The AppliedWorkflow Lab Book a fit call

Privacy notice

How we use personal information

1. Who is responsible for your information

SmartLingo Ltd is the controller responsible for the personal information described in this notice. Privacy questions and rights requests can be sent to peter@appliedworkflowlab.com or to the registered office shown above.

2. What this notice covers

This notice explains how we use personal information relating to website visitors, prospects, clients, programme sponsors, participants, facilitators, contractors and other business contacts. A client may remain responsible for separate privacy information concerning its employees, systems and internal data.

3. Information we may collect

  • Business identity, role and contact details.
  • Enquiry, discovery, proposal and relationship records.
  • Contract, billing, payment and transaction information.
  • Participant, attendance, feedback and agreed workflow responsibility information.
  • Client-provided examples, process descriptions and project materials needed for agreed work.
  • Technical data used for website hosting, form processing, security and troubleshooting.
  • Supplier, facilitator and contractor due diligence and payment information.

4. Why we use information and our lawful bases

We use information to respond to enquiries, take requested steps before a contract, prepare proposals, deliver services, administer participants and sessions, issue invoices, protect confidential information and systems, meet legal obligations, improve delivery and maintain relevant business relationships.

Depending on the activity, we rely on contract, steps requested before entering a contract, legitimate interests, legal obligation or consent. Where we rely on legitimate interests, these may include operating and improving our services, protecting the business and communicating with relevant business contacts. You may object to direct marketing at any time.

5. Automated decision-making

We do not use website enquiry information for solely automated decisions that produce legal or similarly significant effects.

6. Cookies and tracking

We do not currently use advertising cookies, behavioural tracking or website analytics. Our hosting and form providers may process limited technical data needed for security and service delivery. We will update this notice and introduce appropriate consent controls before using non-essential cookies or tracking technologies.

Service providers and information sharing

We use selected service providers to operate the website and communicate with you. These currently include Netlify for website hosting, Formspree for enquiry form processing, and Microsoft 365 for business email and related communications.

We may also share relevant information with authorised facilitators and contractors, accounting and payment providers, professional advisers, insurers, regulators or authorities where legally required, or a genuine business successor subject to appropriate confidentiality and data protection arrangements.

We do not sell personal information.

International transfers

Some providers may process information outside the United Kingdom. Where UK data protection law requires safeguards for a restricted transfer, we use an applicable adequacy regulation, approved contractual safeguards or another lawful transfer mechanism.

AI tools and client information

We do not intentionally enter client confidential information or personal data into an external AI tool unless the tool, purpose, information boundary and safeguards have been agreed with the client.

  • Clients and participants should provide only the minimum information needed for the engagement.
  • Personal, regulated or sensitive information should be removed or anonymised wherever possible.
  • The approved tool and data boundary should be recorded in the engagement documents.
  • AI-assisted drafts and outputs remain subject to human review.
  • AI outputs are not treated as legal, regulatory, cybersecurity or other specialist advice.

Retention

  • Unsuccessful enquiry and prospect records: normally up to 24 months after the last meaningful contact.
  • Contracts, invoices and core transaction records: normally six years after the relevant financial or contractual period.
  • Participant and delivery administration records: normally 12 months after the engagement.
  • Temporary client working examples: normally deleted or returned within 90 days after final delivery, unless continuing support, legal requirements or written client instructions require otherwise.
  • Marketing suppression records: retained as necessary to respect an objection or unsubscribe request.

We may retain information for longer where reasonably necessary for legal obligations, disputes, insurance requirements, fraud prevention or the establishment, exercise or defence of legal claims.

Your rights

Depending on the circumstances, you may have rights to request access, correction, deletion, restriction, objection, data portability and information about automated decision-making. You may withdraw consent where consent is the lawful basis.

To exercise a right, email peter@appliedworkflowlab.com. We may need to confirm your identity before completing a request.

You may complain to the UK Information Commissioner's Office. More information is available at ico.org.uk/make-a-complaint.

Effective date and last updated: 3 August 2026.

Confidentiality

Responsible AI and confidentiality commitment

What we will do

  • Agree the team, tools, information boundaries and intended workflow before implementation.
  • Limit access to authorised people who are subject to confidentiality obligations.
  • Use the minimum client information reasonably required.
  • Avoid entering personal or confidential client information into third-party AI tools unless expressly approved and appropriately safeguarded.
  • Identify where human review, management approval or specialist advice is required.
  • Keep client-specific materials separate from generic templates and delivery methodology.
  • Notify the client promptly if a significant confidentiality or personal data incident affects the engagement.

What we ask clients and participants to do

  • Use only approved AI tools and accounts.
  • Do not paste passwords, credentials, unnecessary personal data, regulated data or trade secrets into AI tools.
  • Anonymise sensitive examples where possible.
  • Check material outputs for accuracy, completeness, suitability and bias.
  • Retain human ownership of decisions and external communications.
  • Obtain specialist advice where the use case requires it.

Methodology and client materials

The client retains ownership of its data, examples and confidential business information. The Applied Workflow Lab retains ownership of its generic methodology, templates, facilitation materials, workflow structures and know-how. Client-specific deliverables are licensed for the client's internal business use in accordance with the applicable Client Services Agreement.