Privacy Policy

1. Who we are

AiActions Ltd ("AiActions", "we", "us") is the data controller for personal data processed through aiactions.co.uk and in the course of delivering our services. We are registered in England and Wales, company number 10754912, registered office 176 Church Road, London NW10 9NP. Contact our team on privacy matters at info@aiactions.co.uk.

2. What we collect

Depending on how you interact with us, we may collect:

• Enquiry and contact data — name, email address, phone number, company, sector, website URL, service interest, budget range and project notes submitted through our contact, project or strategy-call forms.
• Chat and AI advisor data — messages you send to the website chat widget, and, where the AI-assisted advisor is active, the content of that conversation.
• Security testing engagement data — for clients of AiActions Security Testing, the target scope, engagement configuration, scan results, findings and reports generated during an authorised assessment. This data is handled under the terms of your specific engagement agreement in addition to this policy.
• Technical and analytics data — pages visited, referring page, device/browser type and approximate location, collected via privacy-friendly, cookie-free analytics (see our Cookie Policy).
• Correspondence — records of emails and calls where you contact us directly.

3. Why we process it, and our lawful basis

We do not send marketing communications without a lawful basis to do so, and any marketing email will always carry a clear way to opt out.

4. Who we share data with

We use a small number of third-party processors to run the business. We only share what each provider needs to do its job:

• Hosting providers — our web hosting and VPS providers, to serve the website and any client-facing tools you use.
• Email delivery — to deliver enquiry notifications and correspondence.
• AI chat provider — where the AI-assisted chat advisor is enabled, messages may be sent to a third-party large language model provider to generate a response. This provider may be based outside the UK and EU. Where personal data is transferred outside the UK, we rely on the provider's standard contractual clauses or an equivalent safeguard recognised under UK GDPR, and we avoid sending sensitive personal data, passwords or payment details through chat by design.
• Analytics — a privacy-focused analytics provider that does not use tracking cookies or build cross-site profiles.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

5. How long we keep it

Enquiry and contact data is kept for as long as needed to respond to you and, if a project proceeds, for the duration of the client relationship plus a reasonable period afterward for accounting and legal purposes (normally up to 6 years, in line with UK statutory record-keeping requirements). Chat conversations that don't lead to a further enquiry are retained only as long as needed to operate and improve the service, and are not kept indefinitely. Security testing engagement data — scope, scans and findings — is retained for the duration stated in the relevant engagement agreement and deleted or returned on request once the engagement and any agreed remediation-verification period has closed.

6. Your rights

Under the UK GDPR and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Ask us to delete your data, where there is no overriding reason for us to keep it
• Restrict or object to certain processing, including processing based on legitimate interests
• Receive your data in a portable format where processing is based on consent or contract
• Withdraw consent at any time, where processing relies on consent

To exercise any of these rights, email info@aiactions.co.uk. We will respond within one month. If you're unhappy with how we've handled your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies and browser storage

Details of the cookies and local storage this site uses are set out in our separate Cookie Policy.

8. Security

We apply reasonable technical and organisational measures to protect personal data, including restricted access to systems holding client and enquiry data, encrypted connections (HTTPS) throughout the site, and — for our own infrastructure — the same authorised-testing discipline we sell to clients. No method of transmission or storage is 100% secure; if we become aware of a breach affecting your personal data, we will notify affected individuals and the ICO where required by law.

9. Children's data

Our services are directed at businesses and professional contacts, not children. We do not knowingly collect personal data from children under 13.

10. Changes to this policy

We may update this policy as our services, tools or legal obligations change. Material changes will be reflected by updating the "last updated" date above. We encourage you to review this page periodically.

11. Contact

For any privacy question or request, email info@aiactions.co.uk or write to AiActions Ltd, 176 Church Road, London NW10 9NP.