PRIVACY NOTICE
Tupi software: TupiEx, TupiNow and TupiManage
Last updated: 20 September 2026, Version 1.1
1. WHO WE ARE
This Privacy Notice is issued by Tupi Solutions Limited (company number 17220183), registered office 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ (“Tupi”, “we”, “us”, “our”). We provide the TupiEx mobile application and the TupiNow and TupiManage web applications (together, the “Software”).
We are registered with the Information Commissioner’s Office (ICO) under registration number ZC203508.
You can contact us about privacy at: info@tupi.solutions or by post at the address above, marked for the attention of the Data Protection Contact (info@tupi.solutions).
2. WHEN WE ARE A CONTROLLER AND WHEN WE ARE A PROCESSOR
The Software is used by language interpreting/translation agencies (each an “Agency”), by interpreters engaged by those agencies, and by the agencies’ clients. Our role under data protection law depends on the context:
(a) Where we act as a CONTROLLER. We decide how and why personal data is processed when we:
- operate your individual TupiEx account and the free Core Functionality of TupiEx that you use for your own purposes;
- manage account registration, authentication and security;
- communicate with you about the Software, support and service messages;
- invoice Agencies for their licence to use the Software, and keep the accounting records that follow from that (the personal data involved is limited to the Agency’s own billing contact); and
- maintain the security, performance and improvement of the Software.
This Privacy Notice explains how we handle personal data when we are the controller.
(b) Where we act as a PROCESSOR. When personal data is entered into or processed within TupiNow, TupiManage, or features made available under an Agency’s licence (for example interpreter records, documentation, bookings, expenses, rates and client records), the Agency is the controller and we act as a processor on the Agency’s behalf. In that case:
- we process that data only on the Agency’s instructions and under our agreement with the Agency;
- the Agency’s own privacy notice governs that processing; and
- if you want to exercise your data protection rights in relation to that data, you should contact the Agency (we will assist the Agency as required).
If you are unsure which applies, contact us and we will help direct your request.
3. THE PERSONAL DATA WE COLLECT (AS CONTROLLER)
Depending on how you use the Software, we may process:
| Category | Examples |
|---|---|
| Identity and account data | Name, username, account ID, password (stored securely), role/type of user. |
| Contact data | Email address, telephone number, postal address. |
| Profile data | For interpreters: languages, qualifications, professional details you choose to hold in your own account. |
| Documentation | Documents you upload to your account (which may include identity, right-to-work, qualifications, certifications). Some of this may be special category data or relate to criminal records, see clause 4. |
| Usage and device data | App/web usage, log data, device identifiers, IP address, operating system, crash and diagnostic data. |
| Communications | Messages, support requests and your correspondence with us. |
| Billing contact data (Agencies) | Name, work email and telephone number of the Agency’s billing contact, and our invoices and payment records. We do not take card payments. |
We collect this data from you directly, automatically through your use of the Software, and in some cases from the Agency that connects you to the Software.
Data held on an Agency’s behalf. Where an Agency uses the Software (see section 2(b)), it may hold further categories that we process only as processor, including details of the person an interpreting assignment is for (which may include their name, gender, and whether the matter is a criminal one), the address of an assignment and its geographic coordinates, interpreters’ bank details for payment, and feedback recorded about an interpreter’s performance. The Agency is the controller of that data and its own privacy notice governs it.
4. SPECIAL CATEGORY AND CRIMINAL OFFENCE DATA
Some data processed through the Software may reveal special category data or relate to criminal convictions and offences. This can arise in two ways: from documents uploaded to an account (for example identity or background-check documents), and from the details an Agency’s client records when booking an interpreter, which, depending on the Agency’s configuration, may include the name and gender of the person needing an interpreter and whether the matter is a criminal one.
Where we act as controller, we process such data only where we have an appropriate lawful basis and an additional condition under Articles 9/10 UK GDPR and the Data Protection Act 2018. Where the Agency is the controller, which is the case for all booking data, the Agency is responsible for the lawful basis and conditions, including for people who are not users of the Software.
5. WHY WE USE YOUR DATA AND OUR LAWFUL BASES (AS CONTROLLER)
| Purpose | Lawful basis |
|---|---|
| To create and operate your account and provide the Software to you | Performance of a contract (this Agreement / our terms) |
| To authenticate users and keep the Software secure | Legitimate interests (security and fraud prevention) |
| To provide support and respond to your queries | Performance of a contract / legitimate interests |
| To send service and administrative messages | Performance of a contract / legitimate interests |
| To invoice Agencies for their licence and maintain our accounting records | Performance of a contract / legal obligation |
| To improve, develop and analyse the Software (using anonymised/aggregated data where possible) | Legitimate interests |
| To send optional marketing about our products | Consent (you can withdraw at any time) |
| To comply with legal and regulatory obligations | Legal obligation |
Where we rely on legitimate interests, we have assessed that these are not overridden by your rights. You can ask us for more information about that assessment.
6. WHO WE SHARE DATA WITH
We may share personal data with:
- the Agency that engages you, where you use the Software in connection with that Agency;
- our service providers (processors) who help us run the Software and our business. These include Amazon Web Services (hosting, infrastructure, email delivery, and the AI processing described in section 10), Xero (our own accounting records, including Agency billing contacts), Google Workspace (our company email and collaboration, which holds our correspondence with you), Mintly (which validates bank account details), and VoIPstudio (which carries calls taken in the browser and sends SMS verification codes). Where an Agency connects its own accounting package (Intuit QuickBooks, Sage Accounting or FreeAgent), invoice and bill data, and the supporting documents the package accepts, are sent to that package on the Agency’s instruction and under the Agency’s own agreement with that provider. A current list of key sub-processors is available on our sub-processors page, or on request.
- professional advisers, auditors and authorities where required by law or to protect our rights; and
- a buyer or successor if we sell or reorganise our business, subject to appropriate confidentiality.
We do not sell your personal data.
7. INTERNATIONAL TRANSFERS
We host and process personal data in the UK and the EEA. Our primary infrastructure is in the United Kingdom; some email-receiving infrastructure and some AI processing operate in the EEA.
Where personal data is transferred outside the UK, an appropriate safeguard is in place, such as a UK adequacy decision, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards used.
8. HOW LONG WE KEEP YOUR DATA
We keep personal data only as long as necessary for the purposes set out above, including to meet legal, accounting or reporting requirements. As a guide:
- Account data: for the life of your account and then up to 12 months after closure, unless we must keep it longer.
- Billing/transaction records: 6 years to meet tax/accounting obligations.
- Support communications: up to 24 months.
- Usage/log data: up to 12 months.
Where we act as processor, retention of Agency-controlled data is governed by our agreement with the Agency and the Agency’s instructions.
9. YOUR RIGHTS
Under data protection law you have the right to: be informed; access your data; have inaccurate data corrected; have data erased in certain circumstances; restrict processing; data portability; object to processing (including direct marketing); and not be subject to solely automated decisions with legal or similarly significant effects. Where we rely on consent, you can withdraw it at any time.
To exercise your rights in relation to data for which we are the controller, contact us at info@tupi.solutions. Where the Agency is the controller, please contact the Agency.
We will respond within one month (extendable by two further months for complex requests). There is normally no charge.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk; helpline 0303 123 1113). We would, however, appreciate the chance to resolve your concerns first.
10. AUTOMATED PROCESSING AND DECISIONS
The Software uses automated processing, including artificial intelligence, in the following ways:
- classifying replies that interpreters send by email, for example, whether an assignment has been accepted or declined;
- reading uploaded job sheets, receipts and supplier invoices to extract the figures they contain, and flagging where those figures disagree with our records;
- proposing adjustments to session, travel and mileage amounts where an Agency’s rate card provides for special conditions; and
- identifying interpreters for an assignment and, where an Agency has enabled it, offering or allocating that assignment automatically.
Amounts proposed by these means, and the figures read from uploaded documents, do not take effect until an Agency administrator approves them.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Where an Agency configures the Software to act without review, the Agency is the controller of that decision and its own privacy notice applies.
If you believe a decision affecting you was reached by automated means, you may ask for it to be reviewed by a person. Contact us, or the Agency where the Agency is the controller.
11. SECURITY
We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, individual accounts with role separation enforced on every request, network segregation, managed secrets, and staff confidentiality obligations. The measures we commit to agencies are set out in Annex B to our Data Processing Agreement. No system is completely secure; please keep your login credentials confidential and tell us immediately if you suspect unauthorised use.
12. COOKIES
Our web applications use cookies and similar technologies. Please see our separate Cookie Policy for details.
13. CHANGES TO THIS NOTICE
We may update this Privacy Notice from time to time. We will post the updated version and, where the change is material, notify you. The “Last updated” date at the top shows when it was last changed.
If you have any questions about this Privacy Notice, please contact us at info@tupi.solutions.