Privacy Policy

1. Introduction

United Workflows Limited (“we”, “our”, or “us”) is committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website at unitedworkflows.com or use our services.

2. Data Controller

The data controller responsible for your personal data is:

For any data protection enquiries, please contact us at info@unitedworkflows.com.

3. Information We Collect

3.1 Information You Provide Directly

When you submit a contact form or get-started enquiry on our website, we collect the following personal data:

• Required: Full name, email address, service interest, project description, budget range, and timeline
• Optional: Company name, phone number, how you heard about us, and any additional message

3.2 Information Collected Automatically

When you submit a form or interact with our website, we automatically collect certain technical data:

• IP address – for security, rate limiting, and fraud prevention
• User agent string – browser type and device information
• Submission timestamps – the date and time of your enquiry
• Page source – which page you submitted the form from

3.3 Website Performance Monitoring

We use AWS CloudWatch Real User Monitoring (RUM) to collect anonymised performance and usage data. This monitoring is only active if you have consented to analytics cookies. It collects:

• Page load times and performance metrics
• JavaScript errors and technical issues
• HTTP request performance data
• General navigation patterns (anonymised)
• Browser type, device type, and screen resolution
• Geographic region (country/region level only)

No personally identifiable information is collected through this monitoring. This data is retained for 30 days and automatically deleted thereafter.

3.4 Chatbot Interactions

Our website features a conversational AI chatbot powered by ElevenLabs. When you interact with the chatbot, your text inputs and the conversation content may be processed by ElevenLabs' servers, which are located in the United States. No voice data is collected from you. Please refer to ElevenLabs' Privacy Policy for details on how they handle data.

3.5 Cookies

We use cookies and similar technologies on our website. For full details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

4. How We Use Your Information

We use the personal data we collect for the following purposes:

• Responding to enquiries: To reply to your contact form submissions and provide information about our services
• Service delivery: To provide the AI consultancy, cloud architecture, and business automation services you have requested
• Confirmation emails: To send you an automatic confirmation that we have received your enquiry
• Website improvement: To monitor website performance, diagnose technical issues, and improve user experience (using anonymised data only)
• Security: To protect our website against abuse, fraud, and malicious activity through rate limiting and CSRF protection
• Legal compliance: To comply with our legal obligations, including financial record-keeping requirements

5. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following lawful bases:

6. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We only share your information with the following categories of recipients, strictly for operational purposes:

• Amazon Web Services (AWS): Our website infrastructure, form data storage, email delivery, and performance monitoring are hosted on AWS in the EU-West-2 (London, UK) region. AWS acts as a data processor on our behalf under a Data Processing Agreement.
• ElevenLabs: Our AI chatbot is powered by ElevenLabs. If you interact with the chatbot, your conversation data may be processed by ElevenLabs in the United States.
• Professional advisors: We may share data with our legal advisors or accountants where necessary for professional advice or legal compliance.
• Law enforcement and regulators: We may disclose your data where required by law, regulation, or court order.

7. International Data Transfers

Your form submission data is stored and processed within the UK/EEA using AWS services in the EU-West-2 (London) region.

However, if you choose to interact with our ElevenLabs-powered chatbot, your conversation data may be transferred to and processed in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO)
• Assessment of the adequacy of data protection in the recipient country
• Contractual commitments from our service providers regarding data protection

You can request further information about the safeguards in place by contacting us.

8. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy:

Contact form data is automatically deleted after the retention period through automated time-to-live (TTL) deletion. When data is no longer required, it is securely deleted or anonymised.

9. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it, including:

• Encryption at rest: All form submission data stored in our database is encrypted
• Encryption in transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS with HSTS enforcement
• CSRF protection: Cryptographically signed tokens protect against cross-site request forgery attacks
• Rate limiting: API rate limiting prevents abuse and protects against automated attacks
• Input validation: Comprehensive server-side validation prevents injection attacks
• Content Security Policy: Strict browser-level security headers protect against cross-site scripting and other web-based attacks
• Access controls: Least-privilege access controls restrict who can access your data within our systems
• Disaster recovery: Point-in-time recovery is enabled on our database to protect against data loss

10. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you (a “Subject Access Request”).
• Right to rectification: You can ask us to correct any inaccurate or incomplete personal data.
• Right to erasure: You can ask us to delete your personal data where there is no compelling reason for us to continue processing it (the “right to be forgotten”).
• Right to restrict processing: You can ask us to temporarily stop processing your personal data in certain circumstances.
• Right to data portability: You can request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to object: You can object to processing based on legitimate interests, and we must stop unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent: Where we rely on your consent to process data (such as analytics or marketing cookies), you can withdraw that consent at any time by updating your cookie preferences or contacting us.
• Rights related to automated decision-making: We do not make any automated decisions that produce legal or similarly significant effects based on your personal data.

To exercise any of these rights, please contact us at info@unitedworkflows.com. We will respond to your request within one month. In exceptional circumstances, we may extend this by a further two months, but we will inform you if this is the case.

There is no fee to exercise your rights. However, we may charge a reasonable fee or refuse your request if it is manifestly unfounded or excessive.

11. Children's Privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete that information.

12. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policy of any website you visit.

13. Complaints

If you are unhappy with how we have handled your personal data, we encourage you to contact us first at info@unitedworkflows.com so that we can try to resolve your concern.

You also have the right to lodge a complaint with the UK's supervisory authority:

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a concern about how we handle your personal data, please contact us: