Last updated: 18 June 2026
1. Introduction
This Privacy Policy explains how Pallma AI Limited ("Pallma", "we", "us", "our") collects, uses, and protects personal data relating to visitors to our website at vernolabs.ai (the "Website").
This policy covers only personal data we process in connection with the Website. If you are a customer of Pallma's AI security platform (the "Service"), the processing of personal data in connection with the Service is governed by the Master Services Agreement, Order Form, and Data Processing Agreement signed between Pallma and your organisation, not by this policy.
We are the data controller for personal data we collect through the Website. Our registered office is 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, United Kingdom, WA14 2DT. Our company number is 16834998.
2. Personal data we collect
We collect personal data about Website visitors in the following circumstances:
2.1 Information you give us directly
When you contact us through a form, request a demo, sign up for our newsletter, or otherwise communicate with us, we collect:
- Your name and job title
- Your work email address
- Your company name and, where applicable, company URL
- The content of your message or request, including any information you choose to share about your AI systems or security needs
- Any other information you choose to provide
2.2 Information we collect automatically
When you visit the Website, we may automatically collect:
- Technical data, including IP address, browser type and version, operating system, device type, time zone, and language preferences
- Usage data, including the pages you visit, time spent on the Website, referring URL, and links clicked
- Cookies and similar technologies, as described in section 6
2.3 Information from third parties
We may receive information about you from third parties, including:
- Business contact and enrichment services (for example, Apollo, Clearbit, or Hunter.io) that provide information about you or your organisation in a B2B context
- Publicly available sources such as LinkedIn or your company website
- Mutual contacts who introduce you to us
3. How we use your personal data
We use personal data collected through the Website for the following purposes:
- To respond to your enquiries and requests, including demo bookings, sales conversations, and support questions
- To provide you with information about Pallma's products and services that may be relevant to your role
- To improve and develop the Website and our products
- To analyse Website usage and measure marketing effectiveness
- To comply with legal obligations, enforce our terms, and protect our rights
- To prevent fraud, abuse, and security threats
4. Legal bases for processing
Under the UK GDPR and EU GDPR, we rely on the following legal bases to process your personal data:
Legitimate interests: To respond to your enquiries, market our products to business contacts in a B2B context, improve our Website, and prevent fraud and abuse. We balance these interests against your rights and freedoms.
Consent: Where required by law, for example for certain cookies and direct marketing communications. You may withdraw consent at any time.
Contract: To take steps at your request before entering into a contract, such as responding to a request for a demo or proposal.
Legal obligation: Where we are required to process personal data to comply with applicable law.
5. Who we share your data with
We share personal data with the following categories of recipients:
- Service providers and subprocessors who help us operate the Website and our business, including hosting providers, customer relationship management (CRM) platforms, email service providers, and analytics tools. A current list of subprocessors is available at vernolabs.ai/legal/subprocessors.
- Professional advisers, including lawyers, accountants, and auditors, where reasonably necessary.
- Regulators, courts, and law enforcement, where required by law or to protect our rights.
- Successors in interest, in the event of a merger, acquisition, reorganisation, or sale of substantially all our assets.
We do not sell personal data.
6. Cookies and similar technologies
The Website uses cookies and similar technologies to function correctly and to help us understand how visitors use the Website.
Cookies are small text files placed on your device. We use:
- Strictly necessary cookies, which are required for the Website to function and cannot be switched off.
- Analytics cookies, which help us understand how visitors interact with the Website. These are only set with your consent where required by law.
- Marketing cookies, which we may use to measure the effectiveness of our campaigns. These are only set with your consent where required by law.
You can manage your cookie preferences through the cookie banner shown on your first visit and at any time through your browser settings. Disabling cookies may affect Website functionality.
7. International data transfers
We are based in the United Kingdom, and our customers and data hosting infrastructure are located in the United Kingdom, the European Union, and the United States.
When we transfer personal data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, including:
- Transfers to countries that the UK or EU has determined provide adequate protection for personal data
- Standard Contractual Clauses approved by the UK Information Commissioner's Office or the European Commission, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses
- Other lawful transfer mechanisms permitted by Data Protection Laws
Further information about the specific safeguards we use is available on request from contact@vernolabs.ai.
8. How long we keep your data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements.
- Enquiry and demo request data: retained for up to 24 months after the last contact, unless you become a customer or otherwise remain in active commercial discussions with us, in which case retention is governed by our commercial relationship.
- Website analytics data: retained in line with our analytics provider's standard retention period, typically 14 to 26 months.
- Marketing data: retained until you unsubscribe or until your data is no longer accurate or useful.
Where personal data is no longer needed, we delete or anonymise it.
9. Your rights
Subject to applicable law, you have the following rights in relation to your personal data:
- Access: To request a copy of the personal data we hold about you.
- Rectification: To ask us to correct inaccurate or incomplete data.
- Erasure: To ask us to delete your personal data in certain circumstances.
- Restriction: To ask us to restrict the processing of your personal data in certain circumstances.
- Portability: To receive your personal data in a structured, commonly used, machine-readable format.
- Objection: To object to processing based on our legitimate interests, including direct marketing.
- Withdrawal of consent: Where we rely on consent, to withdraw that consent at any time.
- Complaint: To lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or another competent supervisory authority.
To exercise any of these rights, please contact us at contact@vernolabs.ai. We will respond within one month, or notify you if we need additional time.
10. Security
We maintain appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include access controls, encryption in transit, encryption at rest where supported, secure software development practices, vendor due diligence, and personnel training.
No system is completely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.
11. Children
The Website is not directed to children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this policy indicates when it was most recently revised. Material changes will be communicated through the Website or, where appropriate, by direct notice to you.
13. Contact us
If you have any questions, requests, or concerns about this Privacy Policy or our handling of personal data, please contact us:
Pallma AI Limited 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, United Kingdom, WA14 2DT
Last updated: 18 June 2026
1. Introduction
This Privacy Policy explains how Pallma AI Limited ("Pallma", "we", "us", "our") collects, uses, and protects personal data relating to visitors to our website at vernolabs.ai (the "Website").
This policy covers only personal data we process in connection with the Website. If you are a customer of Pallma's AI security platform (the "Service"), the processing of personal data in connection with the Service is governed by the Master Services Agreement, Order Form, and Data Processing Agreement signed between Pallma and your organisation, not by this policy.
We are the data controller for personal data we collect through the Website. Our registered office is 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, United Kingdom, WA14 2DT. Our company number is 16834998.
2. Personal data we collect
We collect personal data about Website visitors in the following circumstances:
2.1 Information you give us directly
When you contact us through a form, request a demo, sign up for our newsletter, or otherwise communicate with us, we collect:
- Your name and job title
- Your work email address
- Your company name and, where applicable, company URL
- The content of your message or request, including any information you choose to share about your AI systems or security needs
- Any other information you choose to provide
2.2 Information we collect automatically
When you visit the Website, we may automatically collect:
- Technical data, including IP address, browser type and version, operating system, device type, time zone, and language preferences
- Usage data, including the pages you visit, time spent on the Website, referring URL, and links clicked
- Cookies and similar technologies, as described in section 6
2.3 Information from third parties
We may receive information about you from third parties, including:
- Business contact and enrichment services (for example, Apollo, Clearbit, or Hunter.io) that provide information about you or your organisation in a B2B context
- Publicly available sources such as LinkedIn or your company website
- Mutual contacts who introduce you to us
3. How we use your personal data
We use personal data collected through the Website for the following purposes:
- To respond to your enquiries and requests, including demo bookings, sales conversations, and support questions
- To provide you with information about Pallma's products and services that may be relevant to your role
- To improve and develop the Website and our products
- To analyse Website usage and measure marketing effectiveness
- To comply with legal obligations, enforce our terms, and protect our rights
- To prevent fraud, abuse, and security threats
4. Legal bases for processing
Under the UK GDPR and EU GDPR, we rely on the following legal bases to process your personal data:
Legitimate interests: To respond to your enquiries, market our products to business contacts in a B2B context, improve our Website, and prevent fraud and abuse. We balance these interests against your rights and freedoms.
Consent: Where required by law, for example for certain cookies and direct marketing communications. You may withdraw consent at any time.
Contract: To take steps at your request before entering into a contract, such as responding to a request for a demo or proposal.
Legal obligation: Where we are required to process personal data to comply with applicable law.
5. Who we share your data with
We share personal data with the following categories of recipients:
- Service providers and subprocessors who help us operate the Website and our business, including hosting providers, customer relationship management (CRM) platforms, email service providers, and analytics tools. A current list of subprocessors is available at vernolabs.ai/legal/subprocessors.
- Professional advisers, including lawyers, accountants, and auditors, where reasonably necessary.
- Regulators, courts, and law enforcement, where required by law or to protect our rights.
- Successors in interest, in the event of a merger, acquisition, reorganisation, or sale of substantially all our assets.
We do not sell personal data.
6. Cookies and similar technologies
The Website uses cookies and similar technologies to function correctly and to help us understand how visitors use the Website.
Cookies are small text files placed on your device. We use:
- Strictly necessary cookies, which are required for the Website to function and cannot be switched off.
- Analytics cookies, which help us understand how visitors interact with the Website. These are only set with your consent where required by law.
- Marketing cookies, which we may use to measure the effectiveness of our campaigns. These are only set with your consent where required by law.
You can manage your cookie preferences through the cookie banner shown on your first visit and at any time through your browser settings. Disabling cookies may affect Website functionality.
7. International data transfers
We are based in the United Kingdom, and our customers and data hosting infrastructure are located in the United Kingdom, the European Union, and the United States.
When we transfer personal data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, including:
- Transfers to countries that the UK or EU has determined provide adequate protection for personal data
- Standard Contractual Clauses approved by the UK Information Commissioner's Office or the European Commission, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses
- Other lawful transfer mechanisms permitted by Data Protection Laws
Further information about the specific safeguards we use is available on request from contact@vernolabs.ai.
8. How long we keep your data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements.
- Enquiry and demo request data: retained for up to 24 months after the last contact, unless you become a customer or otherwise remain in active commercial discussions with us, in which case retention is governed by our commercial relationship.
- Website analytics data: retained in line with our analytics provider's standard retention period, typically 14 to 26 months.
- Marketing data: retained until you unsubscribe or until your data is no longer accurate or useful.
Where personal data is no longer needed, we delete or anonymise it.
9. Your rights
Subject to applicable law, you have the following rights in relation to your personal data:
- Access: To request a copy of the personal data we hold about you.
- Rectification: To ask us to correct inaccurate or incomplete data.
- Erasure: To ask us to delete your personal data in certain circumstances.
- Restriction: To ask us to restrict the processing of your personal data in certain circumstances.
- Portability: To receive your personal data in a structured, commonly used, machine-readable format.
- Objection: To object to processing based on our legitimate interests, including direct marketing.
- Withdrawal of consent: Where we rely on consent, to withdraw that consent at any time.
- Complaint: To lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or another competent supervisory authority.
To exercise any of these rights, please contact us at contact@vernolabs.ai. We will respond within one month, or notify you if we need additional time.
10. Security
We maintain appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include access controls, encryption in transit, encryption at rest where supported, secure software development practices, vendor due diligence, and personnel training.
No system is completely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.
11. Children
The Website is not directed to children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this policy indicates when it was most recently revised. Material changes will be communicated through the Website or, where appropriate, by direct notice to you.
13. Contact us
If you have any questions, requests, or concerns about this Privacy Policy or our handling of personal data, please contact us:
Pallma AI Limited 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, United Kingdom, WA14 2DT