1 Who we are
Optaflo ("Optaflo", "we", "us" or "our") designs and builds custom AI automation systems for trades businesses. This policy explains how we collect, use, store and protect personal information when you visit our website, get in touch, or work with us, and it sets out your rights over that information.
For the purposes of UK data protection law, Optaflo is the "data controller" of the personal information described in this policy, except where we act on behalf of a client business as described in section 5.
Our contact details are:
- Business name: Optaflo, a trading name of OptafloLtd, registered in England and Wales, company number 17267181
- Address: 2 Munnions High Street, Great Baddow, Chelmsford, Essex, CM2 7HN, United Kingdom
- Email: contact@optaflo.co.uk
2 Information we collect
Information you give us
When you complete our enquiry or booking form, email us, or speak with us, you may provide:
| Type of information | Examples |
|---|---|
| Identity and contact details | Your name, business name, email address and phone number |
| Business details | Your trade, the rough number of enquiries you receive, your biggest operational challenge, and your preferred time to be contacted |
| Anything else you share | The contents of messages, emails or notes you send us about your business or requirements |
Information we collect automatically
When you visit our website, certain information may be collected automatically through cookies and similar technologies, where you allow this. This can include your IP address, approximate location, browser and device type, the pages you view, and how you arrived at our site. See section 8 for more on cookies and analytics.
Information from working with you
If you become a client, we will hold the records needed to deliver and support your project, such as project notes, account contacts, billing details and correspondence.
3 How and why we use your information
We use your personal information to:
- respond to your enquiry and arrange your free call;
- understand your business so we can advise you and prepare a proposal;
- provide, build, support and improve the systems and services you ask us to deliver;
- manage our relationship with you, including billing, support and administration;
- send you relevant updates about our services, where you have agreed to this or where we are otherwise permitted to;
- maintain the security and performance of our website and systems;
- keep proper business records and meet our legal and regulatory obligations; and
- establish, exercise or defend legal claims where necessary.
4 Our legal bases for using your information
Under the UK GDPR we must have a lawful basis for using your personal information. We rely on the following:
| What we do | Lawful basis |
|---|---|
| Responding to an enquiry and arranging a call | Our legitimate interests in answering people who contact us, and taking steps at your request before entering into a contract |
| Delivering services to a client | Performance of a contract with you |
| Sending marketing by email | Your consent, or our legitimate interests where the law allows us to contact existing business customers about similar services |
| Improving and securing our website | Our legitimate interests in running a safe, effective business |
| Meeting legal and accounting obligations | Compliance with a legal obligation |
Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights. You can object to this processing at any time (see section 11). Where we rely on consent, you can withdraw it at any time.
5 Data we handle on behalf of clients
When we build and run automation systems for a client, those systems may process personal information about the client's own customers, such as the people who call, message or book with that business. In those cases the client business decides why and how that information is used, so the client is the "data controller" and Optaflo acts as a "data processor".
When we act as a processor we:
- only process that information on the client's documented instructions;
- put a written data processing agreement in place with the client;
- apply appropriate security measures to protect the information; and
- support the client in responding to requests from their customers and in meeting their own obligations.
If you are a customer of one of our clients and have a question about your information, please contact that business directly, as they are responsible for it. We will assist them as needed.
6 Sharing your information and third parties
We do not sell your personal information. We share it only where necessary, with:
- Service providers who help us run our business, including website hosting, email, call scheduling and video meetings, and the AI and automation platforms we use to build and run our services;
- Professional advisers such as accountants and legal advisers, where needed;
- Authorities or other parties where we are required to by law, or to protect our rights, property or safety; and
- A buyer or successor if we reorganise, sell or transfer part of our business.
The main providers we currently rely on are:
- Netlify for website hosting and for receiving enquiry form submissions;
- Calendly for booking and managing calls;
- Microsoft 365 for email and day to day business operations;
- Zoom for video calls.
We choose providers that offer appropriate protection for your information, and we put contracts in place that require them to keep it secure and use it only for the purposes we specify.
7 International data transfers
Some of our providers may store or process information outside the United Kingdom. Where information is transferred outside the UK, we take steps to make sure it receives an equivalent level of protection, for example by relying on an adequacy decision, on the UK International Data Transfer Agreement, or on the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards that are appropriate.
8 Cookies and analytics
Our website uses only a small number of cookies and similar technologies. Cookies are small files placed on your device that help a website work and remember your choices.
We do not use advertising cookies, and we do not run analytics or tracking tools that profile you. The cookies in use are:
- Essential cookies needed for the website and its security to function;
- Third party functional cookies set by our embedded Calendly scheduling tool when you use it to book a call. These are governed by Calendly's own privacy and cookie policies.
You can control or delete cookies through your browser settings. Because we do not use non essential tracking or advertising cookies, the site does not display a cookie consent banner. If we add analytics or marketing tools in future, we will update this policy and ask for your consent where the law requires it.
9 How long we keep your information
We keep your personal information only for as long as we need it for the purposes set out in this policy, and then we securely delete or anonymise it. How long that is depends on the type of information and why we hold it:
- Enquiries that do not become projects: we keep these for up to 24 months after your last contact with us so we can follow up, then we securely delete them.
- Client records: we keep these for the duration of our relationship and for a period afterwards to handle queries, support and disputes.
- Financial and tax records: we keep these for as long as the law requires, which is generally at least six years.
If you would like us to delete your enquiry sooner, you can ask us at any time using the contact details below.
10 How we protect your information
We take appropriate technical and organisational measures to protect your personal information against loss, misuse, unauthorised access, disclosure or alteration. These include access controls, secure accounts, encryption where appropriate, and choosing reputable providers.
No method of transmission or storage is completely secure, so while we work hard to protect your information we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the ICO, and you where required, in line with our legal obligations.
11 Your rights
Under UK data protection law you have the following rights over your personal information:
- Access: to ask for a copy of the information we hold about you;
- Rectification: to ask us to correct information that is inaccurate or incomplete;
- Erasure: to ask us to delete your information in certain circumstances;
- Restriction: to ask us to limit how we use your information in certain circumstances;
- Objection: to object to our use of your information where we rely on legitimate interests, and to object to direct marketing at any time;
- Portability: to ask us to provide certain information to you, or another organisation, in a structured, commonly used and machine readable format; and
- Withdraw consent: to withdraw your consent at any time where we rely on it.
To exercise any of these rights, please contact us at contact@optaflo.co.uk. We will respond within one month, and there is normally no charge. We may need to confirm your identity before we act on a request.
If you are unhappy with how we have handled your information, you can complain to the ICO, the UK supervisory authority for data protection, at ico.org.uk or by calling 0303 123 1113. We would appreciate the chance to address your concerns first.
12 Marketing choices
We will only send you marketing messages where we are permitted to. You can opt out at any time by using the unsubscribe link in our emails or by emailing contact@optaflo.co.uk. Opting out of marketing will not stop service messages that we need to send you about a project or account.
13 Children
Our website and services are aimed at businesses and are not directed at children. We do not knowingly collect personal information about children. If you believe a child has provided us with personal information, please contact us so we can remove it.
14 Other websites
Our website may contain links to other websites and services that we do not control. This policy does not apply to those sites, and we are not responsible for their content or privacy practices. We encourage you to read the privacy policy of any website you visit.
15 Changes to this policy
We may update this policy from time to time to reflect changes in our practices or the law. When we do, we will revise the "last updated" date at the top of this page. If the changes are significant, we will take reasonable steps to let you know.
16 How to contact us
If you have any questions about this policy or about how we handle your personal information, please get in touch:
- Email: contact@optaflo.co.uk
- Post: 2 Munnions High Street, Great Baddow, Chelmsford, Essex, CM2 7HN, United Kingdom
You also have the right to complain to the Information Commissioner's Office at any time. You can find out more at ico.org.uk.