Eigen Limited Privacy Policy

General

At EIGEN, we take data privacy very seriously. Data protection and privacy are part of Eigen’s Information Security Policy subject to internal and external audits as part of our ongoing ISO 27001 certification, to help us manage your data and keep it secure. 

To protect your privacy, EIGEN follows different principles in accordance with the most stringent practices concerning privacy and data protection, which are aligned with Europe’s General Data Protection Regulation (GDPR) and the British equivalent “Data Protection Act 2018”. 

Technical and organisational measures include measures to deal with any suspected data breach. If you suspect any misuse or loss or unauthorised access to your Data, please let us know immediately by contacting the Privacy Team at the e-mail address: dataprivacy@eigen.co. 

For purposes of the applicable Data Protection Laws, Eigen is the “data controller”. This means that Eigen determines the purposes for which, and the manner in which, your Data is processed. 

In general: 

• Customer information that comes into the possession of EIGEN in the context of a contractual agreement shall be kept confidential and shall not be disclosed to any third party without the consent of the customer.
• We will not disclose personal customer data such as your name, postal address, phone number, email address or any other personal information to anyone.
• We will use state of the art security measures to protect any information you give us from unauthorised access. 

EIGEN through planned and systematic measures, will ensure adequate information security with respect to confidentiality, integrity and accessibility when processing personal data. Such information protection policies shall be made available to the customer and its auditors, upon request.

Personal Data Management

Eigen maintains formalised procedures for the collection, processing, storage, retention and deletion of
personal data in accordance with applicable data protection laws and regulations.

These activities are governed by Eigen’s Information Security Policy and supporting standards, which
define the technical and organisational controls required to ensure the confidentiality, integrity and
availability of personal data throughout its lifecycle.

Personal data is processed only for defined purposes, limited to what is necessary, and retained only
for as long as required. Secure disposal processes are applied when data is no longer needed.

Data Breach Notification

Eigen maintains formal procedures for identifying, reporting, and investigating personal data breaches
in accordance with applicable data protection laws.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of
individuals, Eigen will notify the UK Information Commissioner’s Office (ICO) without undue delay
and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to affected individuals, Eigen will also communicate
the breach to those individuals without undue delay, in accordance with legal requirements.

Internal Escalation Procedure:

• All suspected or actual data breaches must be reported immediately upon discovery.
• Incidents must be escalated internally to the Data Privacy Team without delay
• Initial reports should include the nature of the breach, categories of data affected, and any
  known or suspected impact.
  All breach notifications and enquiries should be directed to: dataprivacy@eigen.co
  Eigen maintains records of all data breaches, including facts relating to the breach, its effects, and
  remedial actions taken.
  Data Protection Impact Assessments (DPIAs)
  Eigen is committed to conducting Data Protection Impact Assessments (DPIAs) where processing is
  likely to result in a high risk to individuals’ rights and freedoms.
  DPIAs are carried out prior to the deployment of any high-risk processing activities, including but not
  limited to:
• Use of Artificial Intelligence or machine learning systems.
• Implementation of new analytics or monitoring tools.
• Profiling or automated decision-making processes.

DPIAs assess the necessity, proportionality, and risks associated with processing activities and identify measures to mitigate those risks.

Processing will not proceed until appropriate safeguards are in place and risks have been reduced to an acceptable level.

Lawful Basis for Processing

Eigen processes personal data under one or more of the following legal bases:

• Consent
• Contractual necessity
• Legal obligation
• Legitimate interests (balanced against individual rights)

For website cookies and similar tracking technologies:

• Strictly necessary cookies are processed on the basis of legitimate interests to ensure the website functions correctly.
• Analytics and advertising cookies are processed on the basis of user consent, in accordance with applicable privacy and data protection laws.

Customer Personal Data

When managing Eigen software deployed for our customers, Eigen automatically collects customer contact details and data about Eigen software utilisation including login emails and usage statistics, for the purpose of licensing and improving our services.

On Eigen’s Software, including Eigen Ingenuity and Eigen Ingenuity Plug in for Excel, Eigen may collect the email addresses and IPs of logins, date, times and frequency with which you access our services and the way you use and interact with its content.

Website Data Collection 

On Eigen’s websites, eigen.co and eigeningenuity.co, we use first- and third-party cookies and similar tracking technologies for analytics, functionality, and advertising purposes.

We use tools such as Google Analytics and Microsoft Clarity to understand how users interact with our website. This includes the collection of behavioural data through technologies such as session replay, heatmaps, and analytics tools, which may capture interactions including page visits, clicks, scrolling, and navigation activity.

This processing may involve profiling and behavioural analysis for the purpose of improving website performance, user experience, and marketing effectiveness.
Where this processing is based on our legitimate interests (such as strictly necessary website functionality and limited analytics), you have the right to object to such processing at any time. You can exercise this right or manage/withdraw your preferences via the website cookie settings.

This data is typically processed in an aggregated and/or pseudonymised form where possible and is not used to directly identify individual users. However, certain data elements (such as IP addresses or online identifiers) may be considered personal data under applicable data protection laws.

Where required by law, we will obtain your consent before placing non-essential cookies (including analytics and advertising cookies) on your device. You can manage or withdraw your consent at any time via our cookie banner.

We use this information for site optimisation, security and fraud prevention, and to measure the effectiveness of our marketing and advertising activities.

For more information about how Microsoft collects and processes personal data through Microsoft Clarity and Microsoft Advertising, please refer to the Microsoft Privacy Statement: https://privacy.microsoft.com/en-gb/privacystatement

You can also find more information about how Google processes personal data here: https://policies.google.com/privacy

Cookies and Tracking Technologies

Our website uses the following categories of cookies:

Strictly Necessary Cookies

These cookies are essential for the operation of our website and cannot be switched off. They are typically set in response to actions such as setting privacy preferences or filling in forms.

Analytics Cookies

These cookies help us understand how visitors interact with our website by collecting and reporting information in an aggregated manner. We use providers such as Google Analytics and Microsoft Clarity for this purpose.

Advertising Cookies

These cookies are set by our advertising partners (such as Google and Microsoft) and are used to build a profile of your interests and show you relevant advertisements on other websites.

Marketing Cookies

We use marketing cookies to enable our meeting booking widget, which allows you to schedule meetings directly from our website. These cookies are set by a third-party service and may track your interaction with the widget. If you do not accept these cookies, the booking feature will be unavailable. You can still contact us through other methods.

You can control your cookie preferences at any time through our cookie banner. For more detailed information about the cookies, we use and to manage your preferences, please refer to the cookie banner available on our website.

Use of Customer Contact Details

Customer’s contact details will be used in the normal course of business engagements with the customer and, if specifically consented by the customer, for the distribution of information about Eigen’s products and services, which will be of interest to the customer.

We may use your Data for the above purposes if we deem it necessary to do so for our legitimate interests. If you are not satisfied with this, you have the right to object in certain circumstances (see the section headed “Your rights” below).

Personal data of customers in the United Kingdom or Europe shall not be transferred to countries outside the United Kingdom or the European Economic Area (EEA) without the prior written consent of the customer.

The customer has the rights and duties set out in the UK’s Data Protection Act 2018 with respect to the treatment of personal data.

CUSTOMER (NON-PERSONAL) DATA

During the course of business with Eigen it may be necessary for customers to share data including plans, project information, designs, databases, etc. This data will be processed within the bounds of our contractual scope of work, and also:

• Data shall be kept encrypted on Eigen Servers, Secured Cloud or on Client owned and hosted servers only, and not on any removable media.

Data shall be obtained with the purpose of completing our contractual obligation to the customer and shall not be further processed in any manner incompatible with that purpose unless written permission is granted by the customer.

YOUR RIGHTS

You have the following rights in relation to your Data:

a. Right to access – the right to request (i) copies of the information we hold about you at any time, or (ii) that we modify, update or delete such information. If we provide you with access to the information we hold about you, we will not charge you for this, unless your request is “manifestly unfounded or excessive.” Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you the reasons why.

b. Right to correct – the right to have your Data rectified if it is inaccurate or incomplete.

c. Right to erase – the right to request that we delete or remove your Data from our systems.

d. Right to restrict our use of your Data – the right to “block” us from using your Data or limit the way in which we can use it.

e. Right to data portability – the right to request that we move, copy or transfer your Data.

f. Right to object – the right to object to our use of your Data including where we use it for our legitimate interests.

To make enquiries, exercise any of your rights set out above, or withdraw your consent to the processing of your Data (where consent is our legal basis for processing your Data), please contact us via this e-mail address: dataprivacy@eigen.co

If you are not satisfied with the way a complaint you make in relation to your Data is handled by us, you may be able to refer your complaint to the relevant data protection authority. For the UK, this is the Information Commissioner’s Office (ICO). The ICO’s contact details can be found on their website at https://ico.org.uk/.

It is important that the Data we hold about you is accurate and current. Please keep us informed if your Data changes during the period for which we hold it.

AI AND LARGE LANGUAGE MODELS (LLMS)

Eigen uses Artificial Intelligence (AI) and Large Language Models (LLMs) in a controlled and responsible manner, in accordance with applicable data protection laws and regulations. Sensitive client data, including personal data or data classified as confidential, will not be input into publicly available AI or LLM platforms, unless appropriate safeguards, contractual protections, and a valid legal basis is in place.

AI systems are used only for defined and legitimate business purposes and are not used to train third-party or public AI models using customer data unless explicitly agreed.

Where AI is used in processing activities, Eigen ensures:

• Appropriate human oversight is maintained.
• Processing does not result in solely automated decision-making with legal or similarly significant effects unless legally permitted.
• Access to AI tools is controlled and monitored.
• Data inputs are minimised and reviewed where appropriate.

Where AI processing is likely to result in a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be conducted prior to deployment.
All AI usage is subject to appropriate technical and organisational measures to ensure the confidentiality, integrity, and security of personal data.

DATA RETENTION

Unless a longer retention period is required or permitted by law, we will only hold your Data on our systems for the period necessary to fulfil the purposes outlined in this Privacy Policy or until you request that the Data be deleted.

Even if we delete your Data, it may persist on backup or archival media for legal, tax or regulatory purposes.

COMPLIANCE TRAINING & AWARENESS

We conduct regular training sessions for all employees to keep them updated on the latest data privacy regulations, policies, and best practices.

CHANGES TO THIS PRIVACY POLICY

Eigen reserves the right to change this Privacy Policy as we may deem necessary from time to time or as may be required by law. Any material changes will be communicated to you via email. New privacy policy versions will be posted on Eigen’s Website, and you are deemed to have accepted the terms of the Privacy Policy on your first use of our services.

For all data-privacy related enquiries, please contact: dataprivacy@eigen.co

Name: Tim Daffin, Director, Date: 7th May 2026