1 Who we are

DUCTIO LTD is a private company limited by shares incorporated in England and Wales under company number 17303286. In this policy, “Ductio”, “we”, “us” and “our” refer to DUCTIO LTD.

For privacy questions or to exercise a data protection right, use the privacy request or contact form at www.ductio.co.uk or write to Data Protection, DUCTIO LTD, at the registered office above. We may ask for information reasonably necessary to verify identity and locate the relevant records.

2 Our data protection roles

2.1 When Ductio acts as a controller

Ductio generally acts as a controller when we decide the purposes and means of processing, including when we:

• operate our website, manage accounts, administer subscriptions, provide support and communicate with customers, prospects and partners;
• collect professional information from public sources, licensed data providers, customers and other third parties to create, verify, maintain and supply executive intelligence;
• generate, quality-check and maintain professional insights, contextual analysis, confidence indicators and other derived information;
• protect our services, prevent misuse, maintain audit records and comply with legal obligations; and
• analyse service usage and improve Ductio's products, subject to the limits in this policy and our contracts.

2.2 When Ductio acts as a processor

Ductio acts as a processor where a customer uploads or connects personal data and determines the purpose for which Ductio processes it, for example customer notes, candidate documents, interview records, project files, communications or call transcripts. In those circumstances, the customer is normally the controller and Ductio processes the data under the customer agreement and data processing agreement.

If your request concerns information controlled by a Ductio customer, please contact that customer first. We will assist the customer where required by law and contract. Ductio may still act as an independent controller for account, security, billing and service-usage information generated through use of the platform.

3 Who this policy concerns

This policy may apply to:

• website visitors, trial users, account holders and authorised customer users;
• executives, directors, candidates, employees, founders, advisers and other professionals who appear in Ductio intelligence records or customer projects;
• customer and prospective-customer contacts, suppliers, partners, investors and event participants;
• people whose information is contained in documents, communications, recordings or connected services supplied by a customer; and
• people who contact us, submit a privacy request or interact with our support services.

4 Personal data we collect

The information we process depends on the relationship and features used. It may include the following categories.

 

4.1 Sensitive information

Ductio is not designed to use special category data or criminal-offence data as a routine input to executive intelligence. Such information can include health, ethnicity, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric identification data, sex life or sexual orientation, and criminal allegations or convictions. Public availability does not remove the legal protections that apply to this information.

We process sensitive information only where it is necessary for a clearly defined and lawful purpose, an additional legal condition applies, and appropriate safeguards are in place. Customers must not upload sensitive information unless authorised by law and by their agreement with Ductio. Ductio does not intentionally infer sensitive characteristics for candidate matching, ranking or employment recommendations.

5 Where information comes from

We may obtain personal data from:

• the individual, including through our website, platform, assessments, support channels and communications;
• Ductio customers and their authorised users;
• licensed professional-data, company-data, news, regulatory and research providers;
• public sources, including company websites, official registers and filings, professional biographies, published interviews, press releases, reputable media and publicly accessible professional profiles where collection and use are permitted;
• connected services and integrations authorised by a customer or user;
• service providers that support identity, security, analytics, customer service and platform operation; and
• analysis performed by Ductio, including linking information from multiple sources and deriving professional insights from underlying evidence.

We take reasonable steps to record relevant source and provenance information. A source being publicly accessible does not automatically mean every use is fair or lawful; we consider the nature of the information, the professional context, reasonable expectations, intended use and effect on the individual.

6 Why we use personal data and our lawful bases

We identify a lawful basis for each purpose. The applicable basis depends on the activity and circumstances. Where we rely on legitimate interests, we assess the purpose, necessity and effect on individuals and apply safeguards. Where special category or criminal-offence data is involved, we also identify an additional condition required by law.

 

7 Executive intelligence, profiling and artificial intelligence

7.1 How Ductio produces intelligence

Ductio may organise professional information, match records believed to relate to the same person, summarise evidence, compare experience with defined requirements, identify patterns and create derived indicators. Some of this processing may constitute profiling because it evaluates aspects of a person's professional experience, performance, reliability, suitability or likely fit for a business context.

Ductio uses automated and AI-assisted tools to support research, extraction, classification, summarisation, comparison and quality control. Outputs may be incomplete, uncertain or incorrect. We therefore design the service to retain supporting evidence, indicate uncertainty where appropriate and enable authorised users to review the basis of material conclusions.

7.2 Human decision making

Ductio does not make the final decision to hire, reject, promote, dismiss, invest in or otherwise take significant action concerning an individual. Ductio provides decision support. Customers remain responsible for meaningful human review, checking relevant evidence, considering context, addressing inaccuracies and complying with employment, equality, data protection and other applicable laws.

Ductio does not authorise customers to use the platform as the sole basis for a decision that produces legal or similarly significant effects on an individual. Where applicable law permits a particular automated decision, the responsible controller must provide the required information and safeguards, including human intervention and a way for the individual to express their view or challenge the decision.

7.3 Model development and customer content

We may use service telemetry, feedback and appropriately de-identified or aggregated information to test, secure and improve the platform. We do not use identifiable customer content or confidential customer project data to train a general-purpose model for the benefit of unrelated customers unless the customer has expressly agreed and the processing is lawful. Our service providers may process prompts and outputs only to provide and secure the contracted service and subject to applicable contractual restrictions.

8 Accuracy, fairness and professional profiles

Professional information changes and source materials may contain errors. We use proportionate measures to improve accuracy, which may include source comparison, provenance records, confidence indicators, automated checks and human review. We distinguish factual source material from analysis or opinion where reasonably possible.

Individuals may ask us to correct inaccurate factual information, add relevant context, restrict disputed processing or object to processing. We may retain a suppression record so that information removed following a valid request is not inadvertently reintroduced from another source. We may decline to alter a genuinely held customer opinion, but we will consider whether it should be marked as disputed, restricted or removed.

9 Customer responsibilities

Customers and authorised users must:

• have a lawful basis for personal data they upload, connect, request or use through Ductio;
• provide required privacy information and obtain consent where the law requires it, including for recording or transcription;
• use Ductio only for lawful, proportionate and transparent purposes;
• apply meaningful human review to material decisions and not treat a Ductio score or summary as determinative;
• avoid discriminatory use and comply with employment, equality, surveillance and sector-specific requirements;
• limit access to authorised users and maintain appropriate account security; and
• honour individual rights and cooperate with Ductio where a request relates to customer-controlled data.

10 How we share and commercially provide personal data

We may disclose, provide, license, make available or permit access to personal data where it is necessary, proportionate and lawful for the purposes described in this policy.

10.1 Customers and authorised users

We may provide personal data to authorised customer organisations and their users where the information forms part of a subscribed Ductio service, executive intelligence product, customer project, integration or other agreed service.

Customers may use the information only for lawful professional and business purposes permitted by their agreement with Ductio. These purposes may include executive research, recruitment, succession planning, investment assessment, governance, organisational design, risk management and related decision-making.

Customers are responsible for establishing their own lawful basis, providing any privacy information required from them, respecting individual rights and applying meaningful human review to decisions concerning individuals.

10.2 Commercial provision and licensing of professional intelligence

Ductio may provide, license, sell, make available or permit access to professional information, executive profiles, source-linked intelligence, derived professional insights and related datasets through current or future Ductio products and services.

Recipients may include executive-search and recruitment organisations, corporate talent teams, investors, private-equity firms, professional-services firms, technology providers, data providers and other organisations using the information for lawful professional, recruitment, succession, investment, governance, risk or organisational decision-making purposes.

In some cases, a recipient may access or incorporate Ductio intelligence through its own product, platform, application programming interface, integration or service. Depending on the arrangement, the recipient may act as:

- an independent controller responsible for determining its own purposes and lawful basis;

- a processor acting only on Ductio’s documented instructions; or

- a joint controller where Ductio and the recipient jointly determine relevant purposes and means of processing.

Before making personal data available, Ductio will assess the intended purpose, lawful basis, necessity, proportionality, reasonable expectations of the individuals concerned, contractual controls and respective data-protection responsibilities.

Where appropriate, recipients will be contractually restricted from using the information for unrelated purposes, attempting to infer protected or sensitive characteristics, making solely automated decisions with legal or similarly significant effects, conducting unlawful or discriminatory profiling, or passing the information to additional parties without appropriate authority and safeguards.

Ductio may receive payment or other commercial benefit for providing or licensing professional information and intelligence. This does not remove Ductio’s obligations to process personal data lawfully, fairly and transparently or the rights available to individuals under applicable data-protection law.

10.3 Use across Ductio products

 

Ductio may use professional information, executive profiles, source evidence and derived insights across current and future Ductio products and services where the use is compatible with the professional and business purposes described in this policy.

Where a proposed product or use would be materially different from, or unexpected in relation to, the purposes for which the information was originally obtained, Ductio will assess the new purpose and lawful basis and provide additional privacy information before commencing the processing where required.

10.4 Service providers and subprocessors

We may share personal data with contracted service providers that support Ductio’s operations. These may include cloud-hosting, identity, security, analytics, communications, customer-service, transcription, payment and other technology providers.

These organisations may process personal data only for the contracted services and subject to appropriate confidentiality, security and data-protection obligations. Where a provider acts as Ductio’s processor, it must act only on Ductio’s documented instructions unless applicable law requires otherwise.

Current subprocessors and material service providers should be identified in Ductio’s published subprocessor list or relevant customer documentation.

10.5 Professional advisers, authorities and corporate transactions

We may also disclose personal data to:

- professional advisers, auditors, insurers, banks, investors and lenders subject to appropriate confidentiality obligations;

- licensed data and content providers where disclosure is required for verification, rights handling, audit, contractual compliance or the correction of source information;

- law-enforcement bodies, courts, regulators, public authorities or other recipients where disclosure is legally required or reasonably necessary to protect rights, safety or security; and

- a prospective or actual buyer, investor, lender or successor in connection with a genuine financing, merger, acquisition, restructuring, insolvency, transfer or sale of all or part of Ductio’s business or assets, subject to confidentiality and applicable law.

10.6 Advertising and unrelated uses

Ductio does not sell or disclose personal data to unrelated organisations for consumer advertising, behavioural advertising or purposes unrelated to the professional and business uses described in this policy.

Laws in some jurisdictions may define “sale”, “sharing” or similar terms broadly enough to include certain commercial licensing or data-access arrangements even where the information is not used for consumer advertising. Where such laws apply, Ductio will provide the notices, rights and opt-out mechanisms required by those laws.

10.7 Individual rights and onward disclosure

Individuals may contact Ductio to request access, correction, restriction, deletion or suppression, or to object to processing, as described in section 17.

Where appropriate and required by law, Ductio will communicate a valid correction, deletion, restriction or suppression request to relevant recipients. Ductio may retain limited suppression information to prevent removed or objected-to information from being inadvertently reintroduced or supplied again.

11 Integrations and third-party services

Authorised users may connect Ductio to third-party services such as identity providers, meeting platforms, communication tools, customer relationship systems or document repositories. The permissions requested and information exchanged depend on the integration. The customer or user is responsible for authorising the connection and reviewing the third party's terms and privacy practices.

Ductio processes integration data only as needed to provide, secure and support the connection and for any additional purposes clearly described at activation. Users can disconnect an integration, although information already imported may remain until deleted under the customer's instructions or the applicable retention rules.

12 Voice, meetings and transcription

Voice and transcription features are disabled by default and are activated only when an authorised user enables the feature or configures the required telephone number or integration. Before recording or transcribing a communication, customers and users must provide all notices and obtain all permissions required in the relevant jurisdiction.

Where enabled, Ductio and its contracted providers may process call or meeting metadata, audio, transcripts, summaries and related participants' contact details. The platform should display applicable usage limits and provide access to the relevant privacy and retention information. Customers control access to customer recordings and may select shorter retention periods where supported.

13 Cookies, analytics and marketing

Our website and platform use essential technologies needed for security, authentication, preferences and service delivery. With any consent required by law, we may also use analytics, functionality and marketing technologies to understand use, improve services and measure communications. Further details, including cookie names, providers, purposes and durations, should be provided through Ductio's cookie notice and consent tool.

You can change non-essential cookie choices through the consent tool. Browser controls may also limit cookies, although blocking essential technologies may prevent parts of the service from working.

You may opt out of marketing emails using the unsubscribe link or by contacting us. We may still send necessary service, security, billing and account communications. Business contacts may also object to marketing based on legitimate interests.

14 International transfers

Ductio is established in the United Kingdom. Our customers, data sources and service providers may operate in other countries, so personal data may be accessed from or transferred outside the United Kingdom and, where relevant, the European Economic Area.

Where a restricted transfer occurs, we use an appropriate legal mechanism, such as an adequacy regulation or decision, the UK International Data Transfer Agreement, the UK Addendum to the European Commission Standard Contractual Clauses, the Standard Contractual Clauses, or another legally recognised safeguard. We also consider whether supplementary contractual, technical or organisational measures are appropriate. Information about a relevant safeguard may be requested through our contact channels, subject to lawful confidentiality restrictions.

15 Security

We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and access. Measures are selected according to risk and may include access controls, authentication, encryption in transit and at rest where appropriate, logging, environment separation, supplier review, vulnerability management, backups, incident response and staff confidentiality obligations.

No system is completely secure. Customers must protect credentials, configure user access appropriately and notify Ductio promptly of suspected unauthorised access. Where a personal data breach occurs, we will investigate and notify affected controllers, regulators or individuals when required by law.

16 Retention and deletion

We retain personal data only for as long as reasonably necessary for the stated purpose, including contractual, security, legal, accounting and dispute-resolution requirements. We consider the amount, nature, sensitivity, source, accuracy, risk and continuing relevance of the information. The periods below are the standard position unless law, a customer instruction, an active dispute or a documented exception requires a different period.

 

When data is no longer required, we delete, anonymise or securely isolate it. We may retain minimal information needed to record an objection, opt-out or deletion request and prevent the information from being reintroduced.

17 Your data protection rights

Depending on the law and circumstances, you may have the right to:

• receive information about how your personal data is used;
• access personal data held about you;
• correct inaccurate or incomplete personal data;
• request deletion of personal data;
• restrict processing while a matter is investigated;
• object to processing based on legitimate interests, including profiling, and object absolutely to direct marketing;
• receive certain information in a portable format;
• withdraw consent at any time where processing relies on consent, without affecting earlier lawful processing; and
• receive safeguards relating to qualifying solely automated decisions and challenge such a decision.

These rights are not absolute. We may need to retain or continue processing information where a lawful exemption or overriding requirement applies. We will explain the outcome of a request and any available route of complaint. We do not discriminate against a person for exercising a privacy right.

17.1 How to make a request

Submit a request through the privacy or contact form at www.ductio.co.uk or write to the registered office. Please identify yourself, describe the information or profile concerned and state the right you wish to exercise. Where a profile may be confused with another person, we may request additional information solely to confirm identity and locate the correct record.

If Ductio holds information only as a processor for a customer, we will refer the request to the relevant customer or explain how to contact them. We normally respond within the period required by applicable law. Complex or numerous requests may take longer where the law permits, and we will explain any extension.

18 Information obtained indirectly

Ductio often obtains professional information from sources other than the individual. Where required, we provide privacy information within the applicable legal period. The law may allow an exception where individual notice would be impossible or involve disproportionate effort, where the individual already has the information, or where another specific exemption applies. We assess such exceptions rather than assuming that professional or public information is exempt.

We support transparency through this public policy, source and provenance controls, direct notice where appropriate, customer-facing safeguards and accessible correction, objection and removal routes.

19 Children

Ductio's services are intended for business and professional use and are not directed to children. We do not knowingly create executive intelligence profiles about children or permit children to create accounts. If we learn that a child's personal data has been collected without an appropriate lawful basis, we will take reasonable steps to delete or restrict it.

20 Regulatory complaints

We encourage you to contact us first so we can investigate the concern. You may also complain to the UK Information Commissioner's Office through ico.org.uk or by calling 0303 123 1113. If you live or work in the European Economic Area, you may also have the right to complain to the supervisory authority in the relevant country.

21 Changes to this policy

We may update this policy to reflect changes in law, technology, services, suppliers or processing. We will publish the current version with its effective date. If a change materially affects how we use personal data, we will take reasonable steps to provide additional notice, such as an in-product message or email to account contacts, before the change takes effect where appropriate.

22 Contact Ductio

Email: support@dutio.co.uk

Website and privacy request form: www.ductio.co.uk