Privacy Policy

1. Who we are and how to contact us

Minutes Agency Ltd (‘Minutes’, ‘we’, ‘us’ and ‘our’) is a company registered in England and Wales, number 13948866. Our registered office is 103 Goldhawk House, 10 Beaufort Square, London, England, NW9 5SW. We operate from the UK. This policy explains our handling of personal information under the UK GDPR, the Data Protection Act 2018 as amended, and applicable privacy and electronic communications law.

Contact us about privacy, your rights or a complaint at [email protected], on +44 161 524 2122, or by post to our registered office, marked “Privacy”.

2. When we are controller or processor

Minutes is a controller when deciding how to handle information for our own business, including website enquiries, prospective clients, business contacts, service accounts, billing and legal administration. The sections below explain that processing.

When a client uses TheMinutes App, CRM, marketing or automation services to handle its own customers’ or contacts’ data, the client normally determines the purposes and acts as controller. We act as its processor and follow its documented instructions under the Data Processing Agreement in our Terms & Conditions. If the client is itself a processor, we act as its subprocessor under the authorised instructions. The client’s privacy notice explains its purposes, lawful basis and retention choices. This policy does not replace that notice or a binding client processing agreement.

If your request concerns data held for one of our clients, contact that organisation first. If you contact us, we will refer the request to the relevant client and assist it as required. We do not use client customer data for our own advertising or to train general-purpose AI models.

3. Information we handle and its sources

• Contact and enquiry information: your name, role, business name, email address, telephone number and information you provide through forms, bookings, email, messages, meetings or service enquiries. This includes questions, recent conversation context and business needs you submit to the website FAQ assistant or plan advisor.
• Account and project information: user identifiers, account contact details, permissions, proposals, instructions, project communications, deliverables and support correspondence.
• Contract and payment records: billing contacts, invoice details, subscription and transaction references, payment status and records of agreements. Payment providers handle payment credentials through their own checkout systems.
• Website and security information: IP address, device and browser information, requested pages, access times, error and security logs, and cookie or similar identifiers where the relevant technology operates.
• Preferences: marketing choices, consent records, objections, unsubscribe requests and the limited information needed to respect those choices.

We receive information directly from you and from your use of our services. We may also receive business contact information from your employer, an authorised colleague, a referral or a publicly available business source such as a company website. Where we obtain it indirectly, we provide the required privacy information within the applicable time limit, normally within one month and at the latest when first contacting you or first disclosing it, unless a legal exception applies. We will explain the relevant source if you ask.

Please provide only information needed for your enquiry or service. Our website and business services are aimed at organisations and adult business users. Processing involving children, health information, other special category data or criminal offence data is outside our standard client instructions and requires an expressly agreed lawful scope and additional safeguards.

4. Purposes and lawful bases

The lawful basis depends on the purpose and our relationship with the person. Where we rely on legitimate interests, we assess necessity and the effect on your rights. You can ask us about that assessment and object to the processing.

• Answering enquiries and arranging services: our legitimate interests in responding to business enquiries and developing business relationships. If you are personally entering a contract, such as a sole trader, processing necessary to take steps at your request before that contract or perform it uses the contract basis.
• Delivering and supporting services: contract where the individual is a party to the contract; for a company’s staff and representatives, our legitimate interests in administering the business relationship, coordinating work and providing support.
• Billing, accounting and compliance: legal obligation for statutory accounting, tax and other required records; legitimate interests for managing payments, recovering debts, obtaining advice and establishing, exercising or defending legal claims.
• Security and service administration: our legitimate interests in protecting accounts, preventing fraud and misuse, investigating faults and keeping services reliable, and legal obligation where a specific security or disclosure duty applies.
• Website assistant and plan suggestions: our legitimate interests in answering the questions you choose to submit and suggesting relevant business services. The optional AI features process your submitted question or business description, relevant recent conversation or selected needs, and public service information to generate a response. You can contact us directly instead.
• Marketing: consent where required by electronic marketing law, or legitimate interests for lawful business marketing where that law permits it without consent. This depends on the recipient and channel. Every marketing message must offer an appropriate way to stop further marketing.
• Advertising and optional website measurement: consent where required for cookies, similar technologies and the associated personal data processing. A legitimate interests assessment does not replace consent required by electronic communications law. Any permitted statistical exception must meet all of its legal conditions.

Providing contact, contract or billing information may be necessary to answer a request, enter or perform a contract, or meet a legal duty. If you do not supply necessary information, we may be unable to provide the requested service. Optional marketing consent is separate from purchasing a service. If we propose a new use that requires further information or consent, we will address that before the new processing starts.

5. Service providers and other recipients

Access is limited to people and providers who need information for the relevant purpose. Our team is based in the UK. Our core operating tools are GoHighLevel, Notion and self-hosted n8n on UK-based hosting. The information involved depends on the service and the client’s instructions.

• HighLevel Inc. (GoHighLevel or GHL) provides the platform underlying TheMinutes App, CRM and related communication features. See its Data Processing Agreement and subprocessor list.
• Notion Labs, Inc. provides project information storage and collaboration. Its privacy and data processing information links to its DPA, privacy policy and subprocessor list.
• We operate n8n ourselves on UK-hosted infrastructure for agreed workflows. The hosting provider can process information stored or transmitted through that infrastructure. Self-hosting n8n does not mean its software developer automatically receives workflow content. A connected service receives the data sent to it by the workflow.
• Website hosting and security providers support delivery of this website. The website also includes Google Tag Manager, Google Analytics and Google Ads tags for measurement and advertising, and links to Stripe for payment checkout. These functions are separate from our core project tools. Google’s Privacy Policy and Stripe’s Privacy Policy explain their handling of information in the roles they perform.
• OpenAI provides the API used by the website FAQ assistant and plan advisor. If you use those features, the question, business description or relevant answers and conversation context are sent to OpenAI to generate a response. This is separate from a client authorising an AI connection in an n8n workflow. See OpenAI’s Data Processing Addendum and API data controls information.
• Professional advisers, accountants, insurers, regulators, courts or law enforcement may receive relevant information where needed for advice, legal claims, a legal duty or a lawful request. If the business is restructured or transferred, necessary information may be shared subject to confidentiality, appropriate safeguards and applicable notice requirements.

We do not sell personal information. Where a provider processes data on our behalf, appropriate processor terms are required. Some providers also act as independent controllers for their own account, payment, security or legal purposes. For client customer data, appointments and changes to subprocessors are governed by the client DPA and its authorisation procedure. Ask us for the providers, purposes and locations relevant to your account.

6. International processing

Our team and n8n hosting are in the UK. HighLevel, Notion, OpenAI and other service providers may process information outside the UK, including in the United States and other locations identified in their supplier information. HighLevel also identifies support processing in India. UK hosting of an automation does not determine where a connected service, cloud platform or its support staff processes data.

A restricted transfer requires a lawful mechanism. Depending on the recipient, this may be a UK adequacy regulation, including the UK Extension to the EU-US Data Privacy Framework only where the recipient and transfer qualify, or appropriate contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses. Required transfer risk assessments and supplementary safeguards must also be addressed. EU transfer rules apply where relevant. Supplier statements of GDPR compliance do not remove these requirements or establish a UK-only storage location.

Contact us for information about the countries and safeguards relevant to your data or to request a copy of the applicable safeguards. We may redact information needed to protect confidential commercial information or other people’s data while still explaining the protection available to you.

7. How long information is kept

We keep personal information only for as long as needed for the stated purpose, taking account of the relationship, legal requirements, limitation periods, sensitivity and deletion arrangements. Different records have different retention needs:

• Enquiries and prospective client records are kept while the enquiry or relevant business discussion remains active, then reviewed for deletion unless a documented continuing purpose justifies retention.
• Service accounts and project correspondence are kept for the relationship and any justified period needed to complete the work, deal with queries or establish, exercise or defend legal claims.
• Invoices, tax, accounting and contract records are kept for the applicable statutory period or a justified claims period. Those periods do not justify keeping every CRM contact or marketing record for the same length of time.
• Marketing records are reviewed for relevance and kept only while there is a lawful reason to contact you. After an objection or unsubscribe request, a minimal suppression record may be kept to prevent further unwanted marketing.
• Security logs and workflow execution records are kept for proportionate operational, troubleshooting and security periods. Backups follow their deletion cycles and must remain protected and unavailable for ordinary use while awaiting erasure.
• Website AI requests can be subject to OpenAI’s provider-side retention, including default abuse-monitoring logs of up to 30 days, subject to the exceptions described in its data controls information and applicable account settings. Choosing not to store a generated response does not remove that separate retention. Avoid including sensitive information or other people’s personal data in a question.
• Client customer data follows the client’s retention instructions and the return or deletion provisions of the DPA, including obligations applying to subprocessors and any legally required retention.

Ask us for the retention period or criteria applicable to a particular record, account or workflow. We may preserve relevant information while a legal obligation or actual dispute requires it, limiting access and use to that purpose.

8. Your data protection rights

Depending on the processing and legal conditions, you may request access to your personal information, correction, erasure, restriction of processing or a portable copy.

Your right to object

You may object to processing based on legitimate interests on grounds relating to your situation. You have an absolute right to object to use of your personal information for direct marketing, including related profiling. Contact us using section 1 or use the unsubscribe option in a marketing message.

Where we rely on consent, you can withdraw it at any time by contacting us or using the relevant unsubscribe or preference option. Withdrawal does not affect the lawfulness of processing before it. Rights have conditions and exceptions; if we cannot comply with a request, we will explain the reason and your complaint options.

Send requests using the contact details in section 1. We normally respond within one month, free of charge, subject to the time limits and exceptions permitted by law. If a lawful extension is necessary, we will explain it within the initial response period. We may seek information reasonably necessary to verify your identity or clarify a request. Please avoid sending unnecessary identity documents or sensitive information.

9. Cookies, analytics and advertising

Cookies and similar technologies can store or read information on your device. Strictly necessary technologies support functions such as security, service delivery and remembering an expressed choice. Google Tag Manager manages tags; Google Analytics measures website activity; Google Ads tags can measure advertising responses and support advertising features. These tools can involve device identifiers, page visits, interaction information and disclosures to Google. The exact technologies depend on the tags, settings and features in operation.

Advertising technologies, and analytics that do not meet a specific legal exception, require prior consent. Consent must be a clear choice and must be capable of being withdrawn as easily as it is given. Visiting this website or reading this policy does not give that consent. A privacy notice and browser settings alone do not replace the consent controls required by law.

You can block or delete cookies through your browser, although this can affect necessary functionality and does not stop every form of data collection. Google provides information about its cookies, their purposes and lifetimes and controls through My Ad Center. Cookie lifetimes and settings can vary by service and configuration. Contact us for the current information about technologies on our site or to raise a consent concern. Choices on Google’s services do not replace choices required for this website.

If you follow a link to Stripe, a social network or another external site, that provider’s notice explains its technologies and processing. The rules for a client’s own website or campaigns must be addressed by that client, with our assistance where agreed.

10. Automation and connected AI services

The website FAQ assistant answers service questions, and the plan advisor interprets the needs you submit and explains service suggestions. Those suggestions are informational and do not decide legal rights or eligibility for an essential service. AI responses can contain errors; contact us to confirm contractual details. The OpenAI processing for these website features is described in sections 3 to 7.

n8n and CRM features can automate agreed steps such as routing an enquiry, updating a record or sending a message. The data and recipients depend on the workflow. Any AI or external service connected to a workflow needs a documented purpose, an appropriate lawful basis, suitable provider terms, any necessary international transfer safeguards and, for client data, the authorisation required by the DPA. UK hosting of n8n does not extend to an external AI provider.

A solely automated decision with legal or similarly significant effects on a person is outside our standard service instructions. Any proposed use of that kind requires a separate assessment, the information required by law about the decision and its effects, and applicable safeguards, including routes for human intervention or challenge where required.

11. Security

Appropriate technical and organisational protection is required for the risks involved. This includes controlling access, protecting credentials and transfers, securing configurations, managing retention and incidents, and reviewing supplier protections. The client DPA sets out our contractual security duties for client personal data. Contact us for the security information relevant to your service. We will address personal data breaches and make notifications as required by our role and applicable law.

12. Complaints

If you are concerned about how Minutes handles personal information, contact us using section 1 and explain the issue and the outcome you are seeking. You can complain by email, telephone or post. We will acknowledge a data protection complaint within 30 days of receipt, investigate appropriately, keep you informed and communicate the outcome without undue delay. If it concerns processing for a client, we will explain its role and refer the matter as appropriate.

You also have the right to complain to the UK Information Commissioner’s Office. See the ICO complaints service or call 0303 123 1113. Contacting us first can help resolve the issue and does not remove your right to approach the regulator or seek a legal remedy.

13. Changes to this policy

We will update this policy when our processing or legal requirements change and show the revision date above. Where required, we will draw material changes to your attention before new processing begins. Updating this notice does not itself create consent, change a client contract or authorise a new subprocessor.