How we handle your data.

Who we are

Weframe Group LTD (trading as weframe), company number 17093742, registered in England and Wales, is the controller of the personal data described here. For anything about your data, email admin@weframe.io.

Whose data this covers

This policy covers people who visit our website, people we contact about our services, our clients and their staff, suppliers, and people who apply to work with us. Where we process data on a client's behalf as part of a build, see “Data we handle for clients” below.

If you visit our website

We collect basic technical information such as browser, device type and pages visited. If you accept analytics cookies, Microsoft Clarity records anonymised session behaviour so we can improve the site. It only loads with your consent.

We don't set any strictly necessary cookies. Cal.com sets its own cookies on the booking page if you schedule a call. You can change your cookie choice at any time using Manage cookie preferences in the footer.

Lawful basis: consent for analytics, and our legitimate interests in running a working website.

If you book a call or contact us

We use your name, email, company and anything you tell us to arrange and hold the conversation and to follow up on it.

We may transcribe calls using Granola so we have accurate notes. We'll tell you at the start of the call, and if you'd rather we didn't, we won't.

Lawful basis: our legitimate interests in responding to you, or taking steps at your request before entering into a contract.

If we contacted you first

If we emailed or messaged you without you contacting us first, we found your work contact details through one of these sources:

• B2B data providers, such as Apollo and Clay
• Public sources, such as your company's website, Companies House and LinkedIn
• Industry events and networks you're part of
• An introduction from someone who knows you

We hold your name, job title, company, work email, work phone number where available, and notes of any conversation we have. We use them to tell you about our services, which we believe may be relevant to your business.

Lawful basis: our legitimate interests in marketing our services to businesses. We've assessed this and keep the assessment on file.

You can object at any time. Reply “no” to any email, or email admin@weframe.io, and we'll stop contacting you. We keep your email on a suppression list so you aren't contacted again by mistake.

We only send unsolicited marketing emails to people at companies and limited liability partnerships. We don't send it to sole traders or ordinary partnerships without their consent.

If you're a client

We use the contact details of your staff to deliver our work, manage the relationship, send invoices and keep records.

Lawful basis: performance of our contract, our legal obligations (for example, tax records), and our legitimate interests in running our business.

Data we handle for clients

When we build systems for clients, we may process personal data that belongs to them, such as tenant, contractor, borrower or customer records. In that case the client is the controller and we act as their processor under a written agreement. We only use that data to deliver the work they've asked for. We don't pool client data, sell it, or use it to train AI models.

If your data is in one of our clients' systems and you want to exercise your rights, contact that client. We'll help them respond.

If you're a supplier or partner

We use your contact details to manage our relationship and pay you.

Lawful basis: contract and legitimate interests.

If you apply to work with us

We use your CV, application and interview notes to assess your application.

Lawful basis: steps taken at your request before a contract, and our legitimate interests in recruiting.

Who we share data with

We don't sell personal data. We use trusted providers to run our business, and they process data on our behalf under contract:

• Email and documents: Google Workspace
• Prospect data and enrichment: Apollo and Clay
• Email sending: Instantly and Smartlead
• CRM: our own in-house system
• Databases and hosting, for our website, our CRM and the systems we build: Supabase and Vercel
• Meeting notes and call transcription: Granola
• Call booking: Cal.com
• Website analytics: Microsoft Clarity

We'll also share data if the law requires it, or with professional advisers such as our accountants and lawyers.

International transfers

Some of our providers store data outside the UK, mainly in the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the ICO's International Data Transfer Agreement or Addendum.

How long we keep it

Prospects who don't respond

Up to 24 months after our last contact

Anyone who opts out

Email kept on our suppression list indefinitely, so we don't contact you again

Clients

Up to 6 years after the relationship ends, for legal and tax purposes

Unsuccessful job applicants

Up to 6 months after the decision

Website analytics

As set by Microsoft Clarity's retention settings

Your rights

Under UK GDPR you can ask us to:

• tell you what data we hold and give you a copy
• correct it
• delete it
• restrict how we use it
• move it to another provider, where that applies

You can also object to how we use your data at any time. If it's for marketing, we'll always stop.

Email admin@weframe.io and we'll respond within one month.

If you're unhappy with how we've handled your data, tell us first and we'll try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes

We'll update this page if anything changes and change the date at the top.