Last updated: 8 September 2026 · Version 1.0 · Previous versions are available on request
Enablai Ltd ("Enablai", "we", "us") is the controller of the personal data described in this policy. This policy explains what we collect, why, on what legal basis, how long we keep it, who we share it with, and the rights you have. It covers this website, our business-to-business outreach, our recruitment, and our delivery of professional services.
It is written to meet Articles 13 and 14 of the UK GDPR as amended by the Data (Use and Access) Act 2025, and the EU GDPR where that applies.
1. Who we are and how to reach us
| Controller | Enablai Ltd, registered in England and Wales, company number 17153203 |
| Registered office | 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom |
| Privacy contact | max@enablai.co.uk |
| Data Protection Officer | We are not required to appoint a statutory Data Protection Officer. Our privacy lead is Max Ayers, Director, contactable at max@enablai.co.uk. |
| EU representative (Art. 27 EU GDPR) | Not appointed; our processing of EEA personal data is occasional and falls within the derogation in Article 27(2). |
2. What we collect, why, and on what basis
2.1 Website visitors
This website sets no cookies and uses no analytics, tracking or advertising technologies — see our cookie policy. The only personal data generated by visiting it is the standard server log kept by our hosting provider.
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Server and security logs held by our hosting provider, Netlify: IP address, browser and device type, pages requested, date and time | Operating and securing the site; detecting and investigating abuse, fraud, and attack | Legitimate interests — network and information security | 90 days |
2.2 Enquiries and proposals
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Name, email address, telephone number, employer and job title where you give them, the service you are interested in, the content of your message, and any file you choose to attach — sent through our contact form (processed by Netlify Forms) or by email | Responding to you; preparing a proposal | Legitimate interests, and steps taken at your request prior to entering a contract | 24 months from our last contact with you |
| Correspondence and meeting notes | Managing the relationship; evidencing what was agreed | Legitimate interests; contract | 24 months from our last contact with you or, where an engagement follows, 6 years after the engagement ends |
2.3 Business-to-business outreach
We may contact people at organisations we believe could benefit from our services, using business contact details obtained from LinkedIn, company websites, and Companies House. We do not run a newsletter and we do not send marketing to consumers.
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Name, business email address, employer, job title, and the source we obtained them from | Introducing our services to organisations we believe could benefit from them | Legitimate interests — direct marketing to businesses. Regulation 22 of the Privacy and Electronic Communications Regulations 2003, which requires consent for marketing emails, applies to individual subscribers and not to corporate subscribers such as limited companies; we rely on that position when emailing people at their business addresses, and we treat sole traders and unincorporated partnerships as individual subscribers whom we do not email without consent | 24 months from our last contact with you, or until you ask us to stop, whichever is sooner. If you opt out we keep only what we need to make sure we do not contact you again |
Every message we send identifies us and tells you how to opt out. To opt out, reply to the message or email max@enablai.co.uk. We honour opt-outs immediately.
2.4 Clients and engagements
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Contact details of your personnel, engagement records, deliverables, timesheets | Delivering the services; managing the account | Contract; legitimate interests | 6 years after the engagement ends |
| Billing details, purchase orders, payment records | Invoicing; accounting; tax | Contract; legal obligation under the Companies Act 2006 and tax law | 6 complete financial years |
Where you instruct us to process personal data belonging to your own customers, employees, or users as part of an engagement, we act as your processor, not as a controller. That processing is governed by the written engagement terms and data processing terms agreed for that work, and by your instructions, not by this policy.
2.5 Suppliers and partners
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Contact and payment details of individuals at our suppliers, subcontractors, and associates | Procuring goods and services; paying them | Contract; legitimate interests | 6 years after the relationship ends |
2.6 Recruitment
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| CV, application, right-to-work evidence, references, interview notes | Assessing your application | Legitimate interests; legal obligation for right-to-work checks; contract if we make an offer | 12 months after the decision, unless you ask us to keep you on file |
3. Where data comes from
Most of it comes from you. We also obtain business contact information from:
- publicly available professional sources, namely LinkedIn, company websites, and Companies House;
- referrals from clients, partners, and your colleagues.
Where we obtain your details indirectly and then contact you, we tell you the source in that first communication.
4. Automated decision-making and artificial intelligence
We do not make decisions about you that are based solely on automated processing and that produce legal effects or otherwise significantly affect you.
We do use AI tools in our own operations — principally large language models supplied by Anthropic through the Claude API — for drafting, research, and analysis. Where we do:
- a human reviews and takes responsibility for any output that affects you;
- we do not use your personal data or your confidential material to train third-party models. Our AI provider supplies its models to us under commercial terms under which our inputs are not used to train its models, and we require an equivalent commitment from any provider we add;
- our providers and the safeguards applying to them are listed in §6 and §7;
- you can object to this processing, and ask for a human review of anything that affects you, at max@enablai.co.uk.
The Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D from 5 February 2026. Significant solely automated decisions that do not involve special category data may now rest on any lawful basis, including legitimate interests, subject to mandatory safeguards. Where such a decision is based wholly or partly on special category data, the stricter regime is preserved: it requires your explicit consent, or authorisation by law together with an Article 9 condition and safeguards. Our transparency, human-review, and contestability commitments above go beyond the statutory minimum and apply to all significant decisions.
How we build and govern AI for clients is described in our responsible AI statement.
5. Special category and children's data
We do not seek special category data — health, race, ethnicity, religion, politics, trade union membership, sex life, sexual orientation, genetics, biometrics. If you choose to tell us something in this category — for example an access requirement so that we can adjust how we meet — we use it only for that purpose and rely on your explicit consent.
Our services are sold to organisations. This website is not directed at children and we do not knowingly collect data from anyone under 18. If you believe we hold a child's data, contact max@enablai.co.uk and we will delete it.
6. Who we share data with
We do not sell your personal data. We never have and we have no plans to.
We share it with the recipients below.
| Category | Provider | Role | Location |
|---|---|---|---|
| Website hosting and contact form processing | Netlify, Inc. | Processor | United States |
| Email, documents, and collaboration | Google Workspace — Google Ireland Limited and Google LLC | Processor | European Union and United States |
| AI and language models | Anthropic — the Claude API | Processor | United States |
| Professional advisers, such as accountants or legal advisers, where we need their help | — | Independent controllers | United Kingdom |
| Subcontractors or associates delivering your engagement, if any | Named to you in the engagement terms | Processor | As stated in the engagement terms |
We do not currently use a customer relationship management system or any analytics, advertising, payment, or booking provider. We review this list whenever we consider adding a provider, and we update this page before a new provider processes your personal data.
We also disclose data where we are required to by law, court order, or a regulator, and to a buyer or their advisers if we sell or reorganise the business — in which case we will tell you beforehand and this policy will continue to apply to data transferred.
7. International transfers
Some of our providers are outside the United Kingdom: Netlify and Anthropic are in the United States, and Google Workspace data may be processed in the European Union and the United States. Where personal data leaves the UK we rely on one of:
- UK adequacy regulations, for transfers to the EEA and other adequate countries;
- the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, supported by a transfer risk assessment;
- the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified.
Where the EU GDPR applies to processing, we rely on EU adequacy decisions or the EU Standard Contractual Clauses.
You can request a copy of the safeguards applying to a specific transfer, with commercial terms redacted, from max@enablai.co.uk.
8. How we protect data
We are a small firm and our measures are proportionate to that, but they are real:
- multi-factor authentication on every account we use;
- encryption in transit and at rest, provided by the services listed in §6;
- least-privilege access — only the people who need access to personal data for their work have it;
- written contracts, including data processing terms, with every processor we use;
- a plan for handling personal data breaches, including reporting to the ICO within 72 hours of becoming aware where that is required.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will report it to the ICO within 72 hours of becoming aware, and tell you without undue delay where the risk to you is high.
9. Your rights
Under the UK GDPR you have the right to:
- be informed — which this policy is for;
- access a copy of your personal data;
- rectification of data that is inaccurate or incomplete;
- erasure, where we have no overriding basis to keep it;
- restriction of processing while a dispute is resolved;
- portability of data you gave us, where processing rests on consent or contract;
- object to processing based on legitimate interests, and to direct marketing at any time — for direct marketing there is no balancing test and we will stop;
- withdraw consent at any time, without affecting processing already carried out;
- not be subject to solely automated decisions with significant effects, and to contest such a decision and obtain human review.
To exercise any right, email max@enablai.co.uk or write to us at the registered office shown in §1. We will respond within one month. If your request is complex we may extend that by two further months, and we will tell you why within the first month. There is no fee unless a request is manifestly unfounded or excessive. We may ask for proof of identity.
10. Complaining to us
Since 19 June 2026 you have a statutory right to complain to us directly about how we handle your personal data, before going to the regulator. We welcome that.
| How | Email max@enablai.co.uk with "Data protection complaint" in the subject, or use our contact form |
| Acknowledgement | Within 5 working days, and in any event within the statutory 30 days |
| Substantive response | Within 20 working days of acknowledgement |
| Owner | Max Ayers, Director — our privacy lead |
| Escalation | If you are not satisfied with the outcome, we will offer a fresh review by an independent mediator at our own cost, and you may go to the ICO at any time |
We will tell you the outcome and the reasons for it. Our full process is in our complaints procedure.
11. Complaining to a regulator
You can complain to a supervisory authority at any time, and you do not have to come to us first.
United Kingdom — Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 0303 123 1113 · ico.org.uk/make-a-complaint
European Union — the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement. A list is maintained by the European Data Protection Board at edpb.europa.eu.
12. Where this policy applies
This website is operated from the United Kingdom for organisations in the United Kingdom and Europe; we do not target the United States or any other market.
Where we offer services to, or monitor the behaviour of, people in the EEA, the EU GDPR applies to that processing alongside this policy. The purposes, bases, recipients, and retention periods above apply equally. We have not appointed an Article 27 representative, for the reason given in §1. Your rights are materially the same, and you may complain to your national supervisory authority.
13. Changes
We review this policy at least annually and whenever our services, providers, or the law change. The version and date are at the top, and previous versions are available on request. Where a change materially affects you we will tell you by email or a prominent notice on this site before it takes effect.
Enablai Ltd, company number 17153203, registered in England and Wales.