Platform

The Organisation The connected behaviour of your whole organisation Decision Engine The reasoning behind every recommendation

Solutions

Team Composition What the people around your team make possible Selection Decide who could strengthen the team, and why Board & Leadership Your board or leadership team, read against the organisation beneath it
Pricing Customers

Resources

Approach
Org intelligence Thesis Security

Company

About Careers Reads Changelog Documentation Contact
Book a conversation Sign in

Privacy Policy

Protu Technology Limited · Last updated July 2026

Introduction

Protu Technology Limited operates a behavioural intelligence platform designed to help organisations understand team dynamics. Privacy and security have been built into the platform from its inception.

This policy applies to workspace users (owners, admins, hiring managers), invited employees, and job candidates. For privacy questions, contact support@protu.io.

Definitions

  • Platform — the Protu web application and services
  • Workspace — a company's account on the platform
  • Assessment — the behavioural evaluation process
  • Insights — the resulting behavioural profiles generated from assessments

Data Processing Roles

Protu acts as a Controller for account registration, workspace data, billing information, and platform analytics.

Protu acts as a Processor for assessment data, employee and candidate information, and generated behavioural insights.

You remain the Controller for your employees' and candidates' assessment data. You decide how their data is used within your organisation.

Data Collection

Account Data

  • Identity information (name, email)
  • Workspace details (company name, size, industry)
  • Job titles and login history

Assessment Data

  • Responses to assessment questions
  • Completion status and behavioural markers

Companies see insights (the behavioural profile), not individual answers.

Usage Data

  • Pages viewed, browser type, IP address
  • Platform performance metrics

Payment Data

  • Billing contact information and transaction history, processed through Stripe

We never store full credit card details.

Data Usage and Legal Basis

Protu processes data to deliver services (contractual basis), prevent fraud (legitimate interest), improve the platform, meet legal obligations, and send promotional communications (with consent).

We never sell your personal data, and never use it to train external AI models. We may use it to improve Protu’s own models; this is on by default and you can turn it off at any time in workspace settings.

AI and Automated Processing

Insights derive from proprietary models grounded in established behavioural and organisational research. Protu provides insights, not decisions.

The platform complies with GDPR Article 22 — no automated decisions with legal or significant effects. Hiring decisions are made by humans using insights as one input.

Model training never uses individually identifiable data. Improvement of Protu’s own models uses anonymised, aggregated data, and you can opt out through workspace settings.

Sub-Processors

  • DigitalOcean — EU cloud hosting
  • Amazon Web Services (S3) — file storage (EU region)
  • Mailgun — email delivery
  • Sentry — performance monitoring
  • Stripe — payments

All providers maintain Data Processing Addendum (DPA) agreements and appropriate data protection safeguards. We provide 30 days' notice before adding new sub-processors.

Data Security

  • AES-256 encryption for data at rest, TLS 1.3 for data in transit
  • Role-based access controls
  • Magic links expiring after 30 days (candidates) or 72 hours (employees)
  • Sessions expire after 2 hours of inactivity
  • Two-factor authentication available
  • Secure cloud hosting (DigitalOcean EU) with automated daily backups

Support personnel may access accounts for troubleshooting purposes. All access is logged and auditable.

Data Retention

  • Account information — retained while active
  • Session data — 90 days
  • Email logs — 90 days
  • Backup data — up to 180 days
  • After account deletion — retained for recovery for 30 days, then permanently removed from production
  • Billing records — 7 years per UK tax requirements

Your Rights

Individuals in the UK, EU/EEA, or under GDPR jurisdiction hold rights including access, rectification, erasure, data portability, restriction of processing, and objection.

Employees and candidates should contact your employer first, as they are the Controller. If unresolved within 14 days, contact support@protu.io.

Workspace users should contact support@protu.io. Responses occur within 30 days.

Cookies

Essential cookies handle session authentication and security. Analytics cookies track anonymised usage patterns and performance. We use no third-party advertising cookies and perform no cross-site tracking.

Users can opt out of analytics cookies by contacting support@protu.io.

Children's Privacy

Protu is not intended for anyone under 16 years of age. Discovery of underage users results in account termination and data deletion.

Policy Changes

Material changes require email notification at least 30 days before the change. Continuing platform use after changes take effect constitutes agreement to updated terms.

Regional Information

California Residents

CCPA/CPRA rights include knowledge of collected information, deletion rights, and opt-out provisions. We do not sell personal information.

UK Residents

You may lodge complaints with the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

Terms of Service Security