Privacy Notice

This Privacy Notice explains how Digital Staff Solutions Ltd(“we”, “us”, “our”) collects and uses personal data when you visit www.purchasly.app or use the Purchasly platform. We are registered in England and Wales under company number 10434349, with our registered office at 25 Luke Street, London, EC2A 4DS. We are the data controller for personal data about visitors to our website and about people who use Purchasly to manage purchasing for their care organisation.

For data your organisation enters into Purchasly about its staff, suppliers, residents or invoices, your organisation is the data controller and we act as a data processor on its behalf.

• Account data: name, work email, role, organisation, home or region you belong to, hashed password.
• Purchasing data: purchase requests, suppliers, cost types, budgets, approvals, contracts, invoices and any documents you upload.
• Communications: messages you send us, demo request forms and support tickets.
• Technical data: IP address, device and browser type, pages viewed and basic usage metrics needed to run the service securely.
• Cookies: a small number of strictly necessary cookies needed to keep you signed in and to keep the platform secure.

• Provide the service (contract): create your account, route approvals, store POs, contracts and invoices, send order and approval emails.
• Keep the service secure (legitimate interests): authentication, anti-abuse, logging and incident response.
• Customer support and admin (legitimate interests / contract): respond to questions, billing and account management.
• Service updates (legitimate interests): occasional product announcements to existing customers, with an easy unsubscribe.
• Legal compliance (legal obligation): tax, accounting and other statutory record keeping.

We do not sell personal data and we do not use it to train third-party AI models.

We share personal data only with trusted suppliers who help us run the service, including:

• cloud hosting and database providers;
• transactional email providers used for approvals and PO emails;
• AI providers used to extract data from invoices and contracts you upload;
• analytics and error monitoring tools used to keep the platform healthy;
• professional advisers (accountants, lawyers) where necessary.

We may also disclose personal data where required by law, to protect our rights, or in connection with a sale or restructuring of our business.

Some of our suppliers process data outside the UK. Where they do, we rely on adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses so that your data has an equivalent level of protection.

Account and purchasing records are kept for as long as your organisation uses Purchasly, plus a reasonable period after the contract ends so we can meet legal, accounting and audit obligations (typically up to 7 years for financial records). Demo request data is kept for up to 24 months. Marketing contact data is kept until you unsubscribe.

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted in certain circumstances;
• restrict or object to certain processing;
• data portability where the processing is automated and based on consent or contract;
• withdraw consent where we rely on it.

To exercise any of these rights, email dan@florence.co.uk. If your data was entered into Purchasly by a care provider, please contact that provider directly in the first instance and we will support them in handling the request.

We use encryption in transit, encrypted storage, role-based access controls, audit logging and least-privilege access for our staff. We regularly review our security practices and require the same of our key suppliers.

We use only strictly necessary cookies to keep you signed in and to protect the service against abuse. We do not use advertising cookies or cross-site tracking cookies.

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Digital Staff Solutions Ltd, 25 Luke Street, London, EC2A 4DS. Email dan@florence.co.uk.