Privacy Policy

This policy explains how Graft ("we", "us") collects, uses, and protects personal data when you use our website or services. We are the data controller for the information described here. We are based in Nottingham, UK, and process data in line with UK GDPR and the Data Protection Act 2018.

What we collect

We only collect what we need to respond to you and run our services:

• Contact details you give us — your name, email, company, and the contents of any message or enquiry you send through our contact form or booking form.
• Automation audit responses — the answers you provide in our online audit tool, used to generate your results. You can complete the audit without giving an email address.
• Usage data — basic, privacy-respecting analytics about how the site is used (pages viewed, approximate region, device type), collected to understand and improve the site.

How we use it

• To reply to your enquiry and provide the service or call you requested.
• To generate and, if you ask us to, send your automation audit results.
• To improve our website and services.
• To send you updates only where you have asked to receive them. You can unsubscribe at any time.

Lawful basis

We rely on legitimate interests (responding to enquiries and running our business), consent (for any marketing emails and non-essential cookies), and performance of a contract where you become a client.

Who we share it with

We do not sell your data. We share it only with the service providers that help us operate, under appropriate agreements. These include our hosting, database, and email delivery providers. Some providers may process data outside the UK; where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or equivalent.

How long we keep it

We keep enquiry and client data for as long as needed to provide our services and meet legal obligations, then delete or anonymise it. Audit responses and analytics are retained only as long as they are useful.

Your rights

Under UK GDPR you have the right to access, correct, or delete your data, to object to or restrict processing, and to data portability. To exercise any of these, contact us through the form on our contact page. You also have the right to complain to the Information Commissioner''s Office (ICO) at ico.org.uk.

Cookies

We use a small number of cookies and similar technologies. See our Cookies Policy for details and how to control them.

Changes

We may update this policy from time to time. The date at the top shows when it was last changed.

Contact

For any privacy question or request, please use our contact form and we will respond within one working day.