Privacy Policy Overview
Effective Date: 13 June 2026
Last Updated: 13 June 2026
Welcome to the Privacy Policy of JUST AUTOMATE IT LTD ("we", "us", or "our"). We are committed to protecting your privacy and being transparent about how we collect, use, and safeguard your personal information.
This Privacy Policy explains how we handle your data when you:
- Visit our website at just-automate-it.org (the "Website")
- Contact us, book a call, or request an assessment
- Engage us for data engineering, AI automation, or consulting services (the "Services")
Data Controller:
JUST AUTOMATE IT LTD
27 Lower Aston Hall Lane
Deeside, Clwyd
CH5 3EX
United Kingdom
Email: support@just-automate-it.org
Our Commitment:
We operate in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We practice data minimization: we collect only what we need to respond to you and deliver our Services.
Information We Collect
Website Visitors
Information You Provide:
- Contact & Booking Forms: Name, email address, company name, phone number (optional), and message content when you submit an inquiry or book a call
- Assessments: Information about your business, tools, and workflows that you choose to share when requesting an automation or data infrastructure assessment
- Newsletter Signups: Email address and name (if provided)
Information Collected Automatically:
- Analytics Data: Pages visited, time on site, referral source, device type, browser type, and IP address
- Cookies: Session cookies for functionality; analytics cookies for usage tracking (see Cookies section below)
Clients and Prospective Clients
When you engage us (or discuss engaging us), we collect:
- Contact & Engagement Records: Names, roles, email addresses, and correspondence with the people we work with on your side
- Contract & Billing Data: Company details, billing address, VAT number, invoices, and payment records
- Project Information: Details about your systems, tools, data sources, and workflows that are necessary to scope and deliver the work
Important: Your Business Data
Our engagements are built around systems and accounts you own. Where we access your business data (e.g., sales records, operational data) to build and test pipelines, reports, or automations, we do so as a data processor acting on your instructions. We access it to deliver the work; we do not copy it into systems of ours except transiently where the work requires it, and we do not use it for any other purpose. Where we act as a processor, our Data Processing Agreement applies.
Legal Basis for Processing (UK GDPR)
We process your personal data under the following legal bases:
- Contract: To deliver Services you have engaged us for, or to take steps you request before entering a contract (e.g., scoping calls, proposals)
- Legitimate Interests: To respond to inquiries, improve our Website and Services, prevent fraud, and ensure security
- Consent: For marketing communications (you can withdraw consent anytime)
- Legal Obligation: To comply with tax, accounting, and regulatory requirements
How We Use Your Information
Service Delivery:
- Responding to inquiries and scheduling calls
- Scoping, delivering, and supporting engagements
- Invoicing and account administration
Service Improvement and Analytics:
- Understanding how visitors use our Website so we can improve it
- Aggregated, non-identifying analysis of inquiries and engagements
Communication:
- Replying to your messages
- Sending engagement-related updates
- Sending marketing emails only where you have opted in (unsubscribe anytime)
Legal and Compliance:
- Maintaining records required by law
- Establishing, exercising, or defending legal claims
Data We Do NOT Use:
- We do not sell your personal data
- We do not share your data with third parties for their marketing
- We do not use client business data to train AI models
- We do not make automated decisions with legal or similarly significant effects about you
International Data Transfers
Some of our service providers process data outside the UK/EEA (typically in the United States). Where that happens, transfers are protected by:
- UK adequacy regulations or EU adequacy decisions, where applicable
- The UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses with the UK Addendum
- The EU-US / UK-US Data Privacy Framework, where the provider is certified
Your Privacy Rights
Under UK GDPR, you have the right to:
- Access: request a copy of the personal data we hold about you
- Rectification: ask us to correct inaccurate or incomplete data
- Erasure: ask us to delete your data ("right to be forgotten")
- Restriction: ask us to limit how we process your data
- Portability: receive your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw Consent: where processing is based on consent, withdraw it at any time
How to Exercise Your Rights:
Email support@just-automate-it.org with your request. We will respond within one month. We may need to verify your identity before acting on a request.
Right to Lodge a Complaint:
If you believe we have mishandled your data, you can complain to the UK Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
We would appreciate the chance to address your concerns first. Please contact us before going to the ICO.
Data Security and Protection Measures
Technical Measures:
- Encryption in transit (TLS 1.2+) and at rest (AES-256) for systems we operate
- Multi-factor authentication and least-privilege access to client systems
- Credential management via secure vaults; we never store client credentials in plain text
- Regular dependency scanning and patching
Organizational Measures:
- Security practices aligned to SOC 2 / ISO 27001 (see our Security & Compliance documentation)
- Confidentiality obligations for everyone who works with client data
- Access to client systems is removed promptly when an engagement ends
Limitations:
No method of transmission or storage is 100% secure. If a breach affecting your personal data occurs, we will notify you and the relevant authorities as required by law. See our Data Processing Agreement for processor breach notification commitments.
Security Reporting:
If you discover a security vulnerability relating to our Website or systems, please report it to support@just-automate-it.org.
Data Retention and Deletion
- Inquiries that don't become engagements: contact details and correspondence retained up to 2 years, then deleted
- Client engagement records: retained for the engagement plus up to 6 years (limitation periods for contract claims)
- Billing and tax records: retained 7 years as required by UK tax law
- Access to your systems: removed at the end of the engagement; any transient working copies of your business data are deleted when the work completes
- Marketing lists: until you unsubscribe or after prolonged inactivity
You may request earlier deletion at any time by emailing support@just-automate-it.org; we will comply unless we have a legal obligation to retain the data.
Cookies and Tracking Technologies
What Are Cookies?
Cookies are small text files placed on your device when you visit a website. We use them to make the Website work and to understand how it is used.
Types of Cookies We Use:
- Essential Cookies: Required for the Website to function (e.g., session management). These cannot be disabled.
- Analytics Cookies: Help us understand how visitors use the Website (pages visited, time on site, referral source) so we can improve it.
- Scheduling: If you book a call through our embedded scheduling tool (Calendly), it may set its own cookies subject to its privacy policy.
Managing Cookies:
You can control and delete cookies through your browser settings. Disabling analytics cookies does not affect your ability to use the Website.
Third-Party Services and Subprocessors
We use a small number of trusted service providers to operate our business:
- Supabase: database and backend services (US/EU, AWS)
- Vercel: website hosting and edge delivery (global, AWS)
- Resend: transactional email delivery (US)
- Calendly: call scheduling (US)
- Google Analytics: website analytics (global)
- Stripe: card payment processing, where used (US/EU)
- n8n: workflow automation, self-hosted (EU)
- AI providers (e.g., Anthropic, OpenAI): used in delivering automation work, typically through accounts you own; where we use our own accounts, no client personal data is submitted without your instruction
For the current list with compliance certifications, see our Subprocessors page. Where these providers process personal data on our behalf, we have data processing agreements in place.
Children's Privacy
Our Website and Services are intended for businesses and are not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact support@just-automate-it.org and we will delete it.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time.
Notification of Changes:
- For material changes: we will notify active clients by email and post a prominent notice on the Website at least 30 days before the changes take effect
- For minor changes: we will update the "Last Updated" date at the top of this page
The current version is always available at just-automate-it.org/privacy.
Questions
If you have any questions about this Privacy Policy or how we handle your data, contact us:
JUST AUTOMATE IT LTD
Email: support@just-automate-it.org
Website: https://just-automate-it.org