Privacy Policy
Last updated: 12 October 2026
1. Who We Are
Productivity Workbench is a product management and agile delivery platform operated by MDTS UK Limited, a company registered in England and Wales.
- Registered name: MDTS UK Limited
- Company number: 05149485 (registered 9 June 2004)
- Registered office: Charlotte House, 500 Charlotte Road, Sheffield, S2 4ER, United Kingdom
- Website:productivityworkbench.com
- Contact:privacy@productivityworkbench.com
We are the data controller for personal data processed through this service. We process data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What Data We Collect
Account data
When you register, we collect:
- Email address
- Display name (chosen by you)
- Account creation timestamp
We do not collect your legal name, phone number, address, or payment card details directly. Subscription billing (where applicable) is handled by our payment processor and is subject to their privacy policy.
Workspace data
When you use the product, the content you create (product visions, features, stories, sprints, team member names, audit log entries, etc.) is stored and associated with your tenant workspace. This data belongs to you.
Technical data
- Authentication tokens (stored in your browser's local storage)
- Invocation logs for debugging and performance monitoring (AWS CloudWatch)
- IP address, used only for security logging and rate-limiting
What we do not collect
- We do not use advertising trackers or third-party analytics
- We do not sell, rent, or share your personal data with third parties for marketing
- We do not use session recording or behavioural tracking tools
3. How We Use Your Data
| Purpose | Lawful basis |
|---|---|
| Providing the service (authentication, workspace access) | Contract performance |
| Sending transactional emails (password reset, invite links) | Contract performance |
| Security monitoring and fraud prevention | Legitimate interests |
| Debugging and service reliability (CloudWatch logs) | Legitimate interests |
| Complying with legal obligations | Legal obligation |
4. Data Storage & Retention
Your data is stored on AWS infrastructure located in the eu-west-1 (Ireland) region. Data does not leave the EEA as part of normal operations.
- Account data: retained for the life of your account, plus 30 days after deletion to allow recovery.
- Workspace data: retained for the life of the workspace. Deleted on tenant deletion.
- Audit logs: retained for 12 months by default (configurable per workspace).
- CloudWatch logs: retained for 30 days.
5. Cookies & Local Storage
This application is a single-page app (SPA). We use browser local storage (not cookies) to persist:
- Authentication tokens (JWT — required for the service to function)
- UI preferences and workspace state
- In the AI Studio, a short-lived copy of the open studio's work package list in session storage (this tab only, at most 12 hours)
We do not use tracking cookies, advertising cookies, or any third-party cookies. A cookie consent banner is shown on first visit to acknowledge the use of local storage for essential functionality.
6. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing in certain circumstances
- Data portability — export your workspace data
- Object to processing based on legitimate interests
To exercise any of these rights, email privacy@productivityworkbench.com. We will respond within 30 days.
7. Third-Party Services
| Service | Purpose | Data shared |
|---|---|---|
| Amazon Web Services (AWS) | Infrastructure hosting, authentication (Cognito), database (DynamoDB) | All account and workspace data |
| Amazon CloudFront | CDN delivery of the application | IP address, request metadata |
AWS is our primary sub-processor. All AWS services used are in the UK/EEA region (eu-west-1). AWS is certified under the UK GDPR international transfer mechanism. For the full sub-processor register, see our Enterprise vendor pack — sub-processors.
8. Security
We implement appropriate technical and organisational measures to protect your data, including:
- All traffic encrypted in transit (TLS 1.2+)
- Authentication via Amazon Cognito with JWT tokens
- Workspace data isolation — no workspace can access another's data
- Role-based access controls within workspaces
To report a security vulnerability, please see our security.txt or email enterprise@productivityworkbench.com.
9. Changes to This Policy
We may update this policy from time to time. Material changes will be announced via the application. The "last updated" date at the top of this page indicates when the policy was last revised.
10. Contact & Complaints
For privacy enquiries: privacy@productivityworkbench.com
If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
ico.org.uk — 0303 123 1113