Duku Privacy Notice
This notice explains how Duku processes personal data for which it is the controller: on the Duku website, on the Duku platform and in its dealings with customers and prospective customers. Where Duku processes Customer Personal Data on a customer’s behalf as a processor, the Duku Data Processing Addendum applies instead. This notice covers the processing that section 2.3 of that Addendum and section 5.2 of the Duku Terms of Use place with Duku as an independent controller.
Who we are
Duku AI is TCWL Group Ltd, trading as Duku AI, a company registered in England and Wales (company number 16526828) with its registered office at 71-75 Shelton Street, London WC2H 9JQ, United Kingdom. You can contact us about anything in this notice at privacy@duku.ai.
What we process and why
| Purpose | Personal data | Lawful basis | Retention |
|---|---|---|---|
| Executing and administering our agreement with your organisation | Business contact details of customer personnel and representatives: name, role, work email and phone; correspondence; billing contacts | Performance of a contract; our legitimate interest in managing customer relationships | Term of the agreement plus six years for contract and accounting records |
| Creating and maintaining user accounts on the Duku platform | Name, work email, organisation, role, authentication identifiers, sign-in and security events | Performance of a contract; our legitimate interest in securing the platform | Life of the account plus 90 days; security logs for 30 days in searchable form, archived thereafter |
| Platform usage analytics and service improvement | Feature usage, session and performance data linked to a user account | Our legitimate interest in understanding and improving the Services | 24 months, then aggregated |
| Improvement Use (see below) | Personal data that may be contained in Customer Data used under the Improvement Use licence | Our legitimate interest in developing and improving the Services, subject to the conditions in the Terms of Use | For the term of the Improvement Use licence; improvements derived from it do not retain personal data |
| Sales, marketing and events | Business contact details, communications and event registrations | Our legitimate interest; consent where required for electronic marketing | Until you opt out, or 24 months after our last contact |
| Website visits | IP address, device and browser data, pages viewed and cookies | Consent for non-essential cookies; our legitimate interest in running a secure website | Up to 14 months for analytics data; see Cookies below |
| Recruitment | The application details you send us | Our legitimate interest; legal obligation | Six months after the process ends, unless you agree to longer |
Improvement Use
Unless an order form excludes it, section 5.2 of the Terms of Use licenses Duku to use Customer Data to develop, test, evaluate and improve the Services, including the models, prompts and detection logic within them. Where that Customer Data contains personal data, Duku acts as an independent controller for that processing. Duku uses it solely for its own internal purposes, does not make it available to third parties other than affiliates, subcontractors and service providers that act on Duku’s behalf and are bound by confidentiality, and does not use it to train, fine-tune or improve any model, system or service operated by a third-party provider. Duku is not currently using Customer Data for Improvement Use; this section describes what will apply if it does, and we will update this notice when it begins.
Who we share personal data with
- Our service providers, which act on our instructions: our sub-processors listed in the Duku Sub-Processor List, PostHog (product analytics for the platform), HubSpot (customer relationship management), Plain (customer support) and our email delivery providers.
- Our professional advisers, insurers and auditors, where necessary.
- Public authorities, where required by law.
- A buyer or successor in a merger, acquisition or reorganisation, under the same protections as this notice.
We do not sell personal data.
International transfers
Duku hosts the platform in the European Union and the United Kingdom: on AWS in Ireland, with a database replica in Google Cloud in London. Where a provider processes personal data outside the UK or the EU, we rely on the EU Standard Contractual Clauses with the UK Addendum (or the UK International Data Transfer Agreement) and, where the provider is certified under it, the EU-US Data Privacy Framework and its UK Extension, as set out in the Sub-Processor List.
Your rights
Depending on where you are, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent where processing relies on it. To exercise a right, email privacy@duku.ai. We respond within one month, extendable where the law allows. You may also complain to your supervisory authority; ours is the UK Information Commissioner’s Office (ico.org.uk). If you are in the EU or EEA you may also complain to the supervisory authority where you live or work.
Cookies
The Duku website uses essential cookies to operate and, with your consent, Google Analytics and HubSpot cookies to understand how it is used and to follow up enquiries. The analytics cookies are Google Analytics (_ga, ga*) and HubSpot (__hstc, hubspotutk, __hssc, __hssrc), set only after consent, and you can change your choice at any time through the cookie banner. The Duku platform uses cookies to keep you signed in and to route your requests, and PostHog analytics (including session replay with typed input masked) to understand how the platform is used. Analytics respects your browser’s Do Not Track setting.
Changes to this notice
Every change is published as a new dated version. The version history shows each version, its effective date and what changed.