Privacy Policy

Scope & interpretation

Who we are and when this policy applies.

This Privacy Policy, together with our Terms of Use, Cookie Policy and any other agreement between you and us, explains how TOPP Tactical Intelligence Limited ("TOPP TI", "we", "us" or "our") handles personal information.

TOPP Tactical Intelligence Limited is a company registered in England and Wales, company number 10250761, with registered office at 27 Old Gloucester Street, London WC1N 3AX, United Kingdom.

"You" and "your" refer to the individual using our website, communicating with us or using our products and services. "Website" means this website and other websites operated by or on behalf of TOPP TI. "Presto PDCA" means our software products, related services, training environments and associated customer services.

Controller and processor roles

When we determine why and how personal information is used - for example for our website, enquiries, commercial relationships, marketing, account administration or our own business operations - TOPP TI generally acts as the data controller. Where a customer uses Presto PDCA to process personal information under that customer's instructions, the customer may be the controller and TOPP TI may act as a processor or service provider under the applicable contract and data-processing terms.

This policy is intended to reflect applicable UK data-protection law, including the UK GDPR, the Data Protection Act 2018 and relevant amendments introduced by the Data (Use and Access) Act 2025, together with applicable rules on electronic communications and storage/access technologies.

1

Data-protection principles

We aim to handle personal information in accordance with the core data-protection principles. Personal information should be:

processed lawfully, fairly and transparently;
collected for specified, explicit and legitimate purposes;
adequate, relevant and limited to what is necessary;
accurate and, where necessary, kept up to date;
kept for no longer than is necessary for the relevant purpose;
protected through appropriate technical and organisational measures; and
handled in a way that demonstrates accountability for compliance.

2

The information we collect

We may collect personal information and technical or usage information when you visit our websites, contact us, attend webinars or training, request information, request a demonstration, create or use an account, or use our products and services.

Category	Examples	Typical context
Identity & contact	Name, business email, telephone number, address or other contact details.	Contact forms, accounts, demonstrations, training, support and commercial relationships.
Professional & organisation	Company name, job title, role, team, department, location and other business information.	Account setup, implementation, permissions, training and customer administration.
Account & service data	User identifiers, account settings, access permissions, support history and service usage.	Operating and supporting Presto PDCA.
Usage & technical	IP address, browser, device, operating system, cookie identifiers, pages viewed and interaction data.	Security, diagnostics, analytics and service improvement.
Communications	Messages, support enquiries, survey responses, feedback and correspondence.	Customer care, Voice of the Customer, support and relationship management.
Commercial information	Company billing details, subscription information, tax or invoicing details where applicable.	Contract administration and payment reconciliation.

Payment-card or payment-account information is generally handled by our payment or merchant-of-record providers, such as PayPal, Paddle or another payment service, rather than stored by us as full payment credentials.

Special-category information

We do not intentionally request special-category personal information through our ordinary website contact forms. Customers and authorised users should avoid entering sensitive personal information into Presto PDCA unless it is necessary, permitted by their organisation and handled in accordance with applicable law and contractual requirements.

3

How we collect information

We may collect personal information:

directly from you when you contact us, complete a form, request a demo, attend training, communicate with support or create an account;
from your employer or organisation where they create or administer your Presto PDCA access;
from authorised users who assign work, permissions, RACI roles, KPI responsibilities or other platform responsibilities to you;
automatically through website, device, security, diagnostic, analytics or cookie technologies;
from business partners, implementation partners, public business sources or professional contacts where lawful and relevant; and
from third-party service providers that support our commercial, payment, technical or customer-service operations.

4

How we use personal information

We may use personal information to:

create, administer and secure accounts;
provide, operate, support and maintain Presto PDCA products and services;
deliver demonstrations, implementation support, training and customer-success services;
respond to messages, service requests, support tickets and other communications;
manage contracts, subscriptions, billing and business relationships;
personalise, configure, improve and develop our products and services;
analyse usage, diagnose technical issues and improve performance and usability;
protect users, customers, our platform and our organisation from fraud, misuse, security threats and other harmful activity;
comply with legal, regulatory, tax, accounting and contractual obligations;
send service communications, product information or marketing where permitted; and
use information for another compatible or specifically disclosed purpose where permitted by law.

5

Lawful bases for processing

We only use personal information where we have an appropriate lawful basis. Depending on the circumstances, this may include:

Contract: where processing is necessary to enter into or perform a contract with you.
Legitimate interests: where processing is necessary for our legitimate business interests or those of another party, and those interests are not overridden by your rights and interests.
Recognised legitimate interests: where applicable law specifically recognises a legitimate-interest purpose and the statutory conditions are met.
Consent: where you have given a valid choice and consent is the appropriate legal basis.
Legal obligation: where processing is necessary to comply with a legal or regulatory requirement.
Other lawful bases: where another basis under applicable data-protection law is relevant to the specific processing activity.

Where we rely on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

6

Sharing information and service providers

We do not sell personal information. We may share personal information where necessary and lawful with carefully selected recipients, including:

hosting, infrastructure, security, analytics, communications, support and software service providers;
payment processors, merchant-of-record providers and billing service providers;
implementation partners, professional advisers, auditors, insurers or consultants where appropriate;
your employer, customer organisation or authorised administrators where the information relates to their account or service;
regulators, courts, law-enforcement bodies or public authorities where required or permitted by law;
parties involved in a corporate transaction, restructuring, financing, merger, acquisition or sale, subject to appropriate confidentiality safeguards; and
other recipients where you instruct us, consent or where another lawful basis permits the disclosure.

Service providers that process personal information for us are expected to use it only for authorised purposes and to apply appropriate confidentiality, security and data-protection safeguards.

7

International transfers

We operate with suppliers, technical infrastructure, partners and customers across multiple geographies. This means personal information may sometimes be accessed, processed or stored outside the United Kingdom.

Where an international transfer is subject to UK data-transfer restrictions, we take steps designed to ensure that an appropriate transfer mechanism or safeguard is in place. Depending on the destination and circumstances, this may include an adequacy regulation or another legally recognised safeguard and any required transfer-risk assessment.

You may contact us if you would like further information about the safeguards relevant to a particular transfer of your personal information.

8

How long we keep personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide services, maintain appropriate business records, resolve disputes, enforce agreements and meet legal, tax, accounting, security and regulatory obligations.

Retention periods may differ depending on the type of information, contractual requirements, customer instructions, the sensitivity of the data, the risk of harm from unauthorised use or disclosure and applicable legal requirements.

Where TOPP TI acts as a processor for a customer, retention and deletion of customer personal information may also be governed by that customer's instructions and the applicable contract or data-processing agreement.

9

Data security and personal-data breaches

We use technical and organisational measures designed to protect personal information from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, authentication, confidentiality obligations, protected databases, network controls, monitoring, backups and supplier-security requirements appropriate to the relevant service and risk.

Access to personal information is limited to people who need it for authorised business purposes and who are subject to appropriate confidentiality obligations.

Incident response

If we become aware of a personal-data breach, we will assess the circumstances and take appropriate action. Where the law requires notification to the Information Commissioner's Office, we will report the breach without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the law requires us to notify affected individuals, we will do so in accordance with the applicable requirements.

10

Marketing communications

Where permitted by law, we may send information about Presto PDCA, product updates, events, training, webinars, operational-excellence content or related services that we believe may be relevant to you.

We will use the lawful basis and electronic-marketing rules applicable to the particular communication. Where consent is required, we will ask for it. Where another permitted basis applies, we will still provide a clear way to opt out.

You can unsubscribe from marketing communications at any time using the unsubscribe option in the communication or by contacting info@toppti.com. Service, security, contractual or account-related communications may still be sent where they are necessary and are not marketing.

11

Cookies, analytics and storage/access technologies

Our websites may use cookies and similar storage or access technologies for purposes such as security, essential site operation, preferences, analytics and improving the website experience.

Some technologies may be used without consent where an applicable legal exception applies. Where consent is required, we will seek it before using the relevant non-essential technology. You can also control many cookies through your browser settings, although disabling essential technologies may affect website functionality.

More detailed information about the technologies we use, their purposes and your choices should be read together with our Cookie Policy and any cookie-preference controls made available on the website.

12

Your data-protection rights

Depending on the circumstances and applicable law, your rights may include:

the right to request access to personal information we hold about you;
the right to ask us to correct inaccurate information and complete incomplete information;
the right to ask us to erase personal information in certain circumstances;
the right to ask us to restrict processing in certain circumstances;
the right to object to certain processing, including certain direct marketing;
the right to data portability where the legal conditions apply;
rights relating to certain automated decisions where applicable;
the right to withdraw consent where processing is based on consent; and
the right to complain about how personal information has been handled.

These rights are subject to legal conditions, limitations and exemptions. We may need to verify your identity before acting on a request. Where another organisation is the controller of personal information held within Presto PDCA, we may direct your request to that organisation or assist them in responding.

How to make a privacy-rights request

Email info@toppti.com with enough information for us to identify you and understand your request. Please do not send unnecessary sensitive information when making the initial request.

13

Data-protection complaints

If you are concerned about how we have used your personal information, we encourage you to contact us first so that we can investigate and, where appropriate, resolve the issue.

Submit a data-protection complaint

Email info@toppti.com and use the subject line "Data Protection Complaint". We will acknowledge a complaint within 30 days and respond without undue delay, taking into account the circumstances and any information we need to investigate it.

You also have the right to raise a concern with the UK's data-protection regulator, the Information Commissioner's Office (ICO), or another competent supervisory authority where applicable. We would appreciate the opportunity to address your concern directly first, but this does not affect your right to contact a regulator.

14

Children's personal information

Our business websites and Presto PDCA services are primarily designed for organisations and business users, not for children. We do not intentionally use our general contact channels to collect personal information from children.

If an online service or feature is made available in circumstances where it is likely to be used by children, we will consider the additional requirements and protections applicable to children's personal information.

15

AI-enabled and automated features

Presto PDCA may include optional AI-assisted or automated functionality designed to help users structure, summarise, classify or work with business information. Where a feature processes personal information, that processing remains subject to this Privacy Policy, applicable customer agreements and any additional feature-specific information we provide.

Customers and users remain responsible for ensuring that information submitted to optional AI-enabled features is appropriate for the intended business purpose and permitted by their organisation. We may provide additional notices where a feature involves materially different processing, third-party providers or specific user choices.

16

Third-party websites, services and links

Our websites and services may contain links to third-party websites, plug-ins, integrations or applications. Those third parties may operate independently from us and may collect personal information under their own privacy notices.

Once you leave a website controlled by us, or choose to use an independent third-party service, we encourage you to review that provider's privacy information. We are not responsible for the privacy practices of independent third parties.

17

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, suppliers or business practices.

The "Last updated" date at the top of this page shows when this version was revised. Where a change is material and it is appropriate to do so, we may also provide an additional notice through our website, service or direct communication.

We encourage you to review this page periodically, particularly when you start using a new product, service or feature.

18

Contact us about privacy

It is important that personal information we hold is accurate and current. Please let us know if relevant information changes during your relationship with us.

TOPP Tactical Intelligence Limited

27 Old Gloucester Street
London WC1N 3AX
United Kingdom

Company number: 10250761
Privacy contact: info@toppti.com

You can use this address to ask questions about this Privacy Policy, exercise applicable legal rights, update information, raise a data-protection complaint or request further information about how your personal information is handled.