Data Protection

Draft for solicitor review. Last updated: 3 November 2026. Items marked [TODO] are still to be added.

1. Who we are

Hamaritech Ltd ("Hamaritech", "we", "us") is a company registered in England and Wales.

• Company number: [TODO]
• Registered office: [TODO]
• ICO registration number: [TODO]

2. The law we follow

We handle personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. Our role

When we set up services for a customer, that customer decides how their own customers' personal information is used. They are the data controller, and we act as their data processor. For information about people who contact Hamaritech directly, we are the data controller, and our privacy policy explains how we handle it.

4. A data processing agreement for each customer

We sign a data processing agreement with each customer before we handle any personal information on their behalf. It sets out:

• What personal information we handle, and why
• That we only act on the customer's written instructions
• How the information is kept secure and who can access it
• Which sub-processors we use, and how the customer is told about changes
• How long information is kept, and how it is returned or deleted at the end
• How we help the customer respond to requests and report any breach

[TODO: attach or link the standard data processing agreement.]

5. AI assistants always disclose they are AI

Every AI assistant we set up tells people at the start that they are talking to an AI, and offers a way to reach a person.

6. Collecting only what is needed

We set up each service to collect only the personal information needed for its purpose, and to keep it no longer than necessary. [TODO: standard retention periods.]

7. Security

We use appropriate technical and organisational measures to protect personal information. [TODO: describe the measures in place.]

8. Sub-processors and transfers

[TODO: list the categories of sub-processors used, and the safeguards in place if any information is processed outside the UK.]

9. Breaches

If a personal data breach affects information we handle for a customer, we will tell that customer without undue delay. [TODO: confirm the notification timescale.]

10. Contact us

For any question about data protection, contact us:

• Email: [email protected] [TODO: replace with the real address]
• Post: [TODO: registered office address]

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.