Privacy Policy

• Physicore Limited is the data controller for personal data described in this policy.
• We process personal data relating to website visitors and business contacts; personnel of customer organisations with whom Physicore delivers missions; and individuals whose image may be incidentally captured by aircraft, cameras or sensors during a customer mission.
• Missions are conducted under written agreement with the customer. For mission data, the customer is normally the controller and Physicore acts as its processor.
• Mission data, including imagery and sensor records, is held under the customer's control and retained only as the customer's agreement with Physicore specifies.
• We transfer personal data between the United Kingdom, the United States and other jurisdictions using the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, and adequacy decisions where available.
• You have rights over your personal data, set out in sections 11 and 12. To exercise them, contact partnerships@physicore.ai.

The controller of personal data described in this policy is Physicore Limited, a company incorporated in England and Wales, with its registered office at 1 Kingdom Street, London W2 6BD, United Kingdom ('Physicore', 'we', 'us', 'our'). Physicore also operates from 200 Page Mill Road, Palo Alto, CA 94306, United States.

For privacy queries, requests to exercise rights, or to contact our data protection point of contact, write to partnerships@physicore.ai or to the registered office marked for the attention of the Data Protection Lead. Where we appoint a UK or EU representative, their contact details will be published here.

This policy applies to personal data we process in connection with:

• visitors to www.physicore.ai and any subdomains we operate (the 'Site');
• business contacts and prospective customers who enquire about, negotiate or enter into agreements with us;
• personnel of customer organisations with whom Physicore delivers missions; and
• individuals whose image may be incidentally captured by aircraft, cameras or sensors during a customer mission.

This policy does not apply to processing carried out by our customers under their own controllership or by third party services that you access independently of the Site.

The categories of personal data we process depend on how you interact with us.

3.1 Website visitors and business contacts

• identifiers and contact details, including name, business email, telephone, employer and role;
• content of correspondence and enquiry forms, including information you choose to provide;
• device and connection data, including IP address, user agent, referrer, language and approximate location derived from IP; and
• cookie and analytics data as described in our Cookie Policy at /cookies.

3.2 Customer organisation personnel

• business contact details of personnel with whom we coordinate site access, mission scope and delivery;
• communications and operational information required to deliver the agreed mission; and
• access and audit records where required to administer the engagement.

3.3 Individuals incidentally captured during missions

• images or video of individuals present within a mission area where incidental capture cannot reasonably be avoided; and
• limited contextual information tied to that footage, including the time and location of capture.

Under the UK GDPR and the EU GDPR, we rely on the following lawful bases:

• Consent (Article 6(1)(a)) for non-essential cookies, optional marketing and any processing for which consent is the appropriate lawful basis.
• Contract (Article 6(1)(b)) where processing is necessary to take steps at your request or administer services requested by you as an individual.
• Legal obligation (Article 6(1)(c)) to comply with tax, accounting, anti-money-laundering, health and safety, and equivalent regulatory duties.
• Legitimate interests (Article 6(1)(f)) for operating, securing and improving the Site; managing business relationships; coordinating and delivering autonomous mission services; preventing fraud and misuse; and pursuing or defending legal claims. We carry out a balancing assessment where required, and a summary is available on request to partnerships@physicore.ai.

Physicore delivers missions, including aerial inspection, site security and surveillance, under written agreement with the customer. The customer determines the purpose of each mission and is normally the controller of the mission data; Physicore processes that data on the customer's documented instructions. The customer is responsible for notices to people within its sites and for the lawful basis for capture.

Aircraft and sensors are directed at the assets, areas and events defined in the mission, not at identifying individuals. Mission data is held under the customer's control, on infrastructure the customer approves, including fully disconnected systems where required.

• operating, securing and improving the Site, including analytics measured against our legitimate interests;
• responding to enquiries and negotiating and administering customer relationships;
• planning, conducting and supervising missions for customers;
• producing mission records and reports under commercial agreement;
• complying with legal, regulatory and contractual obligations; and
• establishing, exercising or defending legal claims.

We share personal data only where necessary and under appropriate safeguards. Recipients fall into the following categories:

• Customers, with whom we exchange operational information needed to plan and conduct missions under written agreements that allocate data protection responsibilities.
• Processors acting on our documented instructions, including cloud infrastructure, secure storage, business communications and analytics providers. Each processor is engaged under a written agreement meeting Article 28 UK GDPR where applicable.
• Professional advisers, including legal, audit, tax and insurance advisers bound by duties of confidence.
• Public authorities and law enforcement, where required by law, court order or to protect rights, property or safety.
• Acquirers in the event of a reorganisation, merger, sale or transfer of all or part of the business, subject to confidentiality undertakings.

We do not sell personal data and do not share personal data for cross-context behavioural advertising.

Physicore operates internationally. Personal data may be transferred to, stored in, or accessed from the United Kingdom, the United States, member states of the European Economic Area, and other jurisdictions where our processors or customers operate.

Where personal data is transferred outside the United Kingdom or the European Economic Area to a country not subject to an adequacy decision, we rely on one or more of the following mechanisms:

• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the EU Standard Contractual Clauses;
• the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), in the appropriate module; and
• the UK Extension to the EU-US Data Privacy Framework where the recipient is self-certified.

We carry out a transfer risk assessment for each transfer mechanism and apply supplementary measures, including encryption in transit and at rest, pseudonymisation and access controls, where the assessment requires them. A copy of the relevant safeguards is available on request to partnerships@physicore.ai.

We retain personal data only for as long as necessary for the purposes set out in this policy. Indicative retention periods are:

• website analytics and server logs: up to 13 months;
• business enquiry correspondence: 24 months from last contact, then deleted or anonymised;
• customer agreement records: duration of the agreement plus 7 years;
• mission imagery and sensor data: retained under the customer's control for the period set in the customer agreement; and
• mission records and reports: retained in accordance with the applicable customer agreement.

Where we are required to retain data for longer to comply with legal or regulatory obligations, we will do so for the minimum period required.

We maintain a written information security programme aligned with recognised standards. Controls include role-based access, principle of least privilege, multi-factor authentication for administrative access, encryption of data in transit and at rest, segregated environments for customer mission data, secure software development practices, vendor risk management, vulnerability scanning, logging and monitoring, and a documented incident response plan including breach notification procedures.

Subject to applicable law, you have the right to:

• request access to your personal data and a copy of it;
• request rectification of inaccurate or incomplete data;
• request erasure of personal data in defined circumstances;
• request restriction of processing;
• object to processing carried out on the basis of legitimate interests, including profiling;
• request portability of personal data you provided to us on the basis of consent or contract;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
• not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not carry out such processing.

To exercise any of these rights, contact partnerships@physicore.ai. We may need to verify your identity before responding. We will respond within one month, extendable by up to a further two months for complex requests, in accordance with Article 12 UK GDPR.

If you are a resident of California, Virginia, Colorado, Connecticut, Utah or any other US state granting equivalent rights, you may have the right to know what personal information we process about you, to request deletion or correction, to opt out of the sale or sharing of personal information, and to limit the use and disclosure of sensitive personal information.

Do Not Sell or Share My Personal Information. Physicore does not sell personal information and does not share personal information for cross-context behavioural advertising as those terms are defined under the California Consumer Privacy Act as amended by the California Privacy Rights Act.

To exercise a US state privacy right, contact partnerships@physicore.ai. We will not discriminate against you for exercising any right. You may authorise an agent to act on your behalf; we will require proof of authorisation.

The Site and our services are directed at business users. We do not knowingly process personal data of children under the age of 16. If you believe that a child's personal data has been processed in connection with our activities, contact partnerships@physicore.ai and we will take prompt steps to investigate and, where appropriate, delete the data.

If you have a concern about how we process your personal data, please contact partnerships@physicore.ai so we can address it. You also have the right to lodge a complaint with a supervisory authority:

• in the United Kingdom, the Information Commissioner's Office (ico.org.uk);
• in the European Economic Area, the supervisory authority of your member state of residence, place of work, or place of the alleged infringement; and
• in the United States, the applicable state attorney general or the California Privacy Protection Agency where relevant.

We may update this policy from time to time. The 'Last updated' date at the top of this page indicates when the most recent changes took effect. Where the changes are material, we will take reasonable steps to notify you, for example by a notice on the Site or by email where we hold your contact details.