Privacy Policy

This policy is dated 19 August 2026. Version 1.5.

1. Who we are and how to contact us

GMD is the controller responsible for your personal data in respect of our own website users, prospects and business contacts (referred to in this policy as you).

You can contact us about this policy or to exercise your rights by email at enquiries@gmdautomation.ai.

Where GMD processes personal data on behalf of a customer in the course of providing its services, GMD acts as a processor and the relevant customer is the controller. That processing is governed by the data protection provisions of the master services agreement between GMD and that customer, and not by this policy.

2. The personal data we collect about you

We may collect, use, store and transfer the following kinds of personal data:

• Identity Data, including your name, title, job title and the organisation you represent.
• Contact Data, including your email address and telephone number.
• Enquiry Data, including the content of your communications with us by email, telephone or LinkedIn, the details you submit through the contact form on the Site, and what you say when you telephone us on the number answered by the AI voice agent described in clause 3. Where you give that agent your details, the written transcript of the call is kept alongside them.
• Transaction Data, including details of services provided to you or the organisation you represent and, where applicable, the payment and direct debit details needed to collect our charges.
• Technical and Usage Data, including your IP address, browser type and version, device information and information about how you use the Site.
• Marketing and Communications Data, including your marketing and communication preferences and records of our correspondence with you.

We do not intentionally collect any special category data (such as data about your health, race, religion or political opinions). Please do not provide such data to us unless we have specifically requested it.

3. How your personal data is collected

We collect personal data:

• directly from you, when you email us, telephone us, connect with us on LinkedIn, submit the contact form on the Site, or otherwise correspond with us;
• when you telephone us, on the number published on the contact page of this site. That number is answered by an automated AI voice agent, which introduces itself as Oscar, and not by a member of our team. Between 09:00 and 17:00, Monday to Friday, the agent can put you through to a person once you have spoken to it; at other times, or if you would rather not speak to an AI agent at all, please email us instead. Where you give the agent your details, we create a record of the enquiry that includes the full written transcript of the conversation, together with your name, company, email address and telephone number, the subject you called about, whether you asked for a callback, and the date and time. We do not ourselves record or keep the audio of the call. The audio does pass through our telephony provider, and we have not confirmed whether that provider retains a recording of it. Please do not give us sensitive information on that line;
• automatically, in the technical information your browser sends whenever it requests a page, which our hosting provider processes in its server logs so that it can serve the Site and keep it secure (see clause 9 (Cookies and similar technologies)); and
• from third parties and public sources, such as Companies House and professional networking platforms.

Only our main site at https://gmdautomation.ai collects personal data directly through a website. Our GMD Rent and GMD Voice sites are static information pages: they contain no contact form or other means of submitting information to us, they set no cookies and use no browser storage, and they send us nothing about you. The calculators on those sites run entirely in your browser, and the figures you enter or select are never transmitted to us. Where those sites invite you to get in touch, they do so by directing you to email us, to telephone us, or to the contact form on our main site.

4. How and why we use your personal data

We will only use your personal data when the law allows us to. The purposes for which we use it, and the lawful bases we rely on, are set out below:

5. Marketing

We do not operate a marketing mailing list, and submitting the contact form does not add you to one. The only email you receive as a result of an enquiry is the confirmation of that enquiry.

You have the right to object to direct marketing at any time. If you would prefer that we did not contact you, please tell us using the details in clause 1 and we will stop.

6. Who we share your personal data with

We share personal data with the recipients described below. Those acting as our processors are permitted to use it only on our instructions:

• Netlify, which hosts and serves our Site and runs the serverless function that receives the enquiries you submit through our contact form;
• Airtable, where we store the enquiry details you submit through our contact form and, in a separate database, the record our AI voice agent creates when you telephone us, which includes the full written transcript of the call alongside your contact details;
• Anthropic, whose Claude AI model helps draft the confirmation email we send when you submit an enquiry, receiving your first name, the service you selected and the content of your enquiry for that purpose but not your email address or telephone number. The same provider’s model also conducts the conversation when you telephone us, and so receives everything you say during that call, including any contact details you give aloud. Anything you choose to type into your enquiry, or to say on that line, is sent with it;
• Resend, which delivers our transactional email, including the confirmation email we send when you submit an enquiry;
• Cal.com, which handles the booking if you use the scheduling link in the confirmation email we send you, or ask our AI voice agent to book a consultation during a call, and which then collects the details entered on its booking page;
• Google, whose web fonts service is used to display the Site, and which may receive your IP address when fonts are requested by your browser;
• Retell AI, which provides the telephone connection for our AI voice line, meaning the audio of your call passes through its systems, and which converts what you say into the written transcript we receive;
• ElevenLabs, which turns our AI voice agent’s replies into the speech you hear, and so receives the words the agent speaks back to you. The voice you hear is one of that provider’s stock synthetic voices; it is not a copy of the voice of anyone at GMD, nor of anyone you are dealing with;
• Voyage AI, which converts both the material in our AI voice agent’s knowledge base and the questions you ask it into a mathematical form, so that the agent can search that knowledge base for an answer;
• Supabase, which provides the database behind our AI voice agent, holding its knowledge base and operational records such as call flags, minute usage and markers showing which calls have been dealt with, but no call transcripts and no caller contact details;
• Twilio, which we use to send text messages in connection with calls to our telephone line, and which receives the number you called from in order to deliver them;
• Render, which hosts the server that runs our AI voice agent, so the details of your call pass through it while the call is in progress; and
• our professional advisers (such as our lawyers, accountants and insurers), and regulators or authorities where we are required by law to share information.

We may also share personal data with a buyer or successor if we sell or transfer our business or assets.

7. International transfers

We treat the following service providers, all of them named in clause 6, as located outside the United Kingdom, principally in the United States, and we apply UK transfer safeguards to all of them: Netlify, which hosts the Site and runs the serverless function that receives your enquiry; Airtable, where we store your enquiry and the record of your call; Anthropic, whose Claude AI model drafts our confirmation email and conducts the conversation on our AI voice line; Resend, which delivers that email; Cal.com, which we use for scheduling; Google, which provides our web fonts; Retell AI, which carries calls to our AI voice line and produces the transcript; ElevenLabs, which generates the agent’s speech; Voyage AI, which supports the agent’s knowledge base; Supabase, which provides the agent’s database; Twilio, which we use to send text messages; and Render, which hosts our voice agent server.

The other recipients described in clause 6 — our professional advisers, any regulator or authority, and any buyer or successor to our business — are ordinarily based in the United Kingdom. The same approach applies to any recipient described in clause 6 that is not. Where we transfer personal data outside the UK, we ensure an appropriate safeguard is in place, such as a UK adequacy determination, the International Data Transfer Agreement, or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with any supplementary measures identified by a transfer risk assessment.

8. Data security and retention

We maintain appropriate technical and organisational measures to protect your personal data. These include encryption in transit across the whole of the Site, a set of HTTP security headers that includes a content security policy, limits on the size and rate of contact form submissions, and automated checks on the confirmation emails we send. We limit access to your personal data to those who have a business need to know it, and we have procedures to deal with any suspected personal data breach.

We retain personal data only for as long as reasonably necessary for the purposes for which we collected it, including to satisfy any legal, regulatory, tax, accounting or reporting requirements. Enquiries reach us in two places and both are covered by the periods below: the contact form on this site, and the records our AI voice agent creates when you telephone us. A record of a call includes the full written transcript of what was said, not only your contact details. Where an enquiry does not lead to a contract, we keep both kinds of record, the transcript included, for no longer than 24 months from our last contact with you. Where an enquiry leads to a contract, we keep the records relating to that contract for 7 years after it ends, in order to meet our legal, tax and accounting obligations. You can ask us to delete your enquiry sooner at any time using the contact details in clause 1, including the transcript of any call you have made to us.

9. Cookies and similar technologies

This clause explains how we use cookies and similar technologies on the Site. A cookie is a small text file placed on your device when you visit a website; in this clause the term also includes similar technologies such as pixels, tags and browser local storage. We use these in accordance with the Privacy and Electronic Communications (EC Directive) Regulations 2003 and the UK GDPR.

The Site sets no cookies and uses no browser storage. All four of our sites are static websites. They store nothing on your device and read nothing from it, and they contain no analytics, advertising, tracking or session-recording technology of any kind. We do not profile you and we do not follow you across other websites. Because nothing is stored on or accessed from your device, no consent is required under those Regulations and we do not display a consent banner.

The Site does make one third-party connection. We load our fonts from Google Fonts, so your browser requests them directly from Google's servers each time a page loads, and your IP address and browser information are disclosed to Google in the process. This does not place a cookie on your device, but it is a disclosure of personal data to a third party, and what Google does with it is governed by Google's own privacy policy.

If we introduce analytics or any other non-essential storage in future, we will update this policy and obtain your consent before any such cookie or similar technology is set. The current position is summarised below:

Your browser settings allow you to refuse or delete cookies and clear site storage at any time, and you can block third-party font requests using your browser or a browser extension. Blocking the font request may mean the Site displays in a fallback typeface.

10. Your legal rights

Under data protection law you have the right to: request access to your personal data; request correction or erasure of it; object to or request restriction of processing; request the transfer of your data; and, where we rely on consent, withdraw that consent at any time.

To exercise any right, contact us at enquiries@gmdautomation.ai. You will not normally have to pay a fee, and we aim to respond within one month. You also have the right to complain to the Information Commissioner's Office (www.ico.org.uk), although we would welcome the opportunity to resolve your concerns first.

11. Changes to this policy

We keep this policy under review and may update it from time to time. The date at the top of this policy shows when it was last updated, and we will post any updated version on the Site.