1Who we are
Patario Limited (“Patario”, “we”, “us”) is a company registered in England and Wales (Company No. 17023042), with registered office at South Wonston Farm House, South Wonston, Winchester, England, SO21 3HL.
We operate in two distinct privacy roles depending on the context. When you visit our website, sign up for a demo, or interact with us as a prospect, we are the data controller — we determine why and how your personal data is used, and this Privacy Policy applies directly to you. When your employer or organisation enrols you on the Patario platform as a learner or administrator, your employer is the data controller and we process your data on their instructions as a data processor. In that context, your employer’s own privacy notice applies and you should contact them with any privacy questions about your training records.
| Role | When | What this means |
|---|---|---|
| Data controller | When processing data about marketing visitors, prospects, and billing contacts | We determine the purposes and means of processing. This Privacy Policy applies directly. |
| Data processor | When processing learner data on behalf of a client workspace | We process on the client’s instructions. The client is the controller. Our obligations are set out in the Data Processing Agreement. |
For all privacy enquiries: [email protected].
ICO registration number: ZC135963
2Scope of this policy
This Privacy Policy applies to:
- patario.com (marketing site)
- app.patario.com (platform)
- All services provided by Patario Limited
This policy does not apply to client workspaces’ own privacy practices. Where a client organisation enrols its employees as learners on the Patario platform, that client remains the data controller for those learner records. Patario processes that data as a processor under the terms of our Data Processing Agreement.
3What personal data we collect
| Category | Data elements |
|---|---|
| Account data | Name, email address, workspace role, authentication events and timestamps |
| Learner activity data | Course progress, module completion records, assessment results, Socratic tutor conversation records |
| Special category data (incidental) | Learners may incidentally input special category data (such as health information or other sensitive details) during Socratic tutor sessions. This is processed under Art. 9(2)(b) UK GDPR as data relating to obligations in the context of employment and professional compliance training. The platform’s AUP prohibits deliberate upload of sensitive personal data outside this context. |
| Marketing data | Prospect details submitted via the invite-request or contact form; email engagement data (opens, clicks) via Brevo |
| Billing data | Transaction records and payment metadata processed via Stripe. We do not store full card numbers — Stripe holds payment instrument data as our processor. |
| Technical data | Device type, browser type, hashed IP address, referrer URL |
| Cookie data | See our Cookie Policy for full details |
4How we collect personal data
- Directly from you — when you sign up, complete forms, set preferences, or contact us
- Automatically — via cookies, server logs, and platform usage (see Cookie Policy)
- From clients — when a client admin invites you to a workspace as a learner or admin
- From payment providers — transaction confirmation and billing status from Stripe
5Why we process your personal data and on what legal basis
| Processing purpose | Lawful basis | UK GDPR reference |
|---|---|---|
| Creating and managing your account; delivering the training platform | Performance of a contract | Art. 6(1)(b) |
| Processing payments and maintaining billing records | Performance of a contract; Legal obligation (tax/accounting) | Art. 6(1)(b); Art. 6(1)(c) |
| Sending transactional communications (account confirmations, password reset, workspace invites) | Performance of a contract | Art. 6(1)(b) |
| Service improvement — analysing aggregate usage to improve course and tutor quality | Legitimate interests | Art. 6(1)(f) — see LIA |
| Platform security and fraud prevention | Legitimate interests | Art. 6(1)(f) — see LIA |
| Sending marketing communications to existing customers about relevant new features | Legitimate interests | Art. 6(1)(f) — see LIA |
| Sending marketing communications to prospects (opt-in) | Consent | Art. 6(1)(a) |
| Non-essential cookies and analytics (GA4) | Consent | Art. 6(1)(a) + PECR |
| Retaining financial records as required by HMRC | Legal obligation | Art. 6(1)(c) |
| Processing incidental special category data entered during tutor sessions | Employment/professional obligations | Art. 9(2)(b) |
You have the right to object to processing based on legitimate interests at any time. See Your rights below.
6Sharing with third parties
We share your personal data only with trusted processors who help us deliver the platform. We do not sell your personal data. We do not use your data for cross-context behavioural advertising.
Our current subprocessors are:
| Subprocessor | Purpose | Privacy information |
|---|---|---|
| Supabase | Database hosting (EU — eu-west-1) | supabase.com/privacy |
| Google Cloud Platform / Vertex AI | AI infrastructure and compute (EU — europe-west4) | policies.google.com/privacy |
| Stripe | Payment processing | stripe.com/privacy |
| Brevo | Email delivery and marketing (EU infrastructure) | brevo.com/legal/privacypolicy |
| Google Analytics 4 | Aggregate web analytics (consent-gated) | policies.google.com/privacy |
| Cookiebot | Cookie consent management | cookiebot.com/en/privacy-policy |
We will give clients 30 days’ written notice of any material changes to our subprocessor list, as set out in the Data Processing Agreement.
7International transfers
Your application data is hosted within the EU:
- Supabase — database hosted in eu-west-1 (EU)
- GCP Cloud Run / Vertex AI — hosted in europe-west4 (EU)
- Brevo — EU-resident email infrastructure
Some third-party processors involve transfers to the United States:
- Stripe — payment processing. Relies on the UK-US Data Bridge (in force 17 October 2023) and, where applicable, the UK International Data Transfer Agreement (IDTA).
- Google Analytics 4 — analytics. Relies on the UK-US Data Bridge and Standard Contractual Clauses with UK Addendum.
8How long we keep your data
We retain personal data for the minimum period necessary for the purpose for which it was collected. The full data retention schedule is available on request from [email protected].
| Data category | Retention period | Reason |
|---|---|---|
| Active account and workspace data | Duration of contract + 12 months | Renewal grace period; supports re-onboarding |
| Deleted workspace data | 90 days post-deletion request | Recovery window for error; hard delete thereafter |
| Completion records and certificates | 6 years from completion | UK statute of limitations; HSE / FCA evidence norms |
| Learner tutor conversation records | 24 months from session close | Pedagogical review and prompt quality; raw text purged, aggregate metrics retained |
| Billing and financial records | 7 years | HMRC statutory requirement |
| Marketing contacts — active | Until unsubscribe + 30 days | List hygiene |
| Marketing contacts — prospects (non-converted) | 12 months from last engagement, then deleted | Proportionate retention for unconverted leads |
| Audit logs (admin and prompt) | 6 years | Compliance and forensic evidentiary window |
| Access event logs | 24 months | Support traceability and abuse investigation |
| System and server logs | 30 days | Operational debugging |
| Consent records (marketing, cookie, AI disclosure) | Duration of relationship + 6 years | Audit trail defence |
| Cookie consent records | 12 months | PECR re-prompt cycle |
| Backups | 7–35 days (platform-managed) | Operational recovery |
Erasure requests override the above except where a legal obligation requires continued retention (primarily billing records held under HMRC requirements).
9Your rights
Under UK GDPR you have the following rights in relation to your personal data:
| Right | Description | How to exercise |
|---|---|---|
| Access | Obtain a copy of the personal data we hold about you | Email [email protected]; we will respond within one month (Art. 12(3)) |
| Rectification | Correct inaccurate data | Email [email protected] or update directly in your account settings where available |
| Erasure | Request deletion of your data in certain circumstances | Email [email protected]; or use the in-product deletion function where available |
| Restriction | Ask us to restrict processing while a dispute is resolved | Email [email protected] |
| Portability | Receive your data in a structured, machine-readable format | Email [email protected] |
| Objection | Object to processing based on legitimate interests or for direct marketing | Email [email protected]; marketing objections actioned immediately via unsubscribe |
| Withdraw consent | Where processing is based on consent, withdraw at any time | Use the Cookie settings link in the footer of any Patario page to manage cookie consent; email [email protected] for marketing consent |
| Complain | Lodge a complaint with the ICO | ico.org.uk/make-a-complaint — we would encourage you to contact us first |
We aim to respond to all rights requests within one month of receipt. In complex cases we may extend by up to two further months (we will notify you if this applies).
10How we protect your data
We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our detailed Technical and Organisational Measures (TOMs) are available to clients and enterprise prospects on request under appropriate confidentiality undertakings — please contact [email protected].
11Cookies
We use cookies and similar technologies on our site. For full details of the cookies we use, how we use them, and how to manage your preferences, see our Cookie Policy.
12Automated decision-making
We use automated processing to determine the outcome of course module assessments on the Patario platform. Assessment scores and pass/fail outcomes are generated algorithmically based on your responses to assessment questions. These outcomes are recorded in your learner record and may be used by your employer as evidence of completed compliance training.
We consider this processing to fall within Art. 22(2)(b) UK GDPR as it is necessary for the performance of a contract between you (or your employer) and Patario. Where you are a consumer purchasing directly, we rely on your explicit consent under Art. 22(2)(a).
You have the right to request a human review of any automated assessment outcome that you believe is inaccurate. To exercise this right, contact us at [email protected]. We will review the outcome and respond within one month.
13Children and age restrictions
The Patario platform is strictly for use by individuals aged 18 and over. This restriction applies to all users of the platform, including learners, client administrators, and workspace owners. We do not knowingly collect personal data from anyone under the age of 18.
If you are a client organisation and you become aware that a user under the age of 18 has accessed the platform, please notify us immediately at [email protected]. We will suspend that account and delete the associated personal data promptly.
If we become aware that we have collected personal data from a person under 18 without appropriate authorisation, we will delete it without delay.
14Changes to this policy
We will notify you of material changes to this Privacy Policy by:
- Email to account holders at least 30 days before the change takes effect
- An on-site banner at patario.com
Previous versions of this policy are available on request from [email protected].
15Contact us
Patario Limited
South Wonston Farm House, South Wonston, Winchester, England, SO21 3HL
Email: [email protected]
Registered in England and Wales, company number 17023042
South Wonston Farm House, South Wonston, Winchester, England, SO21 3HL
[email protected]