SALIBO PRIVACY POLICY

Last updated: 28 January 2026

This Privacy Policy explains how Salibo Ltd ("Salibo", "we", "us", or "our") collects, uses, shares, and protects personal data when individuals and organisations access or use the Salibo platform, systems, applications, websites, dashboards, interfaces, and related services (together, the "Platform"). This Privacy Policy is drafted to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and is intended to support regulatory, public-sector, and enterprise scrutiny, including in relation to AI-enabled and CCTV-derived data processing.

1. Scope and Application

This Privacy Policy applies to the processing of personal data in connection with:

• a) use of the Salibo Platform;
• b) marketplace-facilitated security engagements;
• c) managed security services, where separately agreed;
• d) SaaS licensing and systems access;
• e) AI-assisted incident reporting, voice-to-text processing, and analytics;
• f) AI-enabled CCTV alerts and derived metadata;
• g) compliance, workforce management, and audit functions.

This Privacy Policy applies to all data subjects whose personal data is processed via the Platform, including clients, security officers, employees, contractors, representatives of customers, and other users.

2. Data Protection Roles: Controller, Joint Controller, and Processor

Salibo’s role under data protection law depends on the specific service being provided and the contractual arrangements in place.

2.1 Salibo as Data Controller

Salibo acts as a data controller where it determines the purposes and means of processing personal data, including in relation to:

• a) Platform account creation and administration;
• b) employment and PAYE-related processing for security personnel engaged directly by Salibo;
• c) compliance, vetting, training, and licensing records;
• d) incident reporting systems operated by Salibo;
• e) internal security, audit, and risk management.

2.2 Salibo as Joint Controller

In certain contexts, Salibo may act as a joint controller with clients or partners, for example, where incident data or operational records are jointly determined for security, compliance, safeguarding, or regulatory purposes. Where applicable, joint-controller arrangements are documented in the relevant service agreements.

2.3 Salibo as Data Processor

Salibo acts as a data processor where it processes personal data on behalf of a client or customer under a SaaS, platform licensing, or AI CCTV analytics arrangement. In such cases, processing is governed by the client’s documented instructions and an applicable Data Processing Agreement (DPA).

3. Categories of Personal Data Processed

Depending on the service, Salibo may process the following categories of personal data:

• a) Identity and account data: name, contact details, user credentials, organisational role;
• b) Employment and compliance data: right-to-work checks, SIA licence details, training records, attendance logs;
• c) Incident report data: written reports, images, video clips, audio recordings, witness statements;
• d) Voice-to-text data: audio recordings and machine-generated transcripts derived from incident reporting tools;
• e) AI CCTV Alert data: metadata, flags, or indicators generated by AI-enabled video analytics systems (derived data, not raw CCTV footage);
• f) Location and attendance data: GPS check-ins, shift attendance, time and location stamps;
• g) Technical data: device identifiers, log files, and usage analytics.

Salibo does not process biometric data for the purpose of uniquely identifying individuals.

4. Purposes of Processing and Lawful Bases

Salibo processes personal data only where there is a lawful basis under UK GDPR. The principal processing activities, purposes, and lawful bases include:

• a) Platform provision and account management: performance of a contract;
• b) Incident reporting, investigation, and safeguarding: legitimate interests in maintaining safety and security and, where applicable, compliance with legal obligations;
• c) Voice-to-text processing: legitimate interests in accurate, timely, and consistent incident documentation;
• d) AI CCTV Alerts and risk indicators: legitimate interests in situational awareness, deterrence, and risk detection;
• e) Employment, payroll, vetting, and workforce compliance: compliance with legal obligations;
• f) Location, attendance, and timekeeping: performance of a contract and legal obligations;
• g) Compliance, audit, and regulatory engagement: legal obligation and legitimate interests;
• h) SaaS services provided to clients: performance of a contract.

Where processing is based on legitimate interests, Salibo has carried out an assessment to ensure that such interests are not overridden by the rights and freedoms of individuals. Where consent is relied upon, it may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

5. AI and Automated Processing Transparency

Salibo uses AI-assisted tools, including voice-to-text systems and AI-enabled CCTV analytics, to support operational awareness, reporting, and compliance functions.

• a) AI tools are used in an assistive capacity only;
• b) no solely automated decision-making producing legal or similarly significant effects is carried out;
• c) meaningful human review and oversight remain integral to all operational, disciplinary, and compliance decisions;
• d) Article 22 UK GDPR (automated decision-making) is not engaged.

Salibo conducts Data Protection Impact Assessments (DPIAs) where required under UK GDPR, particularly in relation to monitoring, CCTV-derived data, location tracking, and AI-assisted processing. AI outputs may be subject to inaccuracies, false positives, or false negatives and must not be relied upon as definitive determinations.

6. CCTV and AI CCTV Alerts

Where AI CCTV Alerts are used:

• a) alerts are generated through algorithmic analysis of visual data from CCTV or similar sources;
• b) alerts constitute derived metadata, rather than raw CCTV footage;
• c) Salibo does not independently monitor CCTV feeds unless expressly agreed in writing;
• d) alerts are informational only and do not constitute confirmation of incidents, safety assurances, or obligations to intervene.

Responsibility for CCTV deployment, signage, transparency notices, and lawful operation remains with the relevant data controller, typically the client or site operator.

7. Data Sharing and Recipients

Personal data may be shared, where necessary and lawful, with:

• a) clients and customers in accordance with service arrangements;
• b) authorised subcontractors, cloud service providers, and technology partners;
• c) regulators, law-enforcement agencies, or public authorities where required by law;
• d) professional advisers, auditors, and insurers.

Salibo does not use personal data collected via the Platform for cross-app or cross-website advertising, behavioural profiling for third-party marketing, or tracking as defined under Apple App Tracking Transparency frameworks. Salibo does not sell personal data and does not share personal data with data brokers.

Where third-party software development kits (SDKs) or cloud services are integrated into the Platform, Salibo ensures that such providers act under appropriate contractual, confidentiality, and data protection obligations, and that relevant data practices are reflected in applicable app store disclosures.

8. International Data Transfers

Personal data is primarily processed within the United Kingdom. Where personal data is transferred outside the UK, Salibo ensures that appropriate safeguards are in place in accordance with UK GDPR, including reliance on UK adequacy regulations or approved standard contractual clauses.

9. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected, including:

• a) Incident and operational records: retained in line with contractual requirements and regulatory guidance, typically for several years;
• b) Employment and PAYE records: retained for statutory retention periods;
• c) Location and attendance data: retained for operational and compliance purposes and then deleted or anonymised;
• d) SaaS customer data: retained for the duration of the contract and securely deleted or returned thereafter.

Retention periods are documented, reviewed periodically, and applied proportionately.

10. Data Subject Rights

Individuals have rights under UK GDPR, including the right to:

• a) access their personal data;
• b) request rectification or erasure;
• c) restrict or object to processing;
• d) data portability, where applicable;
• e) lodge a complaint with the Information Commissioner’s Office (ICO).

Requests may be submitted using the contact details below. Salibo will respond in accordance with statutory time limits. Users may request deletion of their Platform account and associated personal data by contacting Salibo using the details set out below or through the account-management features made available within the Platform.

Account deletion requests will be assessed and fulfilled where applicable, subject to identity verification and Salibo’s statutory, contractual, and regulatory data-retention obligations.

11. Security Measures

Salibo implements appropriate technical and organisational measures to protect personal data, including access controls, encryption, monitoring, governance procedures, and staff training, aligned to recognised information-security standards. Personal data transmitted via the Platform is protected using industry-standard encryption in transit and access-control mechanisms.

12. Changes to this Privacy Policy

Salibo may update this Privacy Policy from time to time. Updated versions will be made available via the Platform.

13. Contact and Complaints

For questions or requests relating to this Privacy Policy or personal-data processing, contact:

Email: [email protected]

Individuals may also lodge complaints with the Information Commissioner’s Office (www.ico.org.uk).