Privacy Policy

Effective date: 1 January 2027 · Last updated: 1 January 2027

This policy explains how AIZAINOS LTD (“AIZAINOS”, “we”, “us”) collects, uses, shares and protects personal data when you visit [domain], create an account, or use the AIZAINOS platform. We write it to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended by the Data (Use and Access) Act 2025.

1. Who we are

AIZAINOS LTD is a company registered in England and Wales (company number 16450844), registered office The Club House, 304 Anchor Road, Longton, Stoke-on-Trent ST3 5DN. We are registered with the Information Commissioner’s Office (ICO) under number [ICO registration number].

Our privacy lead is [DPO / privacy lead name], who you can reach at [privacy@domain] or by post at our registered office, marked “Privacy”.

2. Our two roles

AIZAINOS is a leads management and marketing platform that businesses connect to their existing systems. That gives us two different roles:

• Controller — for data about our website visitors, prospects, account users and the businesses we contract with. This policy covers that data.
• Processor — for the leads, contacts and customer records our business customers upload or sync into AIZAINOS. Each customer is the controller of that data and decides how it is used. We process it only on their written instructions under our Data Processing Agreement. If you are a lead or customer of a business that uses AIZAINOS, please read that business’s privacy notice and contact them first; we will help them answer you.

3. The personal data we collect

Category

Examples

Source

Identity and contact

Name, job title, business email, phone, company

You, when you sign up, book a demo or contact us

Account and login

Username, hashed password, multi-factor settings, role and permissions

You and your organisation’s administrator

Billing

Billing contact, invoices, payment status (card details are held by our payment provider, not us)

You and our payment provider

Usage and technical

IP address, device and browser type, pages viewed, features used, log and error data

Automatically, through cookies and server logs

Communications

Support tickets, emails, call notes, survey answers

You

Marketing preferences

Your opt-ins, opt-outs and campaign interactions

You and our email platform

Public business data

Company details from Companies House or professional profiles

Public sources, for business prospecting only

We do not ask for special category data (such as health, ethnicity or religion) and ask you not to put it into support tickets or free-text fields.

4. Why we use it and our lawful basis

Purpose

Lawful basis (UK GDPR Art 6)

Creating and running your account, providing the platform and support

Contract

Billing, accounting and tax records

Legal obligation; contract

Keeping the platform secure, preventing fraud and abuse

Legitimate interests (recognised legitimate interest where it concerns crime or security)

Improving features and fixing faults using usage data

Legitimate interests

Sending service and security notices

Contract; legitimate interests

Sending marketing emails to business contacts

Legitimate interests, with an opt-out in every email; consent where PECR requires it

Analytics and non-essential cookies

As described in our Cookie Policy

Responding to legal requests and enforcing our terms

Legal obligation; legitimate interests

Where we rely on legitimate interests we have weighed our interests against your rights. You can ask for a copy of that assessment at [privacy@domain].

5. Artificial intelligence and automated decisions

AIZAINOS uses AI features such as lead scoring, content suggestions and message drafting. These help our customers prioritise and respond; they do not on their own make decisions that have a legal or similarly significant effect on you.

Where any decision about you is made solely by automated means and significantly affects you, we will tell you, explain the logic in plain terms, and let you ask for a person to review it, contest it and make representations, as Article 22 UK GDPR requires. We do not use your personal data to train general-purpose AI models offered to third parties. Customer data is not used to train models for other customers.

Drafting note: confirm the AI model providers and whether any data leaves the UK, then list them in section 6.

6. Who we share it with

We never sell personal data. We share it only with:

  • Service providers (processors) — cloud hosting ([Microsoft Azure, Hosting region]), email delivery, payment processing, customer support, analytics and AI model providers. Each is bound by a written contract requiring confidentiality and security. Our current list is at [domain]/subprocessors.
  • Your organisation — if your employer holds your account, its administrators can see your account and activity.
  • Integrations you switch on — when your organisation connects a CRM, DMS or other system, data flows as that integration requires.
  • Professional advisers — lawyers, accountants and insurers, under confidentiality.
  • Authorities — when the law requires, or to protect rights, property or safety.
  • A buyer or successor — if we sell or reorganise our business, under the same protections as this policy.

7. International transfers

We host data in the United Kingdom ([Hosting region]). Where a provider handles data outside the UK, we transfer it only to countries the UK has assessed as adequate, or under the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment. Ask us for a copy of the safeguards at [privacy@domain].

8. How long we keep it

Data

Retention

Account data

For the life of the account, then deleted within 90 days of closure

Billing and tax records

6 years after the end of the financial year (HMRC requirement)

Support tickets

3 years after the ticket closes

Security and access logs

12 months

Marketing contacts

Until you opt out, or 24 months without engagement

Backups

Overwritten on a rolling 35-day cycle

Customer (processor) data

As our customer instructs, and deleted within 30 days of contract end unless they ask for return first

9. Your rights

You have the right to:

  1. Access your personal data and get a copy.
  2. Rectify inaccurate or incomplete data.
  3. Erase your data in certain cases — see our Data Deletion page.
  4. Restrict how we use your data.
  5. Object to processing based on legitimate interests, and to direct marketing at any time.
  6. Data portability — receive data you gave us in a machine-readable format.
  7. Withdraw consent at any time, where consent is our basis.
  8. Not be subject to solely automated significant decisions without the safeguards in section 5.
To use any right, email [privacy@domain] or use the form at [domain]/privacy-request. We reply within one month. If your request is complex we may extend this by up to two further months and will tell you why. We may need to confirm your identity first; the time limit starts once we have done so. Our search will be reasonable and proportionate. We do not charge unless a request is manifestly unfounded or excessive.

10. Marketing

We send marketing only to business contacts and only about our own products. Every email has an unsubscribe link, and you can also email [privacy@domain]. We action opt-outs within 2 working days and keep your address on a suppression list so we do not contact you again.

11. Children

AIZAINOS is a business service for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

12. How we protect your data

We use encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access, multi-factor authentication, logging and regular testing. Our Security page has details. If a breach is likely to result in a risk to you, we will report it to the ICO within 72 hours and tell you without undue delay where the risk is high.

13. Complaints

If you are unhappy with how we have handled your data, please complain to us first at [privacy@domain] or through our online complaints form at [domain]/privacy-complaint. We will acknowledge your complaint within 30 days, investigate it without undue delay, and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

14. If you are in the EU or the United States

Drafting note: keep this section only if you actively offer AIZAINOS to people in the EU or US.

  • EU/EEA: the EU GDPR also applies. Our EU representative under Article 27 is [EU representative name and address]. You may complain to your local supervisory authority.
  • California and other US states: we do not sell or share personal information for cross-context behavioural advertising. You may request to know, delete or correct your information, and we will not discriminate against you for doing so.

15. Changes to this policy

We will post any changes here and update the date at the top. If a change is significant, we will tell account holders by email at least 30 days before it takes effect.

16. Contact

AIZAINOS LTD, The Club House, 304 Anchor Road, Longton, Stoke-on-Trent ST3 5DN · [privacy@domain]