Security and data, in plain words
You control every login, nothing is done outside your systems, and the paperwork is in place before anyone starts.
The short answer
We are a UK company registered with the ICO. Our people sign confidentiality agreements, work only inside your systems with individual logins you control, never take card details, and we sign a UK GDPR data processing agreement with you.
ICO stands for the Information Commissioner’s Office. UK GDPR stands for the UK General Data Protection Regulation.
Paperwork before anyone starts
A mutual NDA
A mutual NDA is standard before we see anything sensitive.
A data processing agreement
We sign a UK GDPR data processing agreement with you before anyone gets a login. You are the data controller and we are the data processor.
Confidentiality agreements
Every person and manager signs a confidentiality agreement before any login.
Training in the first week
Every person is trained in UK GDPR and in your business in the first week.
Your logins
Logins you control
Every person has an individual named login that you create and can remove at any time. No shared accounts.
Two-factor sign-in
Two-factor authentication where possible.
A password manager
Passwords are kept in a password manager.
Access reviewed
Access is reviewed every month.
Devices
- Company-approved, encrypted, screen-locked and up-to-date devices.
- No public Wi-Fi without a VPN, which is a private, secure connection.
- No personal email for work.
What happens to your data
It stays in your systems
We work only inside your systems. There is no downloading, no screenshots, no printing and no local copies of customer records.
What we keep
We keep only the weekly reports and hour logs, for 12 months.
When we part ways
We remove all access and delete any data within 14 days of the end of the contract.
No card details
We never request, record or store card data. Customers are sent to your own payment pages.
Sensitive data
Allergen and health information is treated as special category data.
Working from outside the UK
Our team works remotely from several countries. Remote access to UK personal data from outside the UK is covered by the UK’s standard international data transfer terms, with a transfer risk assessment. Both are written into our data processing agreement. Your data stays in your own systems, and we don’t download or store it.
If something goes wrong
Our people report any incident to us within 12 hours. We tell you within 24 hours, and you decide whether to tell the ICO.
How our bots handle data
Content is data, never instructions
An email or web page can never tell a bot what to do, and an emailed “yes” never counts as approval.
Every run is logged
A missed run becomes a follow-up task.
Spending is capped
There are hard weekly caps on paid tools. A capped bot stops rather than finding a workaround.
What we never do
- Take card details.
- Download, screenshot, print or keep local copies of customer records.
- Share logins. Every login belongs to one named person.
- Use personal email for work.
- Name a client or publish a case study without written consent. That is why we do not name our clients.
Questions people ask
Is my data safe?
Yes. We are a UK company registered with the ICO. Our people sign confidentiality agreements, work only inside your systems with individual logins you control, never take card details, and we sign a UK GDPR data processing agreement with you.
Do you sign NDAs?
Yes. A mutual NDA is standard before we see anything sensitive, and a UK GDPR data processing agreement is signed before anyone gets a login.
Can you take card payments over the phone?
No, never. We send customers to your own secure payment page. It protects you and them.
Is it GDPR-compliant if your people work from outside the UK?
Yes. Remote access from outside the UK is covered by the UK’s standard international data transfer terms, which are written into our data processing agreement. Your data stays in your own systems, and we don’t download or store it.
What happens if there is a data incident?
Our people report it to us within 12 hours, and we tell you within 24 hours. You decide whether to tell the ICO.