Privacy policy

1. Who we are

This policy explains how Encrypt AI Solutions (“we”, “us”, “our”) collects and uses personal data about you. It also explains your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), all as amended, including by the Data (Use and Access) Act 2025.

For the processing described in this policy, we are the controller. We are based in Colwyn Bay, North Wales. For any privacy question or request, email chris@encrypt-solutions.com.

We have not appointed a Data Protection Officer because we are not required to.

2. Who this policy covers

This policy covers:

• website visitors: people who visit encrypt-solutions.com;
• enquirers: people who contact us, book a call, ask for a proposal or send us their quiz results;
• client contacts: the staff and representatives of businesses that use our services; and
• suppliers and partners: the people we deal with at those organisations.

What this policy does not cover. While we deliver services, we may see or handle personal data that belongs to our clients, such as data held in their own systems or AI accounts. In that role we act as our client’s processor: we only use that data on the client’s instructions, under a written agreement. Our client is the controller of that data, and their own privacy notice explains how it is used. If your data is held by one of our clients, please contact that client first. We will help them deal with your request.

3. The personal data we collect

We do not intend to collect special category data (for example about health, ethnicity or religious beliefs) or criminal offence data. Please do not send us this kind of information.

4. Our website, forms and cookies

Contact form. When you send our contact form, we receive your name, email address, company (if given), what you are interested in (if chosen), your message, the page you sent it from, the time and your IP address. We store this on our own web server and send a copy to our business email, which is provided by Microsoft 365. We use it to reply to you.

AI readiness quiz. The quiz works out your result in your browser. Your answers are not sent to us unless you enter your email address, tick the consent box and press “Send my results”. If you do, we receive your email address, your answers and result, the time and your IP address, and handle them in the same way as the contact form. You can withdraw your consent at any time by emailing chris@encrypt-solutions.com.

“Ask us a question” box. The quick answers in this box are shown by your browser. Nothing you type there is sent to us unless you choose to pass your question into the contact form and send it.

Spam and abuse protection. Our forms use a hidden field and a timing check to stop automated spam. To stop a form being flooded, our server briefly holds the IP addresses of recent senders in memory (for about 10 minutes) and limits how many messages can be sent from one address.

Server logs. Like most websites, our web server keeps standard logs of requests (IP address, page requested, browser type and time). We use them to keep the site secure and working, and we keep them only for a short time.

Cookies and similar technologies. Our website does not set any cookies and does not store anything on your device. We do not use analytics, advertising or social media tracking, and our fonts and scripts are served from our own server, so visiting the site does not send your data to other companies. If this ever changes, we will update this policy first and ask for your consent where the law requires it.

5. Where we get your data from

• Directly from you: through our forms, emails, calls, meetings and contracts.
• From your employer or colleagues: for example, when they name you as a project contact or book you onto a course.
• Automatically: through our web server logs, as described above.
• From public sources: such as Companies House, your organisation’s website or professional networking profiles, when we research a business enquiry.

6. How we use your data and our lawful bases

Where we rely on legitimate interests, we have balanced our interests against your rights, and you can ask us for details. Where we rely on consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

7. Marketing

We only send updates that are relevant to your role and organisation. Every marketing email includes a way to unsubscribe, or you can email chris@encrypt-solutions.com. We do not sell your personal data, and we do not use it for online advertising.

8. AI and your data

• We do not use your personal data, or any client data, to train our own AI models.
• Where we use AI-enabled tools in running our own business, we configure them so that, as far as the provider allows, what we enter is not used to train the provider’s general models, and we have contracts in place with those providers.
• We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you.

9. Who we share your data with

We share personal data only where necessary, with:

• service providers acting for us: our website hosting provider (Mythic Beasts), our email and productivity provider (Microsoft 365) and other tools we use to run the business, such as accounting software;
• professional advisers: such as accountants, lawyers and insurers;
• subcontractors who help us deliver a project, under confidentiality and data protection terms;
• authorities: HMRC, regulators, law enforcement or courts, where the law requires it; and
• a buyer or successor: if our business, or part of it, is sold or restructured.

Your organisation’s own AI providers (for example Microsoft or OpenAI) are contracted directly by your organisation. They are not our suppliers.

10. International transfers

Some of our service providers, such as Microsoft, may store or access data outside the UK. When this happens, we make sure the transfer is lawful under UK GDPR. For example, the destination is covered by UK adequacy regulations (such as the EEA, or US organisations certified to the UK Extension to the EU-US Data Privacy Framework), or appropriate safeguards are in place, such as the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Email us for more information.

11. How long we keep your data

12. Your rights

You have the right to:

• access your personal data (a subject access request). We will carry out reasonable and proportionate searches;
• have inaccurate data corrected;
• have data erased in certain circumstances;
• restrict our processing in certain circumstances;
• data portability, where processing is based on consent or contract and carried out by automated means;
• object to processing based on legitimate interests. You have an absolute right to object to direct marketing;
• withdraw consent at any time, where we rely on consent; and
• protections relating to automated decision-making (UK GDPR Articles 22A to 22D), including the right to ask for human involvement. We do not currently make such decisions.

To use any of these rights, email chris@encrypt-solutions.com. We will respond without undue delay and within one month. We may extend this by up to two further months for complex requests, and we will tell you if we do. We may need to confirm your identity first.

13. Complaints

Complaining to us. If you are unhappy with how we have handled your personal data, please tell us first, by email to chris@encrypt-solutions.com with the subject “Data protection complaint”, or through our contact form. We will acknowledge your complaint within 30 days, investigate without undue delay, keep you updated and tell you the outcome.

Complaining to the regulator. You also have the right to complain to the UK data protection regulator, the Information Commission (still known as the ICO), at ico.org.uk/make-a-complaint.

14. Security

We use appropriate technical and organisational measures to protect personal data. These include HTTPS encryption on our website, multi-factor authentication, restricted access to form submissions on our server, and keeping our systems up to date. No system is completely secure. If a personal data breach is likely to result in a high risk to you, we will tell you.

15. Children

Our services are for businesses and are not aimed at children. We do not knowingly collect data from anyone under 18.

16. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows when it last changed. We will tell clients about significant changes.