Privacy Notice

This notice explains how Padon collects and uses personal data, and what rights you have. It covers:

• people at businesses we contact about our services (section 3);
• our clients’ staff and contacts, and people who ask us about our services (section 4);
• visitors to padon.ai (section 5); and
• people whose data we handle for our clients, such as people who send an enquiry through a client’s website, respond to a client’s ads or are on a client’s customer list (section 6).

1. Who we are

We are the controller of the personal data described in sections 3 to 5.

Contact us about anything in this notice at hello@padon.ai, or write to us at our registered office. We are a small business and have not appointed a data protection officer.

2. Summary

• We contact businesses about our services by email and by phone, using information from Companies House, their own websites and their public business listings.
• Every email we send says who we are, links to this notice and lets you opt out. If you opt out, by email or on a call, we never contact your business again.
• We do not sell personal data. Our website, padon.ai, uses no cookies or advertising trackers, and our emails contain no tracking pixels or tracked links.
• We do our work with AI tools, under business terms that do not let the providers train their models on what we send them.
• Data we handle for our clients belongs to them, and we handle it only on their instructions.

3. Businesses we contact about our services

What we collect and where it comes from

We look for UK businesses that might benefit from our services: websites, advertising, search and being found in AI answers. We collect:

• from Companies House: the company’s name, number, legal form, status, registered office and nature of business, and, where we address an email or call to a person, the name of one current director;
• from the business’s own website and its public business listings, such as its Google Business Profile: factual information such as its contact email address and phone number, address and services, and the name and role of anyone it lists as a contact; and
• records we create: our notes about the business and how it appears online, the emails we send, notes of any call, any reply, and any request to stop contacting you.

Most of this is information about the business, not about you as a person. It becomes personal data where it identifies you, for example a director’s name or a named email address such as jane@yourbusiness.co.uk.

How we contact businesses

• Email. We email only limited companies and limited liability partnerships, at a business email address they publish. We send at most one follow-up.
• Phone. We call business phone numbers that the business publishes. Before calling, we check each number against the Telephone Preference Service and the Corporate Telephone Preference Service, and we do not call a number registered with either unless the business has told us it is happy to hear from us.
• Addressing a person. We may address an email or call to a director, using their name from Companies House, or to a person the business lists as a contact. If you do not reply, we delete your name within 30 days of our last contact.

Businesses we look at but do not contact

If we decide not to contact a business, we delete any personal data we collected about it, such as a director’s name or a named email address, within 30 days. Telling each person individually that we briefly held their details would involve disproportionate effort, so we rely on Article 14(5)(b) of the UK GDPR and publish this notice instead. Our legitimate interests assessment explains the safeguards we use.

Why we use it and our lawful basis

We use this data to decide whether a business might want our services and to contact it about them. Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): our interest is in offering our services to businesses that may benefit from them. We think this is fair because the information is published by the business, on a public listing or on the public register, we contact you about your business’s own marketing, and you can stop us at any time. We have carried out a legitimate interests assessment, and you can ask us for a copy of its conclusions.

Your right to object, and how to opt out

You have an absolute right to object to direct marketing. To stop us contacting you or your business, use the opt-out link in any of our emails, tell us on a call, or reply or write to hello@padon.ai. We stop straight away.

When you opt out, we delete the outreach data we hold about your business, except a short record on our suppression list: the email address, the phone number, the website domain, the company number and the date you opted out. We keep that record permanently, because it is the only way we can make sure we never contact you again, and we use it for nothing else.

4. Clients and people who ask about our services

What we collect

• the legal name and type of the business, and its company number if it has one;
• the names, job titles, email addresses and phone numbers of the people we deal with, including the person who signs or accepts our Order Form;
• the signed or accepted Order Form, with the date and the version of our terms accepted;
• the information and content you send us for the work, and the access you give us to your accounts;
• billing details, such as the business’s name and address, VAT number and payment history;
• notes and written summaries of our calls, and recordings of strategy calls if you agree at the start of the call;
• consents you give us, such as to a case study that names you or to marketing emails; and
• our emails and other correspondence with you.

We do not see or store full card or bank account numbers. If you pay by card or Direct Debit, our payment provider collects them directly (see section 7).

Why we use it and our lawful basis

Purpose	Lawful basis
Providing our services and managing your account	Contract, where you are the contracting party; otherwise legitimate interests in performing our contract with your business
Answering enquiries about our services	Legitimate interests in responding to a business’s request, or steps taken at your request before a contract
Keeping a record of the Order Form and the terms accepted	Legitimate interests (being able to show what was agreed)
Taking payments and keeping accounting and tax records	Legal obligation, and contract or legitimate interests as above
Recording strategy calls, so that our summaries are accurate	Consent, which you give at the start of the call and can withdraw at any time
Publishing a case study that names you, quotes you or shows your photo	Consent
Service messages, such as reports, changes to our terms and service updates	Contract or legitimate interests as above. These are not marketing, and you cannot opt out of them while you are a client
Occasional marketing emails about our services, if you opted in	Consent, which you can withdraw at any time using the link in any such email or by emailing us
Dealing with complaints and legal claims	Legitimate interests (protecting our business)

AI tools

We do our work with AI tools, such as Claude from Anthropic. The information you send us for the work, and notes or recordings of our calls, may be processed by our AI provider (see section 7). We use AI providers only under business terms that do not let them train their models on what we send them. A person reviews our work before it goes live, and we do not use AI to make decisions about you that have legal or similarly significant effects.

5. Visitors to padon.ai

Our hosting provider, Cloudflare, processes technical information, such as your IP address, browser type and the pages requested, to deliver our pages and protect the site from attacks. Our lawful basis is legitimate interests in running a secure website.

padon.ai does not use cookies or similar technologies for analytics or advertising. If we start using anything that needs your consent, we will ask for it first and update this notice.

If you use our complaint form, we use what you send only to deal with your complaint (see section 11).

6. People whose data we handle for our clients

If you sent an enquiry through a website we host for one of our clients, responded to a client’s ads, are on a client’s customer list, or visited a client’s website where tracking is set up, that business is the controller of your data. We handle your data on its behalf, as its processor, only to provide our services to it: for example, to deliver your enquiry to the business, to run and measure its ads, or to match its customer list with an advertising platform. We delete customer lists from our own systems within 7 days after uploading them to the client’s own advertising account.

The business’s own privacy notice explains how it uses your data. To exercise your rights, please contact the business. If you contact us, we will pass your request to the business.

7. Who we share personal data with

We use these service providers. They process personal data on our instructions, except where we say they act as independent controllers.

Provider	What they do	Location
Cloudflare, Inc.	Hosting, forms, storage and running our software	Global network; USA-based company
Resend	Sending emails	USA
Anthropic, PBC	AI processing (Claude) of work content and call notes; never form enquiries, leads or customer lists	USA
Google LLC (Google Workspace)	Our email, file storage, calendar and video calls	USA and other countries
GitHub, Inc.	Storing the code and content of websites we build	USA
GoCardless Ltd	Direct Debit payments, if you pay that way. GoCardless is an independent controller of payment data and has its own privacy notice	UK and EEA
Stripe	Card payments, if you pay that way. Stripe is an independent controller of payment data for its own purposes, such as fraud prevention and regulatory compliance, and has its own privacy notice	UK, EEA and USA

We may also share personal data with our professional advisers (such as accountants, lawyers and insurers), with HMRC, the police or other authorities when the law requires it, and with a buyer if we sell our business. We do not sell personal data.

8. Transfers outside the UK

Some of our providers are based in, or use services in, the USA and other countries. When personal data is transferred outside the UK, we make sure it is protected by one of the safeguards allowed by UK law: either the UK-US data bridge (for US companies certified under the UK Extension to the EU-US Data Privacy Framework) or contract terms approved under UK law, such as the International Data Transfer Addendum to the EU Standard Contractual Clauses. You can ask us for details.

9. How long we keep personal data

Data	How long we keep it
Personal data about businesses we look at but do not contact	Deleted within 30 days
Names of people we addressed by name, where there is no reply	30 days after our last contact, then deleted
Mobile phone numbers found on business websites	Deleted within 30 days, unless we contact the business
Outreach records for businesses that do not reply	6 months after our last contact, then deleted
Enquiries about our services, and outreach records for businesses that reply but do not become clients	12 months after our last contact, then deleted
Suppression list entry after an opt-out	Permanently (see section 3)
Client account, Order Form and acceptance records, and correspondence	For the length of the contract plus 6 years, to deal with any legal claims
Invoices and payment records	6 years from the end of the financial year they relate to, as tax law requires
Recordings of strategy calls	30 days after the call, then deleted. Our written summary is kept with our correspondence
Case study consent records	For as long as the case study is published, plus 2 years
Marketing consent records	For as long as you are opted in, plus 2 years
Data we handle for clients	As set out in our Data Processing Agreement at https://padon.ai/dpa
Complaints, including those sent through our complaint form	6 years after the complaint is closed

10. Your rights

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in some circumstances;
• restrict how we use your data in some circumstances;
• object to our use of your data based on legitimate interests, and to object at any time to direct marketing;
• data portability for data you gave us under a contract or with your consent; and
• withdraw consent, where we rely on consent, without affecting what we did before.

To use any of these rights, email hello@padon.ai. We will respond within one month, which may be extended by up to two further months for complex requests. We may need to confirm your identity first.

11. Complaints

If you are unhappy with how we have handled your personal data, please tell us first. You can use our complaint form at https://padon.ai/complaints, email hello@padon.ai, or write to us at our registered office (section 1). We will acknowledge your complaint within 30 days, keep you informed of progress, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commission (ICO):

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

12. Changes to this notice

We will update this notice when our practices change, and show the version and date at the top.