Privacy Policy
Last updated: [Date]
Version: 2.0
Table of Contents
- 1. Introduction
- 2. What Information Do We Collect?
- 3. How Do We Use Your Information?
- 4. Who Do We Share Your Information With?
- 5. International Data Transfers
- 6. How Long Do We Keep Your Information?
- 7. How Do We Keep Your Information Safe?
- 8. When We Act as Data Processor
- 9. Your Privacy Rights
- 10. Cookies and Tracking Technologies
- 11. Children's Privacy
- 12. Automated Decision-Making and Profiling
- 13. Changes to This Privacy Policy
- 14. Contact Information
- 15. Legal Basis Summary
- FAQ for Quick Reference
1. Introduction
Bramforth AI (trading as JIMENY Enterprises Ltd) ('we', 'us', or 'our') is committed to protecting your privacy and personal data in accordance with UK data protection laws.
Registered Address: 86-90 Paul Street, London, EC2A 4NE, England
Company Registration: [Number]
Data Protection Contact: privacy@bramforth.ai
About This Privacy Policy
This Privacy Policy explains how we collect, use, store, and protect personal information when you:
- Visit our website at bramforth.ai
- Enquire about or purchase our services
- Interact with our sales, marketing, or support teams
- Use our AI voice agent services (if you're a business customer)
- Call a business that uses our voice AI technology (if you're an end user)
Our Dual Role: Controller and Processor
Understanding our role is important for your privacy rights:
When we're a Data Controller (we decide what to do with your data):
- Website visitors and prospects exploring our services
- Business customers who purchase our services
- Marketing contacts and newsletter subscribers
When we're a Data Processor (we follow our client's instructions):
- When you call a business (like a clinic or support center) that uses our voice AI agents
- In these cases, the business you're calling is the Controller and decides how your data is used
- We process data only according to their instructions and our Data Processing Agreement (DPA)
This policy primarily covers our role as Controller. If you're calling a business that uses our voice agents, please see Section 8 "When We Act as Data Processor" and refer to that business's privacy notice.
2. What Information Do We Collect? (When We're Controller)
2.1 Information You Provide Directly
When you interact with Bramforth AI as a potential or current business customer, we collect:
Contact Information:
- Full name
- Business name and role/title
- Email address
- Phone number
- Business address
Business Information:
- Company size and sector
- Business needs and pain points
- Services you're interested in
- Preferred contact methods and times
Account and Billing Information:
- Username and password (hashed, never stored in plain text)
- Billing address and VAT number
- Payment information (processed by Stripe - we never see your card details)
- Invoice history and payment records
Communications:
- Emails you send us
- Phone call recordings (with advance notice)
- Meeting notes from sales calls or support sessions
- Feedback and survey responses
Marketing Preferences:
- Newsletter subscription status
- Marketing consent preferences
- Communication channel preferences
2.2 Information We Collect Automatically
When you visit our website, we automatically collect:
Technical Information:
- IP address and approximate location (country/city level)
- Browser type and version
- Device type (desktop, mobile, tablet)
- Operating system
- Screen resolution and browser window size
Usage Information:
- Pages you visit and time spent on each
- Links you click
- Files you download (e.g., case studies, whitepapers)
- Search queries on our site
- Referral source (how you found us)
Cookies and Similar Technologies:
We use cookies for:
- Essential website functionality
- Analytics to improve our website (Google Analytics)
- Marketing attribution (if you've consented)
You can control cookies through your browser settings. See Section 10 for details.
2.3 Information From Third Parties
We may receive information about you from:
- LinkedIn: If you connect with us or interact with our content
- Google/Microsoft: If you use social login on our platform
- Business partners and referrers: Who recommend our services
We only accept third-party data where we believe they have a lawful basis to share it with us.
3. How Do We Use Your Information? (When We're Controller)
3.1 Our Processing Purposes and Legal Bases
We use your personal information for the following purposes, each with a lawful basis under UK GDPR:
| Purpose | Legal Basis |
|---|---|
| Providing our services (account setup, service delivery, customer support) | Performance of contract (Article 6(1)(b)) - necessary to deliver the services you've purchased |
| Processing payments and managing billing | Performance of contract (Article 6(1)(b)) |
| Responding to enquiries before you become a customer | Legitimate interests (Article 6(1)(f)) - our interest in growing our business |
| Sending marketing emails to prospects/customers | Consent (Article 6(1)(a)) OR Legitimate interests (Article 6(1)(f)) for existing customers under soft opt-in |
| Improving our website and services through analytics | Legitimate interests (Article 6(1)(f)) - improving user experience |
| Fraud prevention and security monitoring | Legitimate interests (Article 6(1)(f)) - protecting our business and customers |
| Complying with legal obligations (e.g., tax, accounting) | Legal obligation (Article 6(1)(c)) |
3.2 Legitimate Interests Assessment
Where we rely on legitimate interests, we've balanced our interests against your privacy rights and ensured:
- We use minimal data necessary
- You have reasonable expectations we'd process this data
- Our interests don't override your fundamental rights
- You can object at any time
3.3 Marketing Communications
What we send:
- Product updates and new features
- Industry insights and best practices for AI automation
- Case studies and success stories
- Event invitations and webinar announcements
How to opt out:
- Click "unsubscribe" in any marketing email
- Email privacy@bramforth.ai with "Unsubscribe" in the subject
- Update your preferences in your account dashboard
Note: Even if you opt out of marketing, we may still send you essential service communications (e.g., security alerts, billing notices, service changes).
5. International Data Transfers
5.1 Where Is Your Data Processed?
Primary storage: European Union (Ireland and Germany)
Some processing occurs in the United States through providers like:
- Vercel (website hosting)
- Stripe (payment processing)
- Mailgun (email delivery)
- Google Workspace (internal business systems)
5.2 How We Protect International Transfers
For transfers to the United States and other countries without UK adequacy decisions, we use:
Standard Contractual Clauses (SCCs): EC-approved contracts requiring US providers to protect your data to UK GDPR standards
Supplementary measures:
- Encryption in transit and at rest
- Access controls and authentication
- Regular security assessments
- Contractual commitments to challenge government data requests
UK International Data Transfer Agreement (IDTA): Post-Brexit UK framework ensuring continued protection
5.3 Transfer Impact Assessments
We've conducted Transfer Impact Assessments for all US providers and determined that with our supplementary measures, the transfers provide appropriate safeguards.
Your rights: You can request copies of relevant SCCs and transfer safeguards by emailing privacy@bramforth.ai.
6. How Long Do We Keep Your Information?
6.1 General Retention Principles
We keep data only as long as necessary for the purposes described in this policy. Retention periods depend on:
- Legal and regulatory requirements (e.g., tax records for 7 years)
- Contract obligations
- Our legitimate business interests
- Your preferences and rights
6.2 Specific Retention Periods
| Data Type | Retention Period | Reason |
|---|---|---|
| Prospect/lead data | 3 years from last interaction | Reasonable period to nurture business relationship |
| Customer account data | Duration of contract + 7 years | Fulfilling contract + legal/tax obligations |
| Payment/billing records | 7 years from transaction | UK tax and accounting requirements |
| Marketing consent records | Until consent withdrawn + 3 years | Demonstrating consent compliance |
| Website analytics | 26 months | Google Analytics default retention |
| Security logs | 12 months | Security monitoring and incident investigation |
| Email communications | 3 years from last contact | Business records |
6.3 Deletion Process
After retention periods expire:
- Deletion: We securely delete data so it cannot be recovered
- Anonymization: Some data may be anonymized for statistical analysis (no longer personal data)
- Backups are overwritten within 90 days
- Legal hold data is retained until the matter concludes
You can request earlier deletion by exercising your right to erasure (see Section 9).
7. How Do We Keep Your Information Safe?
7.1 Technical Measures
- Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
- Access controls: Role-based access, multi-factor authentication for staff
- Monitoring: 24/7 security monitoring and intrusion detection
- Backups: Daily encrypted backups stored securely
- Password security: Passwords hashed using bcrypt (never stored in plain text)
7.2 Organizational Measures
- Staff training: Regular data protection and security training
- Confidentiality agreements: All staff and contractors sign NDAs
- Access restrictions: Data access limited to authorized personnel only
- Vendor management: Sub-processors vetted for security practices
- Incident response plan: Documented procedures for data breaches
7.3 Certifications (Planned)
We're working toward:
- ISO 27001 (Information Security Management)
- SOC 2 Type II (Security and Confidentiality)
7.4 Data Breach Notification
If we suffer a data breach affecting your personal information:
- We'll notify you within 72 hours of becoming aware
- We'll notify the ICO if the breach poses risks to your rights
- We'll provide: Details of the breach, likely consequences, and our remedial actions
Despite our safeguards, no system is 100% secure. If you notice any security concerns, please report them immediately to security@bramforth.ai.
8. When We Act as Data Processor
This section applies to you if: You're calling a business (like an aesthetic clinic, medical practice, or support center) that uses our AI voice agent technology. In these cases, the business you're calling is the Data Controller and we're their Data Processor.
8.1 Who Controls Your Data?
When you call a business using our voice agents:
- The business (Controller) decides: What data to collect, how to use it, how long to keep it, who to share it with
- Bramforth (Processor) follows instructions: We only process data as instructed by the business
- Your rights: You must contact the business (Controller) to exercise privacy rights
8.2 What Data We Process (As Processor)
When you call a business using our voice agents, we may process:
For Healthcare Clients:
- Your name and phone number (caller ID)
- Call recordings (audio) and transcripts (text)
- Appointment booking details (date, time, service type)
- Health-related information you voluntarily share (e.g., "I need a consultation for hair loss")
- CRM data from the clinic (if you're a returning patient)
For Non-Healthcare Clients:
- Your name and phone number
- Call recordings and transcripts
- Enquiry details (e.g., technical support questions, your technical level)
- Account information for personalized service
Special Category Data: We may process health data when our clients are healthcare providers. This is processed under Article 9(2)(h) UK GDPR (healthcare purposes) and strictly according to our clients' instructions and legal bases.
8.3 Our Obligations as Processor
Under our Data Processing Agreements (DPAs) with business customers, we:
- ✅ Process data only on their documented instructions
- ✅ Keep data secure using measures described in Section 7
- ✅ Only use approved sub-processors (see table below)
- ✅ Help them respond to data subject rights requests
- ✅ Notify them within 48 hours if we detect a security incident
- ✅ Delete or return data within 30 days of contract termination
8.4 Sub-Processors for Voice Agent Services
When providing voice agent services, we use these additional sub-processors:
| Provider | Service | Location | Purpose | Safeguards |
|---|---|---|---|---|
| Retell AI | Voice AI engine | 🇺🇸 United States | Converting speech to text and processing conversations | SCCs, SOC 2, encryption |
| Twilio | Telephony (phone system) | 🇺🇸 United States | Routing phone calls to our AI agents | SCCs, SOC 2, HIPAA-eligible |
| OpenAI | AI language models | 🇺🇸 United States | Understanding and responding to enquiries (via RetellAI) | SCCs, data processing agreements |
| ElevenLabs | Voice synthesis | 🇺🇸 United States | Text-to-speech voice generation (via RetellAI) | SCCs, data processing agreements |
| MongoDB Atlas | Database | 🇮🇪 Ireland (EU) | Storing call records and transcripts | ISO 27001, EU-based |
| Render | Backend hosting | 🇩🇪 Germany (EU) | Running voice agent applications | ISO 27001, EU-based |
Important: Our DPA with the Retell AI platform includes their sub-processors (see Retell AI DPA in project documents).
8.5 International Transfers (Voice Agent Data)
Healthcare client data:
- Core data stored in EU (Ireland, Germany)
- Some AI processing in US (Retell AI, Twilio, OpenAI/Anthropic)
- Protected by: UK GDPR-approved Standard Contractual Clauses, UK IDTA, and supplementary measures
- Transfer Impact Assessments: Conducted and documented
Your rights regarding US transfers: The business you're calling (Controller) can object to these transfers. Refer to their privacy notice or contact them directly.
8.6 Healthcare Data Protections
When processing health information (UK GDPR Article 9 "special category data"), we implement:
- Enhanced encryption and access controls
- Healthcare-specific staff training and confidentiality agreements
- Faster breach notification (24 hours vs 48 hours standard)
- Stricter data minimization (only essential health information captured)
- Regular security assessments focused on healthcare compliance
8.7 Your Rights (When We're Processor)
If you're calling a business that uses our voice agents:
- ✅ Right to access your call recordings and transcripts
- ✅ Right to correction of inaccurate information
- ✅ Right to deletion of your call data
- ✅ Right to object to AI processing (and request human handling)
- ✅ Right to complain to the ICO if you believe your data is mishandled
How to exercise these rights:
- Contact the business you called first (they're the Controller)
- The business will coordinate with us to fulfill your request
- We'll respond to their request within 2 business days
- If you can't reach the business, contact us at privacy@bramforth.ai and we'll assist
8.8 Data Retention (As Processor)
We retain voice agent call data according to our DPA with each business customer:
Standard retention (unless instructed otherwise):
- Call recordings and transcripts: Configurable per customer (0, 7, 30, or 90 days); default 30 days
- Appointment data: Up to 3 months after appointment
- CRM synced data: Duration of service + 30 days
- Security logs: 12 months
Automatic deletion: Data is automatically deleted per these schedules.
8.9 DPA Availability
Business customers who use our voice agent services execute a Data Processing Addendum (DPA) that includes:
- UK GDPR Article 28 requirements
- Standard Contractual Clauses for international transfers
- Security obligations and breach notification procedures
- Sub-processor list and change notification rights
- Audit rights and compliance certifications
Current/prospective business customers: Contact info@bramforth.ai to request our DPA.
9. Your Privacy Rights
Under UK GDPR, you have the following rights:
9.1 Right of Access (Article 15)
What it means: You can request a copy of the personal data we hold about you.
How to exercise: Email privacy@bramforth.ai with subject "Subject Access Request"
What you'll receive:
- Copy of your personal data in a common format (PDF or CSV)
- Details of how we use your data and who we share it with
- How long we'll keep your data
- Your rights regarding your data
Response time: 1 month (may extend to 2 months for complex requests)
9.2 Right to Rectification (Article 16)
What it means: You can request correction of inaccurate or incomplete data.
How to exercise: Email privacy@bramforth.ai with subject "Rectification Request"
9.3 Right to Erasure / "Right to be Forgotten" (Article 17)
What it means: You can request deletion of your personal data.
How to exercise: Email privacy@bramforth.ai with subject "Deletion Request"
When we must comply:
- Data is no longer necessary for the original purpose
- You withdraw consent (where consent was the legal basis)
- You object to processing and there's no overriding legitimate interest
- Data was unlawfully processed
- Legal obligation requires deletion
Exceptions (we may refuse deletion if):
- We need to comply with legal obligations (e.g., tax records for 7 years)
- We need to establish, exercise, or defend legal claims
9.4 Right to Restrict Processing (Article 18)
What it means: You can request we stop processing your data (but still store it).
When available:
- You're contesting data accuracy (we pause processing during verification)
- Processing is unlawful but you don't want deletion
- We no longer need the data but you need it for legal claims
- You've objected to processing (pending verification of legitimate interests)
9.5 Right to Data Portability (Article 20)
What it means: You can receive your data in a machine-readable format and transfer it to another service.
Applies when:
- Processing is based on consent or contract
- Processing is automated
Format: JSON, CSV, or XML (your choice)
9.6 Right to Object (Article 21)
What it means: You can object to processing based on legitimate interests or for marketing.
How to exercise: Email privacy@bramforth.ai with subject "Objection"
Marketing objections: We'll stop immediately (no questions asked)
Legitimate interests objections: We'll stop unless we can demonstrate compelling legitimate grounds that override your interests
9.7 Rights Related to Automated Decision-Making (Article 22)
What it means: You have the right not to be subject to automated decisions with significant effects.
Our stance: We don't use automated decision-making that significantly affects you (see Section 12).
9.8 Right to Withdraw Consent
Where we process data based on your consent, you can withdraw consent at any time:
- Click "unsubscribe" in marketing emails
- Email privacy@bramforth.ai
- Update preferences in your account dashboard
Note: Withdrawal doesn't affect the lawfulness of processing before withdrawal.
9.9 Right to Complain
If you believe we've mishandled your data, you can:
- Contact us first: privacy@bramforth.ai - we'll investigate and respond
- Complain to the ICO:
- Information Commissioner's Office (ICO)
- Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- 🌐 https://ico.org.uk
- 📞 0303 123 1113
9.10 How to Exercise Your Rights
To exercise any of these rights:
- Email us: privacy@bramforth.ai
- Include: Your full name, email, account details (if applicable), specific request, and proof of identity (if needed)
- We'll respond: Within 1 month (may extend to 2 months for complex requests)
- It's free: We don't charge for rights requests (unless manifestly unfounded or excessive)
11. Children's Privacy
Age restriction: Our services are not intended for children under 18.
We do not knowingly collect data from children under 18. If we discover we've inadvertently collected such data, we'll delete it immediately.
Exception: Healthcare Services
When acting as a processor for healthcare clients, children's data may be processed as part of legitimate healthcare services (e.g., pediatric clinics). In these cases:
- The clinic (Controller) is responsible for obtaining parental consent
- We process children's data only as instructed by the clinic
- Enhanced protections apply (minimal data collection, strict access controls)
Parents/Guardians: If you believe we've collected your child's information, contact privacy@bramforth.ai immediately.
12. Automated Decision-Making and Profiling
We do not use automated decision-making that produces legal or similarly significant effects on you.
Our AI Voice Agents:
- Assist with appointment booking and enquiries
- Do not make decisions that significantly affect you (e.g., loan approvals, medical diagnoses)
- Always allow you to speak with a human by pressing a button or requesting a callback
Business Customers:
We may use automated systems to qualify sales leads (e.g., company size, industry) but this doesn't significantly affect you. You can contact us at any time to discuss your needs with a human.
13. Changes to This Privacy Policy
13.1 Updates
We may update this Privacy Policy to:
- Reflect changes in our services
- Comply with new legal requirements
- Improve clarity and transparency
When we make material changes:
- We'll update the "Last Updated" date at the top
- We'll notify business customers by email
- For significant changes, we may require re-acceptance
13.2 Review History
You can request previous versions of this Privacy Policy by emailing privacy@bramforth.ai.
14. Contact Information
14.1 General Privacy Enquiries
Email: privacy@bramforth.ai
Response time: Within 5 business days for initial response
14.2 Data Protection Responsibilities
Data Protection Contact: Jamie Oarton, Director of Operations
Email: privacy@bramforth.ai
Note: We're a small business and don't currently have a statutory obligation to appoint a Data Protection Officer. Jamie Oarton serves as our data protection contact.
14.3 Exercise Your Rights
Subject Access Requests: privacy@bramforth.ai (Subject: "Subject Access Request")
Deletion Requests: privacy@bramforth.ai (Subject: "Deletion Request")
Objections: privacy@bramforth.ai (Subject: "Objection")
Other rights: privacy@bramforth.ai (specify your request in the subject)
Response time: 1 month (may extend to 2 months for complex requests)
14.4 Security Concerns
Security issues: security@bramforth.ai
Suspected data breach affecting you: We'll notify you within 72 hours
14.5 Business Enquiries
General enquiries: info@bramforth.ai
Sales: sales@bramforth.ai
Support: support@bramforth.ai
Postal Address
Bramforth AI (JIMENY Enterprises Ltd)
86-90 Paul Street
London EC2A 4NE
England
14.6 Regulatory Authority
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
🌐 https://ico.org.uk
📞 0303 123 1113
15. Legal Basis Summary
Quick reference for our legal bases for processing:
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Delivering services to customers | Performance of contract | 6(1)(b) |
| Processing payments | Performance of contract | 6(1)(b) |
| Responding to enquiries | Legitimate interests | 6(1)(f) |
| Marketing to prospects | Legitimate interests | 6(1)(f) |
| Marketing to customers | Consent OR Soft opt-in (legitimate interests) | 6(1)(a) or 6(1)(f) |
| Website analytics | Legitimate interests | 6(1)(f) |
| Security and fraud prevention | Legitimate interests | 6(1)(f) |
| Tax and accounting compliance | Legal obligation | 6(1)(c) |
| Processing health data (as Processor) | Healthcare purposes (on behalf of Controller) | Article 9(2)(h) |
FAQ for Quick Reference
Q: Do you sell my data?
A: No. Never.
Q: Can I delete my account?
A: Yes. Email privacy@bramforth.ai and we'll delete within 30 days.
Q: Where is my data stored?
A: Primarily in the EU (Ireland and Germany). Some processing occurs in the US with legal protections (SCCs).
Q: Do you process health data?
A: Yes, when healthcare clinics use our voice agents. We're the Processor; the clinic is the Controller. We follow strict protections for health data.
Q: How long do you keep call recordings?
A: When acting as Processor: As instructed by the business (typically duration of service + 30 days). See Section 8.8 for details.
Q: Can I opt out of AI call handling?
A: That's decided by the business you're calling (they're the Controller). Most offer the option to press a button to speak with a human.
Q: Do you use my data to train AI models?
A: No, not without explicit opt-in. Our sub-processors (OpenAI, Anthropic) process data only to provide the service, not for model training, per our agreements.
Q: How do I know if a business I'm calling uses your service?
A: They should disclose this in their privacy notice and when you call. The AI typically identifies itself at the start of the call.
Q: Are you GDPR compliant?
A: Yes, we're committed to full UK GDPR compliance. This Privacy Policy and our DPAs with business customers reflect that commitment.
Q: Do you have a Data Protection Officer?
A: We don't have a statutory requirement for a DPO yet, but Jamie Oarton serves as our data protection contact. Contact: privacy@bramforth.ai.
Document Information
Document Version: 2.0
Owner: Jamie Oarton, Director of Operations
This Privacy Policy was written to be clear, honest, and comprehensive. If anything is unclear, please contact privacy@bramforth.ai - we're here to help.