Legal Document

Privacy Policy

Effective date: 25 June 2026 · Version 1.0

Section 01

Who We Are

AI by EDM is an AI architecture firm operating as part of Easy Data Marketing, based in the United Kingdom. We design, build, and deploy bespoke AI systems — including generative AI, agentic systems, and intelligent automation — for businesses.

Data Controller: Easy Data Marketing (trading as AI by EDM) · 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom · contact@easydatamarketing.com

This Privacy Policy explains how we collect, use, store, and protect personal data when you visit our website or engage with our services. It applies to website visitors, enquirers, and clients.

Section 02

What Data We Collect

Information you provide directly

Name and email address (via contact forms or email enquiries)
Company name, job title, and industry
Project details and requirements you share with us
Any personal data included in documents or files you send us

Information collected automatically

IP address and approximate location
Browser type, device type, and operating system
Pages visited, time on page, and referral source
Cookie and tracking data (see Section 10)

Data processed as part of AI project delivery

When we build AI systems for clients, we may process personal data on their behalf as a Data Processor. This is governed by a separate Data Processing Agreement (DPA) with each client.

Section 03

How We Use Your Data

Purpose	Description
Responding to enquiries	To reply to messages, assess project fit, and provide information about our services
Delivering services	To build, test, and deploy AI systems as agreed in client contracts
Project communication	To keep clients updated on project progress and decisions
Improving our website	To understand how visitors use our site and improve user experience
Legal compliance	To meet our obligations under applicable law
Marketing communications	To send relevant updates where you have consented or we have a legitimate interest

We do not sell your personal data to any third party under any circumstances.

Section 04

Legal Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

Basis	When We Use It
Contractual necessity	Processing required to deliver services you have engaged us for
Legitimate interests	Analytics, website security, and business development communications with prospects where our interests do not override your rights
Consent	Marketing emails and optional cookies where you have opted in
Legal obligation	Retaining financial records or responding to regulatory requests

Section 05

AI Systems & Personal Data

As an AI architecture firm, we build systems that may process personal data. The following principles apply to all AI projects we undertake:

Data minimisation: We design AI systems to use only the minimum personal data necessary to achieve the stated purpose.
Purpose limitation: Data used to train or operate an AI system will not be used for any purpose beyond what is agreed in the client contract and DPA.
Security by design: AI systems are built with appropriate access controls, encryption, and audit logging from the outset.
Human oversight: Where AI systems make or influence decisions affecting individuals, we build in human review mechanisms unless otherwise agreed in writing.
Client data ownership: All data provided by clients for AI system development remains the property of the client. We do not retain it after project completion unless contractually required.

If you are a client and want to understand how personal data is handled within a specific AI system we have built for you, please refer to your Data Processing Agreement or contact us directly.

Section 06

Third-Party Services

We use the following categories of third-party services which may process personal data:

AI model providers (e.g. OpenAI, Anthropic, Google) — for AI system development and API access
Website analytics (e.g. Google Analytics) — for understanding website traffic
Email and communication tools — for project communication
Cloud hosting providers — for website and system infrastructure

Each provider is subject to their own privacy policy and data processing terms. We only use providers who offer adequate data protection safeguards.

Where AI model providers process personal data as part of building client systems, appropriate data processing agreements are in place.

Section 07

International Data Transfers

Some third-party providers, particularly AI model providers, may transfer and process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, which may include:

UK Adequacy Regulations for recognised countries
Standard Contractual Clauses (SCCs) approved by the ICO
Other legally recognised transfer mechanisms under UK GDPR

You may request details of the specific safeguards in place by contacting us.

Section 08

Data Retention

Data Type	Retention Period
Enquiry and contact form data	2 years from last contact
Client contract and project data	6 years (Limitation Act 1980)
Financial and billing records	7 years (HMRC requirement)
Marketing consent records	Until consent withdrawn, then 1 year
Website analytics data	26 months (Google Analytics default)
Client data processed for AI systems	Deleted upon project completion unless contractually required otherwise

Section 09

Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate or incomplete data
Right to erasure — request deletion of your personal data (subject to legal obligations)
Right to restrict processing — request that we limit how we use your data
Right to object — object to processing based on legitimate interests or for direct marketing
Right to data portability — receive your data in a structured, machine-readable format
Right to withdraw consent — withdraw any consent you have given at any time

To exercise any right, contact us at contact@easydatamarketing.com. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data lawfully.

Section 10

Cookies

Our website uses cookies. Please refer to our Cookie Policy for full details of the cookies we use and how to manage your preferences.

Section 11

Children's Privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has submitted personal data to us, please contact us and we will delete it promptly.

Section 12

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Updates will be posted on this page with a revised effective date. We encourage you to review this page periodically.

For significant changes, we will notify active clients directly by email.

Section 13

Contact Us

AI by EDM (part of Easy Data Marketing)
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
United Kingdom

Email: contact@easydatamarketing.com