Privacy policy

01Who we are

Leadaline Ltd ("Leadaline", "we", "us") is an AI consultancy and integrations provider working primarily with UK service businesses. We help businesses understand where AI, automation and better-connected systems could improve how they operate, then design, build and support those solutions. Our work covers AI consulting, integrations and tailored business systems such as bespoke CRMs.

• Registered in England and Wales, company number 17224385
• Registered office: given in the company details at the end of this page
• ICO registration reference: ZC183799
• Email: hello@leadaline.com
• Telephone: 07484 657654

02The roles we play

Under UK data protection law, the organisation that decides why and how personal data is used is the controller. An organisation that processes personal data on a controller's documented instructions is a processor. Our role depends on the processing activity, and it can differ within a single project.

When we are a controller

We are the controller for personal data we use for our own purposes, including our website, enquiries and consultation requests, business relationships, our own marketing, billing and internal administration.

When we are a processor

Where we operate integrations, workflows or business systems on a client's behalf and process personal data on their documented instructions, we act as that client's processor. The client is the controller and is responsible for telling the people concerned how their data is used. We have a reviewed data processing agreement template that we use where a processor relationship applies.

03What information we collect

The information we handle depends on the services you use and the agreed scope of a project. Not every client uses every feature. It may include:

• Names and contact details
• Business and organisation information
• Consultation requests and enquiry submissions
• Customer information provided by clients for a project
• Quotations, tasks and other operational records, where relevant to a project
• Project communications and support requests
• Technical information about how our website is used
• Billing and payment administration information
• Call recordings and transcripts, only where AI calling is included in a client project

Booking a free AI consultation

Our website has one form of its own: the enquiry form on our Free AI consultation page. It asks for your name, email address and message, and, if you choose, your phone number, your website and how you heard about us. What you send goes to a Google Form held in our Google Workspace. We use it only to reply to you, and your answer on how you heard about us to see how people find us. When you book a free AI consultation, Google Calendar's booking form asks for your name, email address, business name, website and what you'd most like to fix or improve, and, if you choose, your main services, the areas you want customers from, and whether you're happy for us to check your website. These details come to us through Google Calendar and are held in our Google Workspace, in Google Calendar and our email. We use them only to prepare for the call, including your free Google, AI and agent search check, and to reply to you. To prepare the check we also look at your website and public information about your business, such as Companies House and directory listings. Leadaline is the controller of these details.

Personal data we process on a client's instructions is handled for that client's agreed purposes only, and access is limited to the people who need it for the work. Information held in a client's own independently operated systems stays in those systems.

We do not set out to collect special category data, such as health information. Because client systems can contain a wide range of records, we may encounter it during a project. Where that is likely, we agree how it will be handled with the client before work begins.

04Why we use it, and our lawful bases

Our own processing (as controller)

• Responding to enquiries and arranging consultations: legitimate interests in answering people who contact us, or steps taken at your request before entering into a contract.
• Delivering agreed services and managing projects and support: performance of a contract where you contract with us as an individual. Where our contract is with a business, we use the details of its staff and representatives on the basis of legitimate interests in delivering that contract.
• Managing business relationships and appropriate business communications: legitimate interests in running and developing our business.
• Maintaining the security of our website and systems: legitimate interests.
• Accounting, tax and other legal obligations: legal obligation.
• Marketing where consent is required: consent, which you can withdraw at any time.

Processing on client instructions (as processor)

Where we act as a processor, the client controller decides the purposes of the processing and is responsible for identifying its lawful basis. We process that data only on the client's documented instructions.

05AI and automated processing

Some projects use AI-assisted processing and automated workflows. Depending on what is agreed, this may include:

• AI-assisted handling or summarising of information
• Automated workflows between connected systems
• Enquiry and lead handling
• Connected business systems such as a CRM
• AI calling, call recording and transcription, which are optional and only included in selected projects

Where an agreed solution requires it, personal data may be processed by approved external AI or technology providers. We use these providers only where required for the solution and with the client's approval. That approval does not replace the need for an appropriate lawful basis, suitable contractual terms with the provider, or transparency to the people whose data is involved.

The level of human oversight is agreed for each solution. If a client solution would involve significant decisions about individuals made solely by automated means, we would identify and address the legal requirements that apply with the client before it goes live.

06Marketing and electronic communications

Our own marketing

We send marketing to business contacts in line with UK GDPR and the Privacy and Electronic Communications Regulations (PECR). Whether we need your consent depends on how we contact you and who you are. Every marketing message we send includes a simple way to opt out.

Service communications

Messages about an enquiry, consultation, project or support request you have with us are service communications, not marketing.

Communications sent through client systems

Where we operate messaging, email or calling on a client's behalf, the client is responsible for the lawfulness of those communications, and we act on their instructions.

We do not sell personal data.

07Visitor numbers and cookies

Visitor numbers

We count visits with Vercel Web Analytics. It uses no cookies and stores nothing on your device. It tells us which pages are read, roughly where visitors come from (the country, and the site that sent them) and the type of device, without identifying anyone.

Cookies

Our website sets no cookies of its own, uses no advertising or tracking cookies, and stores nothing in your browser's local or session storage.

The booking calendar on our Free AI consultation page is Google's, shown on our page from Google Calendar. It loads only when you choose to show available times. Once it loads, and if you book a call, Google's own privacy policy and cookies apply.

If we add any technology that stores or reads information on your device, we will update this section first and ask for your consent where the law requires it.

08Sharing and third-party providers

We share personal data only where needed to run our business or deliver an agreed service. Depending on the project, the categories of providers we use may include CRM and database hosting, cloud infrastructure, AI processing services, automation and integration platforms, business email and communications, telephony and transcription where AI calling is included, and billing and accounting.

Our website is hosted by Vercel, which also provides our visitor numbers. Consultation bookings are made through Google Calendar, and messages from our enquiry form through Google Forms. Both are held in our Google Workspace.

Hosting for client systems depends on each project's requirements.

The providers we use fall into three groups. Some are our own service providers, acting as our processors for our own business, such as website hosting, calendar and business email. When we process personal data for a client, providers we engage for that work act as sub-processors, and we use them in line with our agreement with the client. A few providers may act as independent controllers for parts of their service, for example payment or telephony networks, and their own privacy notices then apply. We may also disclose information where required by law.

09International transfers

Some of our providers may store or process personal data outside the UK. Where a restricted transfer takes place, we rely on an appropriate safeguard, such as UK adequacy regulations, the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where required. We have reviewed and documented the processing locations and transfer arrangements of our main providers. Choosing a UK or EU hosting region does not on its own rule out access from elsewhere, for example by a provider's support staff or sub-processors, so we take those arrangements into account. Details of specific providers and their processing locations are available on request.

10How long we keep data

We keep personal data only for as long as we need it. Our current retention periods are:

• Unsuccessful enquiries: up to 12 months.
• Call recordings, where AI calling is used: 90 days.
• Call transcripts and summaries: while we provide the relevant service, subject to any agreed deletion arrangements.
• Client lead records: the duration of the contract plus up to 12 months.
• Financial records: six years, subject to applicable legal requirements.

Where AI calling or lead handling is part of a project, the call and lead periods above apply unless the client agreement says otherwise. Other records, such as consulting and project documentation, support communications and our own business records, are kept for as long as we need them to deliver and support the work and to meet our legal obligations, and are then deleted. CRM and other client system data is kept and deleted in line with the client's instructions, including what happens when a contract ends.

Where we operate a system on a client's behalf, retention follows the client's instructions and our agreement with them. Data held in a client's own independent systems is the client's responsibility. Information in backups is deleted in line with each provider's backup cycle.

11Your rights

Under UK data protection law you have the right to:

• Be informed about how your data is used (this notice).
• Access a copy of the personal data we hold about you.
• Have inaccurate or incomplete data corrected.
• Have your data erased in certain circumstances.
• Restrict or object to certain processing.
• Data portability, where applicable.
• Withdraw consent at any time, where we rely on consent.
• Complain to us about how we handle your data.

To exercise any of these rights, contact us at hello@leadaline.com. Some rights are subject to legal exceptions, so we cannot fulfil every request in every circumstance, but we will explain if that applies. Where your request relates to data we process for a client, we will refer it to the relevant controller and support their response.

12How to complain

If you think we have mishandled your personal data, please raise it with us first at hello@leadaline.com so we can put it right. We will acknowledge your complaint within 30 days of receiving it, take appropriate steps to look into it without undue delay, and keep you informed of progress and the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), although the ICO generally expects you to raise the matter with us first. The ICO can be reached at ico.org.uk or by post at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

13Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, proportionate to the nature of the data and the risks involved. Where we work in client systems, access is limited to what is needed for the agreed work. No system can be guaranteed to be completely secure.

14Changes and how to contact us

We may update this policy as our services or the law change. The date at the top of this page shows when it was last updated.

If you have any questions about this policy or how we handle personal data, email hello@leadaline.com or call 07484 657654.