Privacy Policy
Last updated: 12 October 2026
At Pec, we believe that you should be the person most empowered to make decisions regarding your personal information. In order to do so, you should always know precisely what personal information is collected about you, how it is collected and the purposes for which it is used. This Privacy Policy sets out the manner in which Pelume Technologies Limited (hereinafter referred to as "Pec", "we", "us" or "our") collects, uses, discloses and safeguards personal information in connection with the Pec website at pec.cam, the Pec organiser application at app.pec.cam, every guest page published at pec.cam and all associated services (collectively referred to as the "Platform"). Capitalised expressions which are not defined in this Privacy Policy bear the meanings given to them in our Terms of Service.
1. General information about this Privacy Policy
1.1. Who we are. Pelume Technologies Limited is a company incorporated and registered in England and Wales with company number 17000375, and our registered office is at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are registered with the Information Commissioner's Office under registration number ZC168303.
1.2. Our role. We are the controller of the personal information of Organisers and of the information described in this Privacy Policy that we collect for our own purposes. In respect of the Photos taken at an Event, the Organiser of that Event decides why and how those Photos are taken and used, and is accordingly the controller of them. We process Photos on the Organiser's behalf, as their processor, in order to provide the Platform.
1.3. How to contact us. All queries regarding this Privacy Policy, or the manner in which we handle your personal information, can be directed to hello@pec.cam.
1.4. Who this Privacy Policy applies to. This Privacy Policy, together with our Terms of Service, governs our collection and use of the personal information of every Organiser who creates an account on the Platform, of every Guest who uses a Guest Page, and of every other individual who visits the Platform.
2. What personal information we collect
2.1. We collect a variety of personal information when you use the Platform, which may be categorised as follows:
| Category | What this means |
|---|---|
| "Identity Data" | Your first name or the name of your organisation, whether you use Pec for yourself or for an organisation, and your profile photograph, where you add one |
| "Contact Data" | Your email address |
| "Account Data" | Your password, which is stored only in hashed form, and the times at which you sign in |
| "Profile Data" | The kinds of events that you tell us you host, and how you heard about Pec |
| "Event Data" | The name, date and web address of each Event, its Card, and any logo, icon or image that you upload to it |
| "Photo Data" | The Photos taken or uploaded through each Guest Page, together with the time at which each was taken, which may include the faces and likenesses of the individuals shown |
| "Transaction Data" | Records of the payments that you make, including the Plan, the amount and the identifiers assigned by Stripe to each payment |
| "Device Data" | The IP address, type of browser and device, and the dates and times at which the Platform is accessed, including by Guests |
| "Correspondence Data" | The content of any communication between you and us, including any feedback you give and any call you book with us |
2.2. Guests are not required to create an account, and we do not ask Guests for their name, email address or any other contact details. The camera on a Guest's device is used only while the Guest Page is open and only once the Guest has given permission through their browser. Images from the camera are composed into the Card on the Guest's own device, and only the finished Photo is transmitted to us.
2.3. Your payment card details are collected and retained exclusively by Stripe, and are neither received nor stored by us.
2.4. You are under no obligation to provide personal information to us. There may, however, be instances in which we require your personal information in order to provide the Platform to you or to comply with applicable law. In such circumstances, we may be required to restrict your access to the Platform should you not provide the relevant information, and we shall inform you at the relevant time should this occur.
3. How we use your personal information
3.1. Under applicable data protection law, we are permitted to use your personal information only where certain conditions apply (otherwise known as a "lawful basis"). Accordingly, all use of your personal information by us is justified by one of the following lawful bases:
- (a) where we are required to use your personal information in order to provide the Platform to you or to take a step which you have requested ("Contractual Necessity");
- (b) where we are required to use your personal information for the purposes of our legitimate interests, and your interests and fundamental rights do not override those interests ("Legitimate Interest");
- (c) where we are required to use your personal information in order to comply with our legal or regulatory obligations ("Compliance with Law"); and
- (d) where you have given your consent to the use of your personal information for a specific purpose ("Consent")
3.2. We have set out below the purposes for which we use your personal information, together with the corresponding lawful bases upon which we rely:
| Purpose | Categories of personal information | Lawful basis |
|---|---|---|
| To register your account, sign you in and manage your access to the Platform | Identity Data, Contact Data, Account Data, Device Data | Contractual Necessity |
| To create, save and publish your Events, Cards and Guest Pages | Event Data | Contractual Necessity |
| To receive, store and display Photos to the Organiser of the relevant Event, and to delete them at the end of the relevant Plan | Photo Data | Contractual Necessity, in respect of the Organiser; as processor on the Organiser's behalf, in respect of Guests |
| To process payments and refunds, and to make each Event live once payment is confirmed | Transaction Data, Event Data | Contractual Necessity; Compliance with Law |
| To send you service emails, including sign-in links, confirmations that an Event is live, reminders before an Event and notices before Photos are deleted | Contact Data, Identity Data, Event Data | Contractual Necessity |
| To send you a small number of check-in emails, such as a welcome email and a request for feedback, each of which you may unsubscribe from | Contact Data, Identity Data (first name only), Event Data | Legitimate Interest, namely understanding how Pec is used and improving it |
| To understand which kinds of events and organisations use Pec, and how Organisers hear about us | Profile Data, Identity Data | Legitimate Interest, namely improving and promoting the Platform |
| To keep the Platform secure, to apply Photo limits and rate limits, to prevent abuse, to review reports and to enforce our Terms of Service | Any of the above, as necessary | Legitimate Interest, namely operating a safe and reliable service; Compliance with Law |
| To find and fix errors in the Platform | Device Data, and such other information as is contained in an error report | Legitimate Interest, namely keeping the Platform working |
| To respond to your correspondence, and to establish, exercise or defend legal claims | Correspondence Data and any of the above, as necessary | Legitimate Interest; Compliance with Law |
| To maintain financial and tax records | Transaction Data, Identity Data, Contact Data | Compliance with Law |
3.3. Where we rely upon Legitimate Interest, we have assessed our interests against your rights and freedoms and concluded that they are not overridden. Details of that assessment are available upon request.
3.4. No facial recognition. We do not use Photos to identify any individual, we do not create any biometric template from a Photo, and we do not analyse Photos by automated means other than as necessary to store, resize and display them.
4. Who we share your personal information with
4.1. Organisers and Guests. Each Photo is made available to the Organiser of the Event at which it was taken, and to the Guest who took it. The name, date, Card and any logo of an Event are visible to every person who opens its Guest Page.
4.2. Our service providers. We share personal information with carefully selected service providers who process it on our behalf, in accordance with our instructions, and under written agreements which require them to keep it secure:
| Service provider | Service provided | Location of processing |
|---|---|---|
| Stripe | Payments and refunds | United States, United Kingdom and European Union |
| Supabase | Database, sign-in and storage of Photos | European Union |
| Vercel | Website hosting | United States and other jurisdictions |
| Loops | Delivery of service and check-in emails | United States |
| Sentry | Error monitoring | United States |
| Cal.com | Scheduling of any call that you choose to book with us | United States and European Union |
4.3. Stripe as an independent controller. Stripe acts as an independent controller in respect of certain personal information which it collects in order to process payments. The Stripe Privacy Policy governs that processing.
4.4. Other disclosures. We may additionally disclose your personal information:
- (a) to the police, regulators, tax authorities or courts, where we are required to do so by law;
- (b) where such disclosure is necessary in order to protect the vital interests of any person, or to establish, exercise or defend legal claims; and
- (c) to any purchaser or successor of all or part of our business, who shall be bound by the terms of this Privacy Policy
5. We never sell your personal information
5.1. We do not, and shall never, sell, rent, trade or otherwise commercialise your personal information or any Photo.
5.2. We do not disclose your personal information to advertisers, data brokers or marketing organisations. We do not use your personal information for the purposes of targeted advertising, whether on the Platform or elsewhere, nor do we use it, or any Photo, to train artificial intelligence models.
5.3. Your personal information is disclosed only to the recipients described in section 4, and solely for the purposes described in this Privacy Policy.
6. International transfers
6.1. Our database and the Photos taken through the Platform are stored within the European Union. Certain of our service providers are, however, located outside the United Kingdom and the European Union, principally in the United States, and your personal information may accordingly be transferred to those jurisdictions.
6.2. Where your personal information is transferred outside the United Kingdom or the European Union, we ensure that it is afforded the level of protection required by applicable data protection law, by relying upon an adequacy decision (including the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified under it) or upon standard contractual clauses approved for that purpose. A copy of the relevant safeguards is available upon request.
7. How long we keep your personal information
7.1. We retain your personal information only for so long as is necessary to fulfil the purposes described in this Privacy Policy, including the satisfaction of any legal, accounting or reporting requirements:
| Category | Retention period |
|---|---|
| Identity Data, Contact Data, Account Data and Profile Data | For the duration of your account, and deleted upon its closure |
| Event Data | For the duration of your account, unless deleted by you at an earlier date, and deleted upon its closure |
| Photo Data | From the date of the Event, for 7 days under Pec Free, 30 days under Pec Mini and Pec Lite, 90 days under Pec Pro and one year under Pec Max, or such period as is agreed for Pec Custom. Photos are deleted earlier where the Organiser deletes them, deletes the Event or closes their account |
| Transaction Data | Six years from the end of the financial year in which the transaction took place, notwithstanding the closure of your account. Stripe retains its own records in accordance with its own policies |
| Device Data | Up to 30 days |
| Correspondence Data | For as long as is necessary to respond to you, and in any event no longer than two years after our last contact |
7.2. Upon the closure of your account, we delete your profile, Events, Cards and Photos, and retain only the Transaction Data described above. We may retain personal information for a longer period where we are required to do so by law or where it is necessary in connection with a legal claim. Any Photo which has already been downloaded or shared by a Guest or by an Organiser is outside our control and is not affected.
8. Cookies and local storage
8.1. We do not use cookies for advertising or analytics purposes. We store only the following information on your device, in order to provide the Platform to you:
| Item | Purpose | Duration |
|---|---|---|
| Sign-in session | To keep you signed in to the organiser application | Until you sign out |
| Draft Event | To keep your progress while you design an Event | Until the Event is saved or the draft is cleared |
| Hints you have seen | To avoid showing you the same tips twice | Until cleared |
8.2. Guest Pages store nothing on a Guest's device beyond what their browser requires to display the page. This storage is strictly necessary for the provision of the Platform at your request and is accordingly not subject to consent. Stripe sets its own cookies on its checkout, which are governed by Stripe's own policies.
9. Communications
9.1. We send service emails which are necessary for your use of the Platform, including sign-in links, confirmations that an Event is live, reminders before an Event and notices before Photos are deleted. You may not opt out of service emails while your account remains open. Receipts for payments are sent by Stripe.
9.2. We may also send you a small number of check-in emails, such as a welcome email, a request for feedback and an invitation to book a call with us, each of which contains a means of unsubscribing.
9.3. We do not send any email to Guests.
10. How we keep your personal information secure
10.1. We implement appropriate technical and organisational measures to safeguard your personal information, including encryption in transit, the hashing of passwords, row-level access controls which restrict each Organiser to their own Events and Photos, private storage for Photos, links to Photos which expire after one hour, rate limiting, and the restriction of access to personal information to those members of staff who require it.
10.2. No method of transmission or storage is entirely secure, and we are therefore unable to guarantee the absolute security of your personal information. Should a personal data breach occur which is likely to result in a risk to your rights and freedoms, we shall notify you and the relevant supervisory authority as required by law.
11. Your rights
11.1. Subject to applicable law, you have a number of rights in respect of the personal information which we hold about you, including the right to:
- (a) obtain confirmation of whether we process your personal information, together with a copy of that information;
- (b) have any inaccurate or incomplete personal information rectified;
- (c) have your personal information erased;
- (d) restrict the processing of your personal information;
- (e) object to the processing of your personal information, including for the purposes of direct marketing;
- (f) receive your personal information in a structured, commonly used and machine-readable format, and have it transmitted to another controller; and
- (g) withdraw your consent at any time, where processing is based upon Consent
11.2. You may delete any Event, and close your account, at any time through the Platform. Requests to exercise any of your other rights can be directed to hello@pec.cam. We shall respond within one month of receipt and may require you to verify your identity before doing so. No fee is payable, save where a request is manifestly unfounded or excessive.
11.3. Where you are resident in California, or in any other state of the United States with consumer privacy legislation, you are entitled to equivalent rights under that legislation. We do not sell or share personal information within the meaning of that legislation.
12. Guests and individuals shown in Photos
12.1. Where you have taken a Photo at an Event, or appear in one, the Organiser of that Event is the controller of that Photo, and requests concerning it should in the first instance be directed to the Organiser.
12.2. Should you be unable to contact the Organiser, or should you consider that a Photo has been taken or used unlawfully, your request can be directed to hello@pec.cam, together with the web address of the Guest Page. We shall pass your request to the Organiser and, where appropriate, remove the Photo.
13. Children
13.1. Only individuals aged 18 and over may create an account. Guests of any age may attend an Event, and the Organiser of each Event is responsible for obtaining any consent required from a parent or guardian before a child is photographed or uses the Guest Page. Any concern regarding a Photo of a child can be directed to hello@pec.cam, and we shall act on it promptly.
14. Complaints
14.1. Should you wish to make a complaint regarding this Privacy Policy or our practices in relation to your personal information, your complaint can be directed to hello@pec.cam, and we shall respond as promptly as possible.
14.2. Should you consider that your complaint has not been adequately resolved, you are entitled to lodge a complaint with the Information Commissioner's Office (ico.org.uk, 0303 123 1113) or with the supervisory authority of the country in which you reside or work.
15. Changes to this Privacy Policy
15.1. We may from time to time make changes to this Privacy Policy. Where we consider that a change is material, we shall notify you by email or through the Platform before that change takes effect. The date of the most recent change is shown at the top of this Privacy Policy.