Evil Works Privacy Notice
Purpose
Evil Works Ltd trading as Evil Works (the Company, we, us or our) respects your privacy and is committed to protecting your personal data.
This privacy notice explains how we process your personal data when you visit our website, contact us, use our Platform or otherwise interact with us as a customer, prospective customer, Platform user, supplier or website visitor. It also tells you about your privacy rights under applicable Data Protection Laws, including the Data Protection Act 2018, the UK General Data Protection Regulation (“UK GDPR”) and where applicable, the EU General Data Protection Regulation (“EU GDPR”).
Our Platform is a software development tool for data scientists for data science modelling and data analysis. Users can upload data, clean and transform data and create models using standard data science techniques.
Controller for personal data
A “controller” is a person or organisation which alone or jointly determines the purposes for which personal data is or is likely to be processed. Unless we notify you otherwise, Evil Works is the controller of your personal data for the purposes of this website and for personal data we process in connection with providing our Platform and services directly to you.
Processor for personal data
Where a business customer uploads or otherwise provides personal data to the Platform on behalf of that customer, Evil Works may process that personal data on the customer’s behalf and in accordance with the relevant contractual terms and data processing arrangements. In those circumstances, the customer will be responsible for providing privacy information to the relevant individuals and responding to their data protection requests.
Scope
This privacy notice applies to the processing of personal data by us in connection with:
Customers, prospective customers and Platform users: where we provide or are preparing to provide, our products, services or Platform to you.
Suppliers: where you are a supplier or service provider to us or represent a supplier or service provider.
Website visitors: anyone browsing our website or interacting with our content online.
Types of personal data
Personal data or personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed. This is known as anonymised data. Anonymised data falls outside the scope of Data Protection Laws.
Evil Works may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:
Identity Data includes first name, last name, username or similar identifier and title.
Contact Data includes billing address, delivery address, email address and telephone numbers.
Financial Data includes bank account and payment card details, where payment arrangements are introduced.
Transaction Data includes details about payments to and from you and other transaction details relating to the provision of services.
Technical Data includes internet protocol (IP) address, login data, browser type and version, time zone setting, general location, browser plug-in types and versions, operating system, platform and other technology on the devices you use to access our website or Platform.
Profile Data includes username and password, searches made by you, ratings and comments, preferences, feedback and survey responses.
Usage Data includes information about how you use our website, Platform and services.
Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences.
Depending on your relationship with us, we may process some or all of the categories above, together with other personal data you provide through correspondence, support requests, chatbot conversations or use of the Platform.
Lawful bases: how we use your personal data
We will only use your personal data when the law allows us to. We may use your personal data in the following circumstances:
Performance of a contract: where we need to perform a contract we are about to enter into or have entered into with you. For example, when you sign up to our services or use our Platform.
Legal obligation: where we need to comply with a legal obligation. For example, for accounting, tax or legal purposes.
Legitimate interests: where it is necessary for our legitimate interests or those of a third party and your interests and fundamental rights do not override those interests.
Consent: where you have given us consent to process your personal data. We do not generally rely on consent, except where this is appropriate, such as for certain marketing communications and non-essential cookies. You have the right to withdraw consent at any time. Please contact us at contact@evilworks.com to withdraw consent.
Vital interests: where it is necessary to protect your vital interests or the vital interests of another person in an emergency.
Public task: where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
How we collect your personal data
Directly from you
You give us personal data in your direct interactions with us. This may include Identity Data, Contact Data, Financial Data, Profile Data, Usage Data, Technical Data and Marketing and Communications Data when you:
fill in forms on our website;
create an account or use our Platform;
request information, a demonstration or support;
leave ratings, comments, feedback or survey responses;
interact with our chatbot;
subscribe to our newsletter or marketing communications; or
correspond with us by email, post or telephone.
Third-party sources
We may receive Identity Data and Contact Data about you from third parties where:
another person or organisation provides your personal data to enable us to provide services to you;
you provide your personal data to a third party for the purpose of sharing it with us; or
a supplier or service provider collects information on our behalf.
We may obtain information from third parties, including:
companies which support our website and services
providers that support user authentication, account access and security.
analytics providers such as Google Analytics and Squarespace Analytics; and
payment service providers.
Automatically collected information
When you visit our website, use the Platform, open or click on emails we send you or interact with our services, we or third parties acting on our behalf may automatically collect certain information using online tracking technologies, such as cookies, pixels, web beacons, software development kits and third-party libraries. This information is primarily needed to maintain the security and operation of our website and Platform and for our internal analytics, reporting and service-improvement purposes.
Processing Tables
The processing tables below explain the purposes for which we process personal data, the categories of personal data involved and the lawful bases on which we rely. The processing that applies to you will depend on your relationship with us and how you interact with our website, Platform, products or services. For example, different processing activities may apply where you are a customer, prospective customer, Platform user, supplier or website visitor. We may process personal data for more than one purpose and may rely on more than one lawful basis where this is appropriate.
Customer, prospective customer and Platform user: Processing Information
This is where we directly interact with you to provide our products, services or Platform or where you make an enquiry about them.
Processing activities
Categories of personal data
Lawful basis
To respond to enquiries, including enquiries submitted through our website, forms, email, other links on our website or chatbot features
Identity Data, Contact Data and information included in your enquiry
Necessary for our legitimate interests where we need to be able to respond to you
Performance of a contract where relevant
To sign you up to our Platform or products/services
Identity Data, Contact Data, Profile Data, Technical Data
Performance of a contract
To facilitate account creation, authentication and login processes
Identity Data, Contact Data, Profile Data, Technical Data
Performance of a contract
To provide, operate and support the Platform and our products/services
Identity Data, Contact Data, Profile Data, Usage Data, Technical Data
Performance of a contract
Necessary for our legitimate interests in operating, improving and supporting our services
To manage our relationship with you, including notifying you about changes to our terms or privacy notice
Identity Data, Contact Data, Profile Data
Necessary for our legitimate interests in keeping our records updated and studying how customers use our products/services
To process and deliver our products/services to you, including managing payments, fees and charges and collecting and recovering money owed to us
Identity Data, Contact Data, Financial Data, Transaction Data
Performance of a contract;
Necessary for our legitimate interests to recover debts due to us
To request feedback and contact you about your use of our products, services or Platform
Identity Data, Contact Data, Profile Data, Usage Data
Necessary for our legitimate interests in understanding and improving our services
To register you for newsletters and marketing communications
Identity Data, Contact Data, Marketing and Communications Data
Consent, where required; or soft opt-in where permitted by applicable law
Legitimate interest where permitted (i.e. as a business customer)
To post testimonials on our website that may contain personal information
Identity Data and testimonial content
Consent. Before posting a testimonial, we will obtain your consent to use your name and the content of the testimonial.
To administer and protect our business, website, Platform, login portal and dashboard, including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data
Identity Data, Contact Data, Technical Data, Usage Data
Necessary for our legitimate interests in running our business, providing administration and IT services, maintaining network security, preventing fraud
To comply with legal, regulatory, tax, accounting and reporting requirements and establish, exercise or defend legal claims
Identity Data, Contact Data, Financial Data, Transaction Data and other relevant data
Necessary to comply with a legal obligation; necessary for our legitimate interests in establishing, exercising or defending legal claims
Supplier: Processing Information
This is where you are a supplier of products or services to us.
Processing activities
Categories of personal data
Lawful basis
For you to provide services and products to us
Identity Data, Contact Data
Performance of a contract
To manage payments, fees and charges we owe you
Identity Data, Contact Data, Financial Data, Transaction Data
Performance of a contract
To engage with you for product or service support
Identity Data, Contact Data
Performance of a contract
Necessary for our legitimate interests so that we can contact you regarding queries, issues and concerns
To comply with legal, regulatory, tax, accounting and reporting requirements
Identity Data, Contact Data, Financial Data, Transaction Data
Necessary to comply with a legal obligation
Website visitor: Processing Information
This is where you are a website visitor, regardless of whether you take up our products or services.
Processing activities
Categories of personal data
Lawful basis
When you contact us via our website, forms and other links on our website, including chatbot features
Identity Data, Contact Data and information included in your enquiry
Necessary for our legitimate interests where we need to be able to respond to you
To manage our relationship with you, including notifying you about changes to our terms or privacy notice
Identity Data, Contact Data, where you have provided that data to us
Necessary for our legitimate interests in keeping our records updated and studying how visitors use our products/services; necessary to comply with a legal obligation where applicable
To administer and protect our business and website, including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data
Identity Data, Contact Data, Technical Data
Necessary for our legitimate interests in running our business, providing administration and IT services, maintaining network security and preventing fraud; necessary to comply with a legal obligation
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences
Technical Data, Usage Data
Consent where required for analytics cookies or similar technologies; otherwise necessary for our legitimate interests in keeping our website updated and relevant, developing our business and informing our marketing strategy
Use of non-essential cookies, where consent is required
Technical Data
Consent
Use of Artificial Intelligence
For customer: The PUFF platform includes an AI-powered chatbot to assist users when working within their PUFF projects (“Puff books”). The chatbot can help users generate, explain and clarify PUFF code including code used to load, clean and process uploaded data files and apply PUFF functions.
The chatbot is designed to support users in using the platform and does not make decisions on their behalf. In particular, it is not used to make solely automated decisions that produce legal effects or similarly significant effects, on individuals.
Please do not provide sensitive personal data, confidential information, passwords or account credentials through the chatbot unless we specifically request it.
Cookies and similar technologies
We gather information and statistics collectively about visitors to our website. Analysis of this information demonstrates the most frequently used sections of the website and assists us in continually improving the online service. Please also refer to our cookies notice for more information on how we set cookies.
Providing personal data
Where we need to collect personal data by law or under the terms of a contract and you do not provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you. For example, we may be unable to provide access to our Platform or provide the relevant services.
In this case, we may have to cancel the relevant service, but we will notify you if this is the case at the time.
Marketing communications
We may send you marketing communications where permitted by law. You have the right to object at any time to processing of your personal data for direct marketing purposes. You can unsubscribe from receiving marketing communications from us by:
using the unsubscribe method contained in communications we send to you; or
contacting us at contact@evilworks.com.
Where you opt out of receiving marketing communications, this will not apply to personal data provided to us as a result of registering for or using our services or Platform, your service experience, transactions or other interactions with our website.
How we disclose personal information
In certain circumstances, we may disclose your personal information to third parties for contract fulfilment purposes, legitimate purposes and other reasons subject to this privacy notice.
Such circumstances may include disclosure:
Internally: to employees and contractors working to provide our services to you, on a need-to-know basis.
With our affiliates: within our corporate group, where applicable, to operate and manage our business effectively and provide requested services.
With our service partners: to vendors and other third parties which perform services on our behalf, such as IT management, authentication, website hosting, cloud storage, analytics, customer support and payment services.
With legal and professional advisers: including lawyers, bankers, auditors, accountants and insurers, where necessary for legal, financial, insurance, accounting or consultancy purposes.
With payment service intermediaries: where payment arrangements are introduced, to facilitate payment to us.
With public authorities and regulators: where necessary to comply with law, regulation, a court order or a lawful request or to establish, exercise or defend legal claims.
In connection with a business transaction: such as a merger, acquisition, financing, reorganisation, insolvency event or sale of assets. Your personal data will continue to be processed in accordance with this privacy notice unless you are notified otherwise.
Where third parties process personal data on our behalf, we require them to implement appropriate security measures and only process personal data in accordance with our instructions, except where they act as an independent controller.
International transfers for UK/EU
We may transfer and process your personal data outside the United Kingdom (“UK”) and/or European Economic Area (“EEA”) including where one of our service providers processes personal data from another location.
Where we transfer personal data outside the UK or EEA, we will ensure that an appropriate safeguard is in place, as required by applicable Data Protection Laws. This may include:
transferring personal data to a country that has been recognised as providing an adequate level of protection;
using standard contractual clauses approved by the European Commission;
using the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
relying on another lawful transfer mechanism permitted by applicable Data Protection Laws.
Data security
We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, where applicable and are subject to a duty of confidentiality.
Data retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which we collected it, including to satisfy legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint, dispute, investigation or if we reasonably believe that there is a prospect of litigation in respect of our relationship with you.
To determine the appropriate retention period for personal data, we consider:
the amount, nature and sensitivity of the personal data;
the potential risk of harm from unauthorised use or disclosure;
the purposes for which we process the personal data and whether we can achieve those purposes through other means; and
applicable legal, regulatory, tax, accounting or other requirements.
Data Subject Rights
Under certain circumstances, you have rights under Data Protection Laws. Not all rights are absolute and, depending on where you are located, not all rights may apply. You may have the right to:
Request access to your personal data: also known as a subject access request. This enables you to receive a copy of the personal data we hold about you.
Request correction of your personal data: this enables you to have incomplete or inaccurate information corrected.
Request erasure of your personal data: this enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. We may not always be able to comply with an erasure request for specific legal reasons, which we will explain where applicable.
Object to processing of your personal data: where we process your personal data based on legitimate interests or those of a third party. We may continue processing where we have compelling legitimate grounds or where processing is relevant to legal claims. You may always object to direct marketing.
Request restriction of processing: this enables you to ask us to suspend processing in certain circumstances, including where you contest the accuracy of the data, believe our processing is unlawful but do not want erasure, require the data for legal claims or have objected to processing pending verification of our grounds.
Request transfer of your personal data: in certain circumstances, we will provide your personal data to you or a third party you have chosen in a structured, commonly used and machine-readable format.
Withdraw consent: where we rely on consent, you can withdraw it at any time. This will not affect the lawfulness of processing before withdrawal. We will advise you if withdrawing consent means we cannot provide a particular service.
Rights relating to automated decision-making: not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you, subject to applicable legal exceptions.
We do not carry out automated decision-making which produces legal effects concerning you or similarly significantly affects you.
Carrying out your data subject rights
You will not normally have to pay a fee to access your personal data or exercise any other right. However, we may charge a reasonable fee or refuse to act on a request, if it is clearly unfounded, repetitive or excessive.
We may need to request specific information to confirm your identity and ensure your right to access personal information or exercise another right. This is a security measure to ensure that personal information is not disclosed to anyone who has no right to receive it.
You can exercise your rights by:
submitting a request through https://www.evilworks.com/datarequest; or
contacting us at contact@evilworks.com.
We aim to respond to legitimate requests within one month. Occasionally, it may take longer where a request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Keeping personal information accurate and current
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. You may update your account information through your account settings, where available or contact us at contact@evilworks.com.
Concerns and complaints
We would appreciate the opportunity to deal with your concerns in the first instance. Please contact us using the details in the Contact details section above.
You also have the right to complain to a data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (“ICO”):
Website: www.ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
If you live or work in the EEA or your complaint concerns our processing activities in the EEA, you may also lodge a complaint with the relevant supervisory authority in the country where you live, work or believe an infringement has occurred.
Contact details
Evil Works
The Shipping Building
The Old Vinyl Factory
Blyth Road. Hayes
London. UB3 1HA. United Kingdom
Email: contact@evilworks.com
Changes to our privacy notice
This privacy notice may be changed from time to time in response to legal, technical or business developments. We will take appropriate measures to inform you when we update it. Where required by applicable Data Protection Laws, we will obtain your consent to material changes.
Version control
This version was last updated in September 2026.