Privacy Policy

This Privacy Policy explains how Jones and Palmer Limited ("Jones + Palmer", "J+P", "we", "us", "our") collects and uses personal data when you use the Jones + Palmer platform - our websites and applications hosted at jp.tools, including www.jp.tools and Nexus (nexus.jp.tools), together with any other Jones + Palmer applications we make available at jp.tools (together, the "Platform"). This includes when you sign in with your Google or Microsoft account. It also explains your rights under UK data protection law.

1. Who we are

Jones and Palmer Limited is the data controller for personal data processed through the Platform.

• Company: Jones and Palmer Limited, registered in England and Wales, company number 00239324.
• Registered office: 87 Carver Street, Birmingham, B1 3AL, United Kingdom.
• Website: https://www.jonesandpalmer.co.uk
• Telephone: +44 121 236 9007
• Privacy contact: data@jonesandpalmer.co.uk
• ICO registration number: Z2473618.

2. Who this policy applies to

The Jones + Palmer platform is used by:

• Jones + Palmer staff, who sign in with their Jones + Palmer Google Workspace account; and
• Client users, who are given scoped access to their own organisation's information within our applications, and who sign in with their own Microsoft or Google account.

A single sign-on covers all our jp.tools applications, so one account and one sign-in gives you access to the applications you are authorised to use. This policy covers personal data processed for both groups across the Platform. Where you access the Platform as part of a service relationship between your organisation and Jones + Palmer, this policy supplements, and does not replace, any separate agreement or privacy notice in place between us and your organisation.

3. Information we collect

a. Account and identity data (from single sign-on). When you sign in with Google or Microsoft, we receive your name, email address and, where provided, a profile picture and a unique account identifier. We use this to authenticate you and to create and maintain your account across the Platform. See section 4 for exactly what we request and what we do not access.

b. Information you provide in our applications. Depending on your role and which applications you use, this can include the content of tickets and support requests, project and task details, comments and @mentions, uploaded files and attachments, time entries, and similar operational records you create or that relate to you.

c. Technical and usage data. We collect standard technical information needed to run and secure the Platform, such as IP address, device and browser type, authentication session tokens, and application and security logs (for example, sign-in events and actions taken in an application).

d. Cookies and local storage. We use strictly necessary cookies and browser storage to keep you signed in and to operate the Platform. See section 11.

We do not use the Platform to collect special category data from client users as part of sign-in, and we do not sell personal data.

4. Google and Microsoft account data (single sign-on)

We use Google and Microsoft only to verify your identity ("sign in with Google" / "sign in with Microsoft") across our jp.tools applications. For sign-in we request the minimum standard identity information:

• Google: the openid, email and profile scopes.
• Microsoft: the openid, profile and email scopes, and basic profile read (User.Read).

Through sign-in we receive only your name, email address and basic profile. We do not access, read, or store your Gmail, Google Calendar, Google Drive, Google Contacts, Microsoft Outlook mail, calendar, files, or any other content in your account when you sign in. Signing in gives our applications no ongoing access to your mailbox, calendar or files.

Optional, separate integrations (Jones + Palmer staff only). Members of Jones + Palmer staff may separately and explicitly choose to connect additional Google services (such as Gmail or Calendar) to their personal in-app assistant. That is a distinct, opt-in authorisation, shown to the individual member of staff at the time, and is never part of, or required for, ordinary sign-in. It is not offered to client users. Where our use of information received from Google APIs is involved, that use adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we use your information and our legal bases

We use personal data to:

Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us for more detail using the contact above.

6. AI-assisted features

Our applications include AI features (for example, help with triaging and drafting content, answering questions, and generating summaries). To provide these, relevant content may be processed by trusted third-party AI providers acting as our processors. These providers process the content solely to return a result to us and are not permitted to use it to train their own models. For client-facing AI features we use Google (Vertex AI / Gemini) by default, and we may use other providers - which may include Anthropic (Claude), OpenAI (GPT models) and xAI (Grok) - where they are better suited to a specific task (see section 7). AI output can be imperfect and is intended to assist, not replace, human judgement.

7. Who we share your information with

We do not sell your personal data. We share it only with:

• Service providers (processors) who help us run the Platform, under contract and on our instructions. Our core infrastructure and processing providers include:
  • Google Cloud / Google LLC - hosting, database (Firestore), file storage, identity/authentication, email and chat delivery, and AI services;
  • Microsoft - identity/authentication for client sign-in;
  • Anthropic (Claude), OpenAI (GPT models) and xAI (Grok) - additional AI providers we may use for certain features.
• Your organisation, where you access the Platform on its behalf, and Jones + Palmer staff who administer and deliver the relevant service, subject to role-based access controls.
• Authorities or third parties where required by law, or to establish, exercise or defend legal claims.

Client data is scoped: client users can only see information belonging to their own organisation, and one client organisation cannot see another's data.

8. Where we store your information and international transfers

The Platform's primary data (your account, work items, files and related records) is hosted in Google Cloud data centres in the United Kingdom (London, europe-west2).

Some of our processors, in particular certain AI providers, may process limited data outside the UK or European Economic Area. Where personal data is transferred outside the UK, we rely on appropriate safeguards, such as UK adequacy regulations, the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for more information about these safeguards.

9. How long we keep your information

We keep personal data only as long as necessary for the purposes above, including to operate the Platform, meet our legal and contractual obligations, and maintain security and audit records. Retention periods vary by data type; for example, account and operational records are generally retained for the duration of the relevant service relationship and for a reasonable period afterwards, and security and audit logs are retained for a limited period. When data is no longer needed we delete or anonymise it.

10. Your rights

Under UK data protection law you have the right to: access your personal data; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to certain processing; data portability; and, where processing is based on consent, to withdraw that consent at any time. To exercise any of these rights, contact us using the details in section 1.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at https://ico.org.uk or 0303 123 1113. We would, however, appreciate the chance to address your concerns first.

11. Cookies and local storage

The Platform uses only strictly necessary cookies and browser local storage to authenticate you, keep you signed in, and operate core features. We do not use advertising or third-party tracking cookies. Because these are essential to providing the Platform, they do not require consent under the Privacy and Electronic Communications Regulations, but you can control cookies through your browser settings (disabling them may prevent sign-in).

12. Children

The Platform is a workplace platform and is not intended for, or directed to, children. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, notify you.

14. Contact us

Questions or requests about this policy or your personal data:

• Email: data@jonesandpalmer.co.uk
• Telephone: +44 121 236 9007
• Post: Data Protection, Jones and Palmer Limited, 87 Carver Street, Birmingham, B1 3AL, United Kingdom.