Legal
Privacy Policy
1. Who we are
Head of AI Ltd is the controller of your personal data. We are a company registered in England and Wales, company number 15915080.
- Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
- Email: [email protected]
- Phone: 020 8102 0620
- ICO registration number: ZB836023
In this policy, “we”, “us” and “our” mean Head of AI Ltd. We have not appointed a Data Protection Officer because the law does not require one for a business of our size and type. Questions about this policy or your data go to the email above.
2. Whose data this covers and what we collect
This policy covers website visitors, clients and prospective clients, business contacts we reach out to, suppliers, and partners. It does not cover job applicants or consultants applying to work with us: our Candidate Privacy Policy covers them.
| Type of data | Examples |
|---|---|
| Identity | Name, job title, employer, LinkedIn profile URL |
| Contact | Work email, work phone number, business address |
| Professional | Company, sector, company size, role, public professional background |
| Communications | Emails, LinkedIn messages, call notes, meeting bookings and recordings (with your agreement) |
| Commercial | Services you buy or ask about, proposals, contracts, invoices |
| Financial | Payment details for invoicing (we do not store card numbers) |
| Technical | IP address, browser, device, pages viewed, how you arrived at our site |
| Marketing | Your marketing preferences, and whether you opened or clicked our emails |
| AI chat | What you type into the AI use-case chat on our website |
We do not set out to collect special category data, such as health, ethnicity or religious beliefs, or data about criminal convictions. Please do not include it in messages or the chat tool.
3. Where we get your data
Most data comes from you. Some comes from public sources and business data providers, so you may hear from us before you have contacted us.
- From you: when you fill in a form, book a call, email or message us, use the website chat, or work with us.
- From our website: cookies and similar tools record how you use the site, with your consent. See section 6.
- From public sources: company websites, LinkedIn profiles, Companies House, and news and industry publications.
- From business data providers and agencies: lead-generation and data-enrichment services we use to find and verify work contact details, such as Clay and Lusha.
- From people you work with: a colleague or introducer who refers you to us.
When we get your details from somewhere other than you, we tell you within one month, usually in our first message. That message links to this policy and tells you how to opt out.
4. How we use your data and our lawful bases
We only use your data where UK GDPR gives us a lawful basis. The table shows each use and the basis we rely on.
| What we do | Lawful basis |
|---|---|
| Answer your enquiries, book calls and send proposals | Steps before a contract, or legitimate interests (responding to business enquiries) |
| Deliver our services, including matching you with a Head of AI consultant | Contract |
| Invoice, collect payment and keep accounts | Contract and legal obligation |
| Contact businesses that may benefit from our services, by email or LinkedIn | Legitimate interests (growing our business through relevant B2B outreach) |
| Send newsletters and updates to clients and contacts who have not opted out | Legitimate interests, and consent where the law requires it (see section 5) |
| Measure website use and advertising, and identify which organisations visit | Consent, given through our cookie banner |
| Run the AI use-case chat on our website | Legitimate interests (answering your question and following up if you ask us to) |
| Keep our systems secure and prevent misuse | Legitimate interests |
| Comply with the law and deal with legal claims | Legal obligation, or legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against your rights. We only contact people in roles that our services are relevant to, at their work address, and every message tells you how to opt out. You can ask for a copy of this assessment.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Marketing and opting out
You can stop our marketing at any time, free of charge. Use the unsubscribe link in any email, reply “stop” to any message, or email [email protected].
- Companies and LLPs: we may email people at their work address about services relevant to their role, under our legitimate interests.
- Sole traders and partnerships: UK law treats these like individuals. We only send them marketing emails with consent, or if they are existing customers who have not opted out.
- Existing clients and contacts: we may send updates about similar services unless you opt out.
When you opt out, we keep your name and email on a suppression list. This stops you being contacted again, including if your details reach us from another source.
We do not sell your personal data, and we do not share it with other companies for their own marketing.
6. Cookies, website analytics and the AI chat
We only use non-essential cookies if you agree to them in our cookie banner. You can change your choice at any time. Our Cookie Policy lists every cookie and provider.
- Analytics: Google Analytics and Microsoft Clarity show us how the site is used.
- Advertising: LinkedIn, Google Ads and Microsoft Advertising measure our ads.
- Visitor identification: with your consent, Claydar uses your IP address to identify the organisation you are visiting from and records the pages viewed. We use this to follow up on business interest. It can link a visit to you if you are already one of our contacts.
- AI use-case chat: if you use the chat on our website, what you type is sent to our chat service and an AI model to generate a reply. We keep chat logs to answer you and improve the service. Do not enter confidential or personal information you do not want us to hold.
We use Cloudflare to protect and speed up the website. It processes IP addresses for security.
7. Who we share your data with
We share data only with the people and suppliers who need it to help us run the business. Suppliers act on our instructions under written contracts and may not use your data for their own purposes.
| Who | Why | Examples |
|---|---|---|
| Head of AI consultants | To deliver services to clients and prepare for client calls | Our fractional Heads of AI, under confidentiality terms |
| Sales and outreach tools | Find contacts, send outreach, manage our pipeline | LeadLab (LinkedIn outreach), Clay and Lusha (contact data), Pipedrive (CRM) |
| Email and communications | Send email and newsletters, book meetings, sign contracts | Google Workspace, Superhuman, MailerLite, Calendly, Slack, DocuSign |
| Website and forms | Host the site, run forms and connect systems | Our UK hosting provider, Cloudflare, Gravity Forms, Zapier |
| Analytics and advertising | Only with your cookie consent | Google, Microsoft, LinkedIn, Claydar |
| AI chat | Run the website chat | Amazon Web Services, Anthropic (Claude) |
| Professional advisers | Legal, accounting and insurance | Our accountants, lawyers and insurers |
| Authorities | Where the law requires it | HMRC, the ICO, the police or courts |
If we sell or merge all or part of our business, the buyer may receive your data and use it as this policy describes.
8. International transfers
Some of our suppliers store or access data outside the UK, mainly in the US and the European Economic Area. We only transfer data where one of these protections applies:
- the country has a UK adequacy decision, which covers the EEA;
- the US recipient is certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”);
- we have signed the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.
Email [email protected] if you want details of the protection used for a particular transfer.
9. How long we keep your data, and how we protect it
We keep data only as long as we need it, then delete or anonymise it.
| Data | How long |
|---|---|
| Client records, contracts and invoices | 6 years after the contract ends (tax and legal claims) |
| Enquiries and proposals that did not lead to work | 2 years from our last contact |
| Prospect data from outreach, with no response | 2 years from our last contact |
| Call recordings and transcripts | 12 months, unless needed for a client project |
| AI chat logs | 12 months |
| Website analytics | As set out in our Cookie Policy |
| Suppression list (people who opted out) | For as long as we do outreach, so we don’t contact you again |
We protect data with access controls, two-factor sign-in, encrypted connections and contracts with our suppliers. Only people who need data for their work can see it. If a breach puts your rights at risk, we will tell you and the ICO where the law requires it.
10. Your rights, complaints and changes
Under UK GDPR you have the right to:
- get a copy of the data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use it;
- object to our use of it, including an absolute right to object to direct marketing;
- receive data you gave us in a portable format;
- withdraw consent at any time, where we rely on consent.
Email [email protected] to use any of these rights. It is free, and we will reply within one month. We may ask you to confirm your identity first.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk, on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
We review this policy at least once a year and update it when our use of data changes.