Privacy Policy

1.Who we are

Autonoma ("Autonoma", "we", "us", or "our") provides AI-powered digital employee services to businesses in the United Kingdom, operating from London and online at autonoma.cc.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Autonoma is the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator.

2.What data we collect

We only collect personal data we need to provide and improve our services. Depending on how you interact with us, this includes:

• Contact form data — your name, business name, email address, enquiry type, and message, submitted when you enquire through our website.
• Newsletter data — your email address, if you choose to subscribe to updates from us.
• Booking data — details you provide when scheduling a call with us (such as your name and the time you select).
• Technical data — limited information your browser sends automatically, such as approximate location and device type, used only to keep the site secure and working.

We do not knowingly collect special category data (such as health or biometric information) and ask that you do not submit it through our forms.

3.How and why we use your data

We process personal data only where we have a lawful basis to do so under Article 6 of the UK GDPR:

• To respond to your enquiry and provide our services — on the basis of taking steps at your request prior to entering a contract, and the performance of that contract.
• To send you our newsletter — on the basis of your consent, which you may withdraw at any time using the unsubscribe link in any email.
• To carry out business-to-business outreach — on the basis of our legitimate interests in growing our business, balanced against the recipient's rights (see section 5).
• To secure and improve our website — on the basis of our legitimate interest in operating a safe, functional service.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.

4.Service providers who process data for us

We use a small number of trusted third-party providers ("processors") who handle personal data on our behalf, under contract and only on our instructions:

• Google Workspace — email, file storage, and our internal record of enquiries and contacts.
• Formspree — receives and delivers submissions from our website contact form.
• Calendly — manages call bookings made through our site.
• Instantly.ai — supports our business-to-business email outreach (see section 5).

Each provider is bound by a data processing agreement and may only use the data to deliver its service to us.

5.Business-to-business outreach

As part of our lead generation services and our own marketing, we may send cold outreach emails to business contacts using Instantly.ai. This is carried out on the basis of our legitimate interests, and is limited to corporate recipients in a business capacity.

Every outreach email identifies us clearly and includes a simple way to opt out. If you ask us to stop contacting you, we will honour that request promptly and retain only the minimum information needed to ensure we do not contact you again.

6.Sharing and disclosure

We do not sell your personal data. We share it only with the processors listed above, and where we are required to do so by law, by a regulator, or to establish, exercise, or defend legal claims.

7.International transfers

Some of our providers are based outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law — such as the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision — to ensure your data remains protected.

8.How long we keep your data

We keep personal data only for as long as necessary for the purpose it was collected:

• Enquiries that do not become clients — up to 24 months, then deleted or anonymised.
• Client records — for the duration of our engagement and for up to 6 years afterwards, to meet legal and accounting obligations.
• Newsletter subscriptions — until you unsubscribe.
• Opt-out records — retained as long as needed to respect your request not to be contacted.

9.Your rights

Under UK data protection law, you have the right to:

• Be informed about how your data is used (this policy);
• Access a copy of the personal data we hold about you;
• Have inaccurate data corrected;
• Have your data erased in certain circumstances;
• Restrict or object to our processing of your data;
• Request the transfer (portability) of your data; and
• Withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact us at our data contact (enable JavaScript to view). We will respond within one month. There is normally no charge.

10.Cookies and tracking

Our website does not use advertising or third-party tracking cookies. We load a web font from Google Fonts, which means your browser makes a request to Google's servers to retrieve the font; no cookies are set by us for analytics or marketing. Any third-party tools you reach from our site (such as the booking page) have their own privacy policies.

11.Complaints

If you have a concern about how we handle your data, please contact us first so we can try to resolve it. You also have the right to complain to the ICO at ico.org.uk or by calling its helpline.

12.Changes to this policy

We may update this policy from time to time. When we do, we will revise the "last updated" date at the top of this page. Significant changes will be communicated where appropriate.