This Privacy Policy explains how Londonist Yazılım ve Teknolojileri A.Ş. (Londonist Software and Technologies Inc., "PulseDesk", "we", "us") handles personal data in connection with the PulseDesk website (mypulsedesk.com), the PulseDesk service (app.mypulsedesk.com and the desktop applications) and our communication with customers and prospects.
1. Our role: controller or processor
- Employees and other users of a customer's organisation. When a company uses PulseDesk to record the working time and activity of its employees, that company is the controller of the personal data and PulseDesk acts as its processor. We process that data only on the company's instructions, under our Data Processing Agreement. If you use PulseDesk at work, your employer's privacy notice describes how your data is used, and you should contact your employer to exercise your rights. We will help your employer to respond.
- Everyone else. PulseDesk is the controller for the personal data described in this policy that we process for our own purposes: website visitors, people who request a demo or contact us, and the business contacts, administrators and billing contacts of our customers.
2. What we collect and why
| Purpose | Personal data | Legal basis (GDPR / UK GDPR / KVKK) |
|---|---|---|
| Creating and managing customer accounts | Name, work email, password (stored as a one-way hash), company name, role, language and time zone | Performance of a contract; KVKK art. 5(2)(c) |
| Providing the service to a customer | The data described in our DPA, processed on the customer's behalf as processor | The customer's lawful basis |
| Billing and accounting | Billing contact, company details, tax number, invoices, payment status (card details are handled by our payment provider) | Contract; legal obligation; KVKK art. 5(2)(ç) |
| Demo requests and enquiries | Name, work email, company, team size, country, phone (optional), your message and language | Steps taken at your request before a contract; legitimate interest in answering you; KVKK art. 5(2)(c), (f) |
| Customer support | Your messages and the account details needed to help you | Contract; legitimate interest |
| Security and abuse prevention | IP addresses, technical logs, sign-in events, desktop-app tamper events | Legitimate interest in keeping the service and data secure; legal obligation |
| Service emails | Email address and the content of the notification (invitations, password resets, reports you have switched on) | Contract; legitimate interest |
| Improving the service | Aggregated, non-identifying usage statistics | Legitimate interest |
| Website analytics | With your consent: random visitor and visit IDs, pages visited, referring website and campaign (utm_*), clicks and scroll depth, time on page, device type, browser, operating system, language and approximate country (worked out from your IP address, which is not stored). Without consent: an anonymous page-view count | Consent (GDPR / UK GDPR art. 6(1)(a) and the ePrivacy / PECR rules on device storage; KVKK art. 5(1) explicit consent); for the anonymous count, legitimate interest |
| Knowing where new customers come from | The source of your website visit (first and most recent referring site or campaign), saved with your company account when you sign up | Consent given on our website; legitimate interest for campaign parameters in the sign-up link; KVKK art. 5(2)(f) |
| Legal claims | Data relevant to a dispute | Legitimate interest; legal obligation |
We do not use the personal data of our customers' employees for marketing, advertising or profiling of our own, and we do not sell personal data.
3. Data our service collects for customers
For transparency, the desktop application and dashboard may collect, on behalf of the employer and according to its settings: working times, active application names and window titles, website addresses, idle and private time, offline time entries, projects and tasks, rota and leave information, chat messages and files, meeting participation and - only where enabled - periodic screenshots, approximate location and meeting recordings with transcripts. The employer decides which of these are used and who can see them. Employees can see their own data in the dashboard.
4. AI features
When a user asks Lucy (our in-app assistant) a question, or when a meeting is recorded and summarised, the relevant text or audio is sent to our AI provider to produce the answer, transcript or summary. Only data the requesting user is allowed to see is used. Our provider processes this data under its business terms, does not use it to train its models and is listed on our Sub-processors page. We store a usage record (who, when, how much) but not the content of Lucy conversations; conversation history is kept in the user's own browser.
5. How long we keep data
- Customer account data: for as long as the organisation exists, then deleted as described in our Terms (within 30 days from live systems and 90 days from backups after the export period).
- Data processed for customers: according to the customer's settings and instructions - for example, the screenshot retention period chosen by the organisation owner.
- Demo requests and enquiries: up to 24 months after our last contact, unless they lead to a contract.
- Billing and accounting records: for the periods required by tax and commercial law (generally up to 10 years).
- Security logs: generally up to 12 months.
- Website analytics: detailed data up to 13 months, then only aggregated totals without identifiers.
6. Who we share data with
- Service providers (sub-processors) that host the service, process payments or provide AI features - see the Sub-processors page. They may only use the data to provide their service to us.
- Your organisation: if you use PulseDesk at work, your employer and the people it authorises can see data about you within the permissions it sets.
- Authorities and advisers where required by law, to protect our rights or with our professional advisers under confidentiality.
- A successor business if PulseDesk is merged, acquired or sold, subject to this policy.
7. International transfers
PulseDesk is provided by a company established in Türkiye and the service is hosted in the United Kingdom. Some providers, such as our AI provider, are located in the United States. Where personal data is transferred to a country without an adequacy decision, we use appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and, for transfers from Türkiye, the standard contracts and procedures required by KVKK article 9, together with supplementary measures where needed.
8. Security
We protect personal data with technical and organisational measures, including encrypted connections (HTTPS/TLS), hashed passwords, role-based access checked on the server, strict separation of each customer's data, short-lived signed links for screenshots and other sensitive files, backups and limited, need-to-know staff access. More detail is on our Security page.
9. Your rights
Depending on the law that applies to you, you have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have data deleted, or its use restricted;
- object to processing based on legitimate interests, and to direct marketing at any time;
- receive data you gave us in a portable format;
- withdraw consent where we rely on consent;
- under KVKK article 11, learn whether your data is processed, request information, learn the purpose, know the third parties to whom it is transferred, request correction or deletion and claim compensation for unlawful processing;
- under India's DPDP Act, access a summary of your data, correction and erasure, grievance redressal and nominating another person to exercise your rights;
- complain to a supervisory authority - for example the Information Commissioner's Office (UK), your EU data protection authority, or the Personal Data Protection Authority (KVKK) in Türkiye.
To exercise your rights, email privacy@mypulsedesk.com. If your request concerns data that your employer controls, we will pass it on to your employer and help them to respond. We may need to verify your identity before responding. We answer within the time required by law - generally within one month, or 30 days under KVKK.
10. Children
PulseDesk is a service for businesses. It is not directed at children and must not be used to monitor anyone under 18.
11. Cookies
Our website uses optional, first-party analytics only if you accept it in the cookie banner, and you can change your choice at any time with "Cookie settings" at the bottom of every page. We do not use cookies for advertising. The details, including the name and duration of everything we store, are in our Cookie Policy.
12. Changes
We may update this policy. We will publish the new version here with its date and, for significant changes, inform customers by email or in the service.
13. Contact
Controller: Londonist Yazılım ve Teknolojileri A.Ş., Merkez Mah. Kültür Cad. No: 4 İç Kapı No: 29, 34245 Gaziosmanpaşa / İstanbul, Türkiye. Email: privacy@mypulsedesk.com