Data processing

This Addendum applies whenever we process personal data on your behalf — in practice, whenever your attendees use your concierge. It forms part of the Terms of Service. You do not need to sign it or ask for it; it applies automatically from the moment you start using the service.

You are the controller. We are the processor. Where this Addendum and the Terms of Service disagree about personal data, this Addendum wins.

If your procurement process needs a signed copy on paper, write to contact@pulsierlabs.com and we will sign this text. What we will not do is sign a different one quietly — the version here is the one the product actually implements, and a signed document that describes different behaviour would be worth less than this page.

AskConcierge is operated under the trading name Pulsier Labs, established in Portugal. You can reach a person at contact@pulsierlabs.com.

Pulsier Labs is currently operated by an individual and is not a registered company. Two things a contract normally names are therefore not yet stated: the legal name for service (not yet stated) and the postal address (not yet stated). We would rather say this plainly than let a document imply a corporate form that does not exist. If you need a counterparty that is a registered entity before you can sign, write to us and say so — it is a reasonable thing to need, and it is the one thing standing between these documents and a signature.

We have not appointed a Data Protection Officer. On our reading we are not required to: we do not carry out large-scale systematic monitoring of people, and processing special categories of data is not a core activity of ours. That reading is ours, made without legal advice, and it is on the list of things we have asked a lawyer to check.

This document exists in English only, and the English text is the one that governs. Our website, and the notice an attendee reads before asking a question, are available in English, Portuguese and Spanish. We would rather hand you one text we have read carefully than three that can drift apart, because a mistranslated clause in a document like this is not a wording problem — it is two different promises.

We process personal data only on your documented instructions, which are: these documents, the settings you choose in the product, and anything else you tell us in writing. That includes transfers to another country.

If we think an instruction of yours breaks data protection law, we will tell you and we may decline to carry it out.

If we are required by law to process personal data for some other reason, we will tell you first unless the law forbids us from telling you.

Anyone who can reach your data is bound to confidentiality and only gets access where they need it. Support access to a customer workspace is capped below owner — support can administer a workspace, never transfer or delete it — and every change made through it is recorded against a person, a time and a reason. You can ask us for that record for your own workspace.

These are the measures in place today, not a list of intentions. Where a measure is absent, it is absent from this list.

We hold no security certification — no ISO 27001, no SOC 2. If your process requires one, we do not meet it today, and we would rather you knew that at the start of a procurement than at the end of one.

You give general authorisation for us to use the sub-processors listed below. We remain responsible for what they do, and each is engaged under terms that impose obligations equivalent to these.

That list is generated from the register the product itself uses, so it cannot lag behind the code. We will give organizers notice before adding or replacing a sub-processor that can see attendee content, and you may object on reasonable data-protection grounds; if we cannot resolve it, you may terminate the affected concierge and we will refund the unused part of what you have paid.

Which language model answers a question is configuration rather than documentation — it can be changed by us without a code release. The register resolves what is actually in use, which is why it is a register in the product and not a paragraph in a document.

Hosting, the database and email are in the EU. The model router, the web search provider and the crawler are in the United States, and personal data reaching them does so under the European Commission’s Standard Contractual Clauses contained in those providers’ terms.

We have not carried out a documented transfer impact assessment for each provider. We are telling you that rather than leaving you to assume it exists.

• Data subject requests — if an attendee comes to us, we will point them at you and help you answer. We will not respond on your behalf unless you ask us to.
• Impact assessments and prior consultation — we will give you the information about the service that you reasonably need.
• Breaches — we will tell you without undue delay after becoming aware of a personal data breach affecting your data, with what we know and what we are doing.
• Audits — we will answer your questions and provide what we have. We are a very small team, and an on-site audit is something we will accommodate where it is reasonable and at your cost.

On termination we delete your personal data. You can trigger it yourself by archiving the concierge, and the same job does the work either way.

The liability limits in the Terms of Service apply to this Addendum. Nothing here limits a data subject’s rights against either of us under data protection law.

For anything in this policy — a question, a request about your own data, or a complaint — write to contact@pulsierlabs.com and put “Privacy” in the subject line. A person reads it. We aim to answer substantively within 30 days, and to tell you inside 5 working days that we have it.

If you are not satisfied with how we have handled something, you can complain to a data protection authority. Ours is the Comissão Nacional de Proteção de Dados (CNPD) (https://www.cnpd.pt). You can also complain to the authority where you live or work.