Legal

PRIVACY & COOKIES POLICY

  1. Introduction

Welcome to Pilio Limited's Privacy & Cookies Policy.

Pilio Limited ("Pilio," "we," "our," "us") respects your privacy and is committed to protecting your personal data. This Privacy & Cookies Policy explains how we collect, use, disclose, and safeguard your personal data when you interact with us, apply for a role, or visit our website, and informs you of your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and Privacy and Electronic Communications Regulations (PECR).

2. Important information & who we are

2.1 Purpose of This Policy

This policy applies to:

  • Individuals interacting with us (e.g., customers, website visitors, job applicants).

  • Personal data collected via our website, marketing communications, and services.

This website is not intended for children, and we do not knowingly collect data relating to children.

2.2 Data Controller & Data Processor Roles

Pilio acts as a Data Controller when processing personal data for its own purposes (e.g., marketing, account management) and a Data Processor when processing data on behalf of an organisation (e.g., services provided through an Authorised Licensor).

2.3 Contact Details & Complaints

For privacy-related queries, contact our Data Privacy Manager:

  • Email: privacy@piliogroup.com

  • Postal Address: Pilio Limited, Data Privacy Manager, 16 Church Lane, Merton Park, London, SW19 3PD

  • Regulator: If unresolved, you may contact the Information Commissioner’s Office (ICO) at www.ico.org.uk.

3. The data we collect about you

3.1 Personal Data Categories

We may collect the following types of personal data:

  • Identity Data (e.g., name, title, date of birth)

  • Contact Data (e.g., email, phone number, address)

  • Financial Data (e.g., bank details, payment card information)

  • Technical Data (e.g., IP address, device type, browser details)

  • Usage Data (e.g., website interactions, preferences)

  • Marketing & Communications Data (e.g., preferences for receiving marketing)

3.2 Special Category Data & Criminal Data

We do not collect special category data (e.g., health, ethnicity) or criminal conviction data unless required for a job application (see Section 10).

3.3 Automated Technologies & Cookies

We use cookies and analytics tools to collect Technical Data and Usage Data (see Section 9).

4. How we use your personal data

We process your personal data under the following lawful bases:

We will not send personal marketing emails without opt-in consent and you can withdraw consent at any time.

5. Data Sharing & Third Parties

We only share personal data where necessary. This includes:

  • Service providers (e.g., IT, payment processors).

  • Regulatory authorities (e.g., HMRC, law enforcement).

  • Your Organisation (if you access our services via an employer or business partner).

  • Third parties with explicit consent (e.g., marketing partners).
    We require all third parties to protect your data and do not sell personal data.

Managing Cookies

You can manage cookies via browser settings or our Cookie Consent Tool. To opt out of Google Analytics tracking, visit Google Opt-Out.

10. Processing Personal Data of Job Applicants

If you apply for a role with Pilio, we process personal data for recruitment purposes:

  • Collected from: You, references, public sources (e.g., LinkedIn).

  • Used for: Assessing qualifications, conducting interviews, verifying employment history.

  • Retention: Unsuccessful applications deleted after 6 months, unless you consent to longer retention.

11. Your Data Protection Rights

Under UK GDPR, you have rights including:

  • Access: Request a copy of your personal data.

  • Correction: Request rectification of inaccurate data.

  • Erasure: Request deletion in certain circumstances.

  • Objection: Object to processing for direct marketing.

  • Restriction: Request limited processing.

  • Portability: Request transfer of your data.

Requests are free unless excessive. We respond within one month. Contact us at privacy@piliogroup.com.

12. Changes to This Policy

We update this policy periodically. Last updated: March 2025.

By continuing to use our website and services, you agree to this Privacy & Cookies Policy.

6. International Data Transfers

Where personal data is transferred outside the UK (e.g., Google Analytics, Stripe payments), we ensure adequate safeguards, such as:

  • UK International Data Transfer Agreement (IDTA)

  • Standard Contractual Clauses (SCCs) with additional security measures

7. Data Security

We have security measures to prevent data breaches and restrict access to authorised personnel only. We will notify affected users and regulators in the event of a significant data breach.

8. Data Retention

We retain personal data only as long as necessary for the original purpose and legal obligations. Key retention periods:

  • Customer & transaction data: 6 years (legal/tax reasons).

  • Marketing data: Until opt-out (reviewed every 2 years).

  • Job applications: 6 months unless requested for retention.

9. Cookies & Tracking Technologies

Cookies are small files stored on your device that help enhance website functionality. Under UK PECR, we require consent for non-essential cookies.

Cookie: User ID. Purpose: This cookie is essential for the website to operate. It allows us to synchronise your login status between the forum section of the website and the other sections of the website. 

Cookie: Session. Purpose: This cookie is essential for the website to operate. It allows us to remember your details during your current visit to the website. Most of the cookies we use are known as session cookies.

Cookie: authautologin. Purpose: This cookie is a functionality cookie which automatically logs users in if their “session” cookie has expired. This allows you to navigate away from the website and then return to the website in the same browsing session. 

Cookie: lastactivity. Purpose: This cookie is a functionality cookie which records the time of your last visit to the website. This allows us to bring updates which you may have missed to your attention. 

Cookie: lastvisit. Purpose: (a) Identity (b) Contact (c) Technical 

Cookie: password. Purpose: This cookie is a functionality cookie which remembers your password in order to automatically log you into the forum sections of our website if you have already logged into your account. 

Cookie: Google Analytics. Purpose: This is an analytical / performance cookie. The website uses Google Analytics to help analyse how users use the website, collecting standard internet log information and visitor behaviour information in an anonymised form from which no user is identifiable. This information is transmitted to Google and processed to compile statistical reports on activity on the website. These reports allow us to optimise our user experience. Google provide a browser add-on for users who wish to prevent their data from being used by Google Analytics. Further information is available at https://tools.google.com/dlpage/gaoptout/. 

Glossary

Lawful Basis

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.


Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.


Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.


Third Parties

​

External Third Parties:

​

Third parties that your organisation has a contract with or intends to enter a contract with (e.g. a Authorised Licensor of our services such as Julie’s Bicycle) in relation to our services.


Third parties whom you explicitly ask us to provide your personal data to for the potential or actual delivery of our products and/or services.


Service providers (for example, IT services), business partners, suppliers and sub-contractors for the performance of any contract we enter into with you, but also when providing you with marketing communications.
Analytics and search engine providers that assist us in the improvement and optimisation of the website.
Government or other law enforcement agencies, in connection with the investigation of unlawful activities or for other legal reasons (this may include your location information).


Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.


HM Revenue & Customs, regulators and other authorities based in the United Kingdom who require reporting of processing activities in certain circumstances.

 

Your Legal Rights

​

You have the right to:


Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.


Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. 


Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.


Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: 


If you want us to establish the data's accuracy.


Where our use of the data is unlawful but you do not want us to erase it.


Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims. 


You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. 


Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. 


Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.