privacy policy

Buddi Limited is committed to protecting personal data (personally identifiable information) and upholding individuals’ right to privacy. This privacy notice explains how Buddi collects, uses and processes personal data, and outlines the rights individuals have in relation to that data. It applies to information provided directly to us or via third parties and covers data relating to customers, contractors, suppliers and employees in the performance of our business activities.

We comply with current UK privacy laws, primarily the UK GDPR (General Data Protection Regulation) and the Data Protection Act 2018 (DPA 2018), as supplemented by the Data (Use and Access) Act 2025 (DUAA). Where an individual is located in a different country or state, the most stringent applicable law shall be applied.

Any queries regarding this notice should be directed to privacy@buddi.co.uk or to the Data Protection Representative, Buddi Limited, Talbot House, 17 Church St, Rickmansworth WD3 1DE, UK.

Buddi Limited is registered with the UK Information Commissioner’s Office as a Data Controller (Registration No. Z9274127) and maintains a comprehensive Data Protection Policy.

Personal information refers to any data relating to an identifiable individual.

Buddi Limited collects personal information only for lawful purposes connected to our business functions and activities, and only where such collection is necessary for those purposes. We do not collect personal information by means that are unfair, unreasonable or unduly intrusive.

Any individual collecting personal information on behalf of Buddi Limited must comply with this Privacy Notice, our Data Protection Policy, and all applicable legal requirements.

Buddi Limited uses personal information only for lawful purposes connected to our business and services. We process information in ways consistent with the purpose it was collected, unless another lawful basis applies.
We may use personal information to:

• provide, manage, and support our products and services;
• verify identity and maintain accurate records;
• communicate about services, enquiries, updates, and operational matters;
• manage relationships with customers, contractors, suppliers, and employees;
• meet legal, regulatory, and contractual obligations;
• ensure the security and proper functioning of our systems;
• carry out governance, auditing, and service improvement activities.

Buddi Limited will not use or disclose personal information unless such use or disclosure is lawful and appropriate. We may use or disclose personal information where one or more of the following conditions apply:

a. the use or disclosure is necessary for the purpose for which the information was originally collected, or for a purpose compatible with that original purpose;
b. the disclosure is made to the individual concerned or to a person acting on their behalf;
c. the information has been anonymised so that the individual cannot be identified;
d. the individual has provided consent for the specific use or disclosure;
e. the information originates from a publicly available source and using or disclosing it would be fair, lawful, and reasonable;
f. the use or disclosure is required for law enforcement, crime prevention, the protection of public revenue, or for the exercise or defence of legal claims;
g. the use or disclosure is necessary to protect someone’s vital interests, including preventing or reducing a serious risk to an individual’s life, health, or safety, or to public health or safety;
h. the use or disclosure is necessary for national security or intelligence functions where permitted by law;
i. the disclosure is necessary in connection with a business transaction, such as a merger, acquisition, or sale of assets, and appropriate safeguards are in place;
j. the use or disclosure is required or authorised by law, including court orders or statutory obligations;
k. the use or disclosure is otherwise permitted under the UK GDPR or Data Protection Act 2018, including where we have a legitimate interest that is not overridden by the individual’s rights and freedoms.

Buddi Limited may disclose personal information only when necessary and lawful, including to:

• service providers and partners supporting our services;
• regulatory or law enforcement authorities where required;
• professional advisers such as auditors, insurers, or legal representatives;
• other parties with consent or where we have a lawful basis.

All third parties who process personal information on our behalf must comply with confidentiality and data protection requirements. We do not sell personal information.

Access to personal information is limited to those who need it to perform their duties and protected with strict technical and organisational measures.

Buddi Limited primarily processes personal information within the UK. However, some of our service providers or partners may operate outside the UK or may store data in other jurisdictions. Where personal information is transferred internationally, we ensure that such transfers comply with UK data protection law.

We will only transfer personal information outside the UK where:

• the destination country has been recognised as providing an adequate level of data protection; or
• appropriate safeguards are in place, such as UK

International Data Transfer Agreements (IDTAs), Addenda to EU Standard Contractual Clauses (SCCs), or other legally recognised mechanisms; and

• individuals have enforceable rights and effective legal remedies.

We require all overseas recipients of personal information to protect it to the same standard required under UK data protection legislation.

If you would like further details about international transfers or the safeguards we use, please contact us at privacy@buddi.co.uk.

Buddi Limited takes steps to ensure personal information is accurate, complete and kept up to date. Individuals should notify us of any changes to their information.

Appropriate technical and organisational measures protect personal data from unauthorised access, disclosure, alteration or loss.

Although we take all reasonable precautions, no electronic transmission or storage is completely secure. Once received, personal information is handled according to strict security procedures in line with our Data Protection Policy and our responsibilities as a UK-registered Data Controller.

Buddi Limited keeps personal information only as long as necessary for the purposes it was collected or to meet legal, regulatory or contractual requirements. Our standard maximum retention period is 10 years.

When information is no longer needed, it is securely deleted, anonymised or disposed of in line with our Data Protection Policy.

Individuals may request details of retention periods by contacting us.

Under UK data protection law, individuals have certain rights in relation to their personal information held by Buddi Limited. These rights include:

• Access – the right to request a copy of the personal information we hold about you.
• Correction – the right to have inaccurate or incomplete information corrected.
• Erasure – the right to request deletion of personal information, where lawful.
• Restriction – the right to request that processing of personal information is limited in certain circumstances.
• Data Portability – the right to receive personal information in a structured, commonly used format and transfer it to another controller.
• Objection – the right to object to certain processing activities, including direct marketing.
• Withdraw Consent – where processing is based on consent, the right to withdraw it at any time.
• Lodge a Complaint – the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your data has been mishandled.

To exercise any of these rights, please contact us at privacy@buddi.co.uk or write to our Data Protection Representative at the address above.

We reserve the right to update or revise this notice at any time. Any material changes will be reflected promptly.

All queries should be addressed to:

Data Protection Representative
Buddi Limited
Talbot House
17 Church Street
Rickmansworth
Hertfordshire WD3 1DE
United Kingdom.

Email: privacy@buddi.co.uk

Effective Date: This Privacy Notice is effective as of 11th December 2025

Version: 1.3

When using the Buddi Loop app, we collect your device’s precise location (e.g., GPS) periodically.

Purposes for Collection
Primary functionality: Geofencing and real-time location tracking to comply with your onboarded program.
Analytics: To improve app features and understand usage patterns.

Data Retention & Security
Location data is stored securely on our servers.
It is not shared with unrelated third parties.

Consent
We request location permissions at runtime.
Users must consent to location access for features to work.