to the acquiring entity. We will provide reasonable advance notice where practicable.

‍

7. International Data Transfers

Your personal data is primarily processed and stored within the EEA or the United States, depending on the applicable PepTalk entity. Where we transfer data outside the EEA, we do so only where appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or equivalent mechanisms under applicable data protection law.

For further information on the safeguards applicable to your data, contact privacy@peptalk.com.

‍

8. How Long We Keep Your Data

We retain your personal data for the duration of your organisation’s subscription with PepTalk and for up to 24 months following the end of that subscription, to allow for orderly offboarding, to address any outstanding queries or claims, and to meet applicable legal obligations.

On expiry of the applicable retention period, personal data is securely deleted or anonymised.

‍

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures are reviewed regularly.

In the event of a personal data breach affecting your data, we will notify the relevant supervisory authority within 72 hours of becoming aware and will notify you without undue delay where the breach poses a high risk to your rights and freedoms.

‍

10. Your Rights

As a named account holder whose personal data we process, you have the following rights under applicable data protection law:

Access: Request a copy of the personal data we hold about you.

Rectification: Ask us to correct any inaccurate or incomplete data.

Erasure: Ask us to delete your data where it is no longer necessary, or where you withdraw consent and no other legal basis applies.

Restriction: Ask us to restrict processing in certain circumstances (e.g. while accuracy is contested).

Portability: Where processing is based on contract or consent and carried out by automated means, request your data in a structured, machine-readable format.

Objection: Object to processing carried out on the basis of legitimate interests. We will cease unless we can demonstrate compelling grounds.

To exercise any of these rights, contact us at privacy@peptalk.com. We will respond within one month. We may extend this by a further two months for complex requests, in which case we will notify you. You also have the right to lodge a complaint with your relevant supervisory authority. For EU users: Data Protection Commission, Ireland — www.dataprotection.ie. For US users: the applicable state privacy regulator.

‍

11. Changes to This Statement

We may update this Privacy Statement from time to time. Where changes are material we will notify affected account holders in advance by email. The date at the top of this document indicates when it was last updated. Continued use of the Platform following notification of material changes constitutes acceptance of the updated Statement.

‍

12. Contact

For any questions, requests, or concerns regarding this Privacy Statement or the processing of your personal data:

Email: privacy@peptalk.com

EU postal address: Langley Resources Limited t/a PepTalk, Block 1, Ground Floor, Millbank Business Park, Lower Lucan Road, Lucan, Co. Dublin, Ireland

US postal address: PepTalk USA Inc., 575 5th Avenue, WeWork, 14th Floor, New York, NY 10017

EU Supervisory Authority: Data Protection Commission — www.dataprotection.ie