Privacy Notice — PurePrivacy

Verso Privacy Notice

Last updated: 16 June 2026

This Verso Privacy Notice explains how Stafford Projects Limited trading as Pure Privacy collects, uses and protects personal data in connection with the Verso privacy training platform.

It should be read together with our main Pure Privacy Privacy Policy, available at: https://pureprivacy.co/privacy.

This notice provides additional information specific to Verso. This notice is intended for business customer contacts, administrators, super administrators, authorised users of Verso, and individuals who visit or interact with the Verso website, platform or support channels.

1. Who we are

Verso is operated by Stafford Projects Limited trading as Pure Privacy.

Stafford Projects Limited is a company registered in England and Wales.

Company number: 07278841
ICO registration: ZA492954
Contact email: [email protected]
Postal address: 5 Middle Farm Close, Dauntsey, Chippenham, England, SN15 4GY.

In this notice, Pure Privacy, Verso, we, us and our refer to Stafford Projects Limited trading as Pure Privacy.

2. What this notice covers

This notice applies to personal data processed in connection with the Verso platform, including personal data relating to:

(a) business customers who buy or administer access to Verso;
(b) individuals who use Verso as authorised users;
(c) administrators and super administrators who manage user access and training records;
(d) individuals who contact us about Verso;
(e) individuals who use or visit the Verso website or sub-domain; and
(f) individuals whose personal data is processed in connection with platform security, support, billing or service administration.

This notice does not replace the main Pure Privacy Privacy Policy. It supplements it with Verso-specific information.

3. Our role: controller or processor

Our role depends on the processing activity.

3.1 Where we act as processor

For most platform training activities, we act as a processor on behalf of the business customer that has purchased or arranged access to Verso.

This includes where we process personal data to:

(a) create and manage user accounts;
(b) give users access to training modules;
(c) send training reminders configured or requested by the customer;
(d) record training progress and completion;
(e) make training progress information, completion records and dashboard information available to customer administrators, and, where agreed or reasonably provided by us, provide copies, summaries or extracts of training logs or completion records;
(f) manage seat allocation and account access; and
(g) provide platform support and maintenance.

In these cases, the customer is usually the controller and is responsible for explaining to its users how and why their personal data is used. We process the data in accordance with our agreement with the customer, including our Data Processing Agreement.

Users should contact their employer or the organisation that provided access to Verso if they have questions about how their training records are used internally. Users should also refer to any privacy notice or internal information provided by their employer or the organisation that gave them access to Verso, as that organisation is responsible for explaining how it uses training records for its own employment, compliance, governance or audit purposes.

3.2 Where we act as controller

We act as a controller where we decide how and why personal data is processed for our own business purposes. This may include:

(a) managing customer accounts and subscriptions;
(b) billing, payment administration and financial records;
(c) responding to enquiries and support requests;
(d) managing our relationship with business customers;
(e) sending service communications;
(f) maintaining platform security and investigating misuse;
(g) improving, developing and analysing the performance of Verso;
(h) managing legal, regulatory, tax, accounting and audit obligations;
(i) handling complaints or disputes; and
(j) sending business-to-business marketing communications where permitted by law.

Where we use platform, usage or support information to improve, maintain or develop Verso, we will use aggregated, anonymised or minimised information where reasonably practicable.

4. Personal data we collect and use

Depending on how you interact with Verso, we may collect and use the following personal data.

4.1 Account and identity data

This may include:

(a) name;
(b) business email address;
(c) employer or organisation name;
(d) job title;
(e) team, department or business unit, where provided;
(f) user role, such as learner, administrator or super administrator;
(g) account identifiers; and
(h) login and authentication-related information, such as account identifiers, authentication status, login events and related access information. User passwords are processed by our authentication provider and are not stored directly by us.

4.2 Training and usage data

This may include:

(a) modules assigned to you;
(b) modules started, in progress or completed;
(c) completion dates and timestamps;
(d) reminder status and training cadence;
(e) responses, selected options or interactions within modules, where captured by the platform;
(f) engagement and usage information;
(g) training logs and completion records; and
(h) administrator dashboard information.

Verso modules are generally delivered through short, chat-style learning interactions. Where users select responses or options within a module, the platform may record those interactions to support training delivery, progress tracking, completion records, reporting, troubleshooting and service improvement.

4.3 Contact and support data

This may include:

(a) enquiries sent to us;
(b) support requests;
(c) email correspondence;
(d) customer account communications;
(e) feedback; and
(f) records of our responses.

4.4 Billing and subscription data

This may include:

(a) customer organisation name;
(b) billing contact details;
(c) invoice and payment status;
(d) subscription details;
(e) number of seats purchased;
(f) renewal and order information; and
(g) transaction reference information.

Payment card details are usually processed by our payment provider and are not stored directly by us.

4.5 Technical, device and security data

This may include:

(a) IP address;
(b) browser type and version;
(c) device type;
(d) operating system;
(e) time zone setting;
(f) login timestamps, authentication events and session information;
(g) audit logs;
(h) error logs;
(i) security logs;
(j) cookie and similar technology data; and
(k) information about how the platform is accessed and used.

4.6 Marketing and communications data

This may include:

(a) communication preferences;
(b) records of marketing communications sent to business contacts;
(c) newsletter or update preferences; and
(d) opt-out or unsubscribe records.

5. Special category data

Verso is not designed to collect or process special category personal data or criminal offence data.

Users and customers should not enter unnecessary sensitive information into the platform, including health information, criminal offence information, sensitive employee relations information, confidential legal advice or privileged material.

If this type of information is provided to us, we may delete it or restrict processing where appropriate.

6. How we collect personal data

We may collect personal data:

(a) directly from you when you create an account, use the platform, contact us or submit information;
(b) from the customer organisation that purchases or administers Verso access;
(c) from administrators who manage user access and training records;
(d) automatically when you access or use the Verso website or platform;
(e) from our service providers, such as hosting, authentication, support, analytics, email or payment providers; and
(f) from publicly available or business contact sources where relevant to business relationship management.

7. How we use personal data and our lawful bases

Where we act as controller, we use personal data (1) for the purposes (2) and lawful bases (3) set out below.

(1) Account, contact, billing and subscription data (2) To manage business customer accounts and subscriptions (3) Contract and legitimate interests
(1) Contact and support data (2) To respond to enquiries and support requests (3) Contract and legitimate interests
(1) Billing and subscription data (2) To manage billing, invoicing and payment administration (3) Contract, legitimate interests and legal obligation
(1) Account and contact data (2) To send service communications (3) Contract and legitimate interests
(1) Technical, device, security, account and usage data (2) To maintain platform security and investigate misuse (3) Legitimate interests and legal obligation
(1) Usage, technical, support and aggregated, anonymised or minimised analytics data (2) To improve, maintain and develop Verso (3) Legitimate interests
(1) Account, contact, billing, support and transaction data (2) To manage legal, regulatory, tax, accounting and audit obligations (3) Legal obligation and legitimate interests
(1) Relevant account, contact, support, usage and billing data (2) To handle complaints, claims and disputes (3) Legitimate interests and legal obligation
(1) Business contact and marketing data (2) To send B2B marketing or updates about Verso or Pure Privacy service (3) Legitimate interests or consent, depending on the communication
(1) Cookie and technical data (2) To manage cookie consent and website/platform preferences (3) Consent for non-essential cookies; legitimate interests or strictly necessary purposes for essential cookies

Where we act as processor, the customer determines the lawful basis for the processing. This will usually be explained in the customer's own privacy notice.

8. Training records and administrator visibility

Verso enables customer administrators and super administrators to manage training access and view training progress.

This means that your employer or the organisation that gave you access to Verso may be able to see information such as:

(a) whether you have activated your account;
(b) which modules have been assigned to you;
(c) whether you have started or completed modules;
(d) completion dates and timestamps;
(e) training progress and status;
(f) reminder or engagement information; and
(g) dashboard information, reports or summaries generated through or from the platform, where available.

Customer administrators and super administrators may be able to view training progress and completion information through the administrator dashboard. Downloadable logs, completion certificates, self-service exports and automated reporting may not be available as standard platform features unless made available through the Platform.

Customers are responsible for ensuring that their use of this information is lawful, fair and transparent to their users.

9. Reminders and service communications

Verso may send email or platform reminders about assigned training modules.

The timing and cadence of reminders may be controlled by the customer's administrator or by default platform settings.

These communications are service communications relating to the training platform and are not marketing emails.

We may also send administrators and business contacts service updates, account notices, renewal reminders, billing communications and important changes relating to Verso.

10. Marketing communications

We may send business-to-business marketing communications about Verso, Pure Privacy services, updates, events or related content where permitted by law.

You can opt out of marketing communications at any time by using the unsubscribe link in our emails or contacting us at [email protected].

Opting out of marketing does not stop us sending service, account, billing, legal or security communications.

11. Cookies and similar technologies

The Verso website and platform use the same cookies and similar technologies as the main Pure Privacy website.

These may include:

(a) strictly necessary cookies required for the site or platform to work;
(b) security cookies;
(c) authentication and session cookies;
(d) preference or cookie consent cookies; and
(e) analytics cookies, where enabled.

We will only use non-essential cookies where we have a lawful basis to do so, such as consent where required.

More information about the cookies we use, including cookie names, purposes and durations, is available at https://pureprivacy.co/privacy.

12. Who we share personal data with

We may share personal data with:

(a) the customer organisation that purchased or administers your access to Verso;
(b) customer administrators and super administrators;
(c) hosting, infrastructure and platform providers. This includes our platform development, hosting and maintenance provider, currently Engine / This Is My Engine, where necessary for hosting, maintaining, supporting, securing and administering the Verso platform;
(d) authentication and identity management providers, such as Auth0 / Okta, which help us authenticate users and manage secure access to the platform. For example, we use Auth0 to help authenticate users when they log in to Verso. Auth0 may process login credentials and authentication information on our behalf. We do not directly store users' passwords.;
(e) email and notification providers;
(f) customer support and helpdesk providers;
(g) analytics, diagnostics and security logging providers;
(h) payment processors, such as Stripe, where applicable;
(i) professional advisers, including lawyers, accountants, auditors and insurers;
(j) regulators, public authorities, law enforcement or courts where required or permitted by law; and
(k) potential buyers, investors or advisers in connection with a business sale, restructuring, investment or similar corporate transaction.

We do not sell personal data.

13. Payment processing

If a customer pays for Verso online, payments may be processed by Stripe or another payment provider.

Payment providers may process some personal data as independent controllers for payment processing, fraud prevention, compliance and related purposes. Their own privacy notices may apply to that processing.

We do not normally store full payment card details.

14. International transfers

We are based in the United Kingdom.

Some of our service providers may process personal data outside the UK. Where personal data is transferred outside the UK, we will take steps designed to ensure that it receives an appropriate level of protection.

This may include relying on:

(a) UK adequacy regulations;
(b) the UK International Data Transfer Agreement;
(c) the UK Addendum to the EU Standard Contractual Clauses;
(d) the EU Standard Contractual Clauses, where applicable; or
(e) another lawful transfer mechanism available under data protection law.

15. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including for legal, regulatory, accounting, audit, reporting, security and dispute resolution purposes.

Typical retention periods may include:

(a) account and platform records: for the duration of the customer subscription and a reasonable period after expiry or termination to administer closure, export, deletion, legal, security and dispute-related matters;
(b) training logs and completion records: for the duration of the customer subscription and, unless otherwise agreed with the customer or required by law, for up to 30 days after expiry or termination to allow the customer to request a copy, summary or extract of relevant records;
(c) support correspondence: for as long as needed to manage the request and maintain appropriate business records;
(d) billing and transaction records: usually up to six years for tax, accounting and legal purposes;
(e) security logs: for a limited period appropriate to security monitoring and investigation;
(f) marketing records: until you opt out or we no longer need them for business relationship purposes; and
(g) complaint and dispute records: for as long as needed to handle the issue and protect our legal position.

Where we process personal data as processor, retention is governed by our agreement with the customer, including the Data Processing Agreement.

16. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure.

These measures may include access controls, authentication controls, secure transmission, supplier due diligence, confidentiality obligations, logging, monitoring, backup and incident response processes.

We use a third-party authentication provider to support secure login and password management for the Verso platform. This means user passwords are handled by the authentication provider and are not stored directly by us.

No online service can be guaranteed to be completely secure. Users should keep their login credentials confidential and notify us or their administrator promptly if they suspect unauthorised access.

17. Your rights

Depending on the circumstances and our role in relation to the processing, you may have rights under data protection law, including the right to:

(a) request access to your personal data;
(b) request correction of inaccurate personal data;
(c) request deletion of personal data;
(d) object to processing;
(e) request restriction of processing;
(f) request transfer of personal data;
(g) withdraw consent where processing is based on consent; and
(h) complain to the Information Commissioner's Office.

Where we act as processor on behalf of a customer, we may need to refer your request to the relevant customer organisation. This is because the customer is responsible for deciding how to respond to requests relating to its users' training data.

To exercise your rights, please contact us at [email protected] or contact the organisation that provided you with access to Verso.

18. Complaints

If you have concerns about how your personal data is handled in connection with Verso, please contact us first at [email protected].

You also have the right to complain to the Information Commissioner's Office.

ICO contact details:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: https://ico.org.uk
Telephone: 0303 123 1113

If your concern relates to how your employer or another customer organisation uses your training records, you may also wish to contact that organisation directly.

19. Changes to this notice

We may update this notice from time to time.

We will make this notice available through the Verso website, platform, account registration flow or another appropriate channel so that users and customer contacts can access it when their personal data is collected or when they first use the Service.

20. Contact us

For questions about this notice or how we use personal data in connection with Verso, please contact:

Stafford Projects Limited trading as Pure Privacy
Email: [email protected]
Postal address: 5 Middle Farm Close, Dauntsey, Chippenham, England, SN15 4GY