This policy explains how Qualforge Ltd ("Qualforge", "we", "us") collects and uses personal data. It is written to be read, not skimmed, and it says what actually happens.
It covers five different situations, and it matters which one you are in.
We handle personal data in line with UK data protection law, being the UK GDPR and the Data Protection Act 2018, and with the Privacy and Electronic Communications Regulations, which set separate rules for marketing by email, text and telephone.
We act in two different roles, and it matters which one applies to you.
We are the data controller for the personal data described in most of this policy: information you give us when you visit this site, request an audit, book a call, email us, or become a client, the information we need to run your account and take payment, the recording of a call you make to one of our own numbers, and the information we hold about businesses we approach about our own services.
We are a processor, not a controller, for the personal data inside a client's own system. When a business becomes our client, we build and run a system that handles that business's own customers and enquirers. Those records belong to our client. Our client decides who is in them and why they are contacted. We process them only on our client's instructions, under a written data processing agreement that forms part of our client agreement. If you are a customer or enquirer of one of our clients and you want to exercise a data protection right, the business you contacted is the controller, and we will pass any request you send us to them.
If we approached your business about our service and you had not been in touch with us first, we are the controller of the information we hold about you. This section is the information the law says we owe you, because we did not get your details from you.
The Privacy and Electronic Communications Regulations, usually called PECR, are a separate set of rules from the UK GDPR. They govern marketing by email, text message and telephone. Some of them turn on the legal form of your business, so the rule that applies to you may not be the rule that applies to the business next door.
The Information Commissioner divides subscribers into two groups.
A Scottish partnership is a corporate subscriber, and it appears on no public register. That means a business we cannot classify is not treated as fair game. Where we cannot establish the legal form of a business, we do not email it and we do not text it. It stays unclassified until a person classifies it.
Every marketing message we send identifies Qualforge Ltd as the sender, gives you a free and easy way to stop, and links to this page.
A marketing telephone call is governed by a different rule again, and that rule applies whatever the legal form of your business.
Before we call a number, we screen it against the Telephone Preference Service register and the Corporate Telephone Preference Service register. If a number is on either register, we do not make a marketing call to it. We will still call you if you have asked us to, for example to take a call you booked with us or to answer something you got in touch about, and we keep a dated record of that request. We do not use automated dialling, and we do not send recorded marketing calls.
We also keep our own do not call record, and we check it before we call. If you tell us not to ring you again, we add your number to it. That is enough on its own, whether or not your number is registered anywhere, and you do not need to give a reason.
To be taken off our calling list, say so on the call, or email team@qualforge.co.uk with the number you want removed. We record it against the details we hold for you, and we stop ringing that number.
One thing to be straight about, because it affects what you should tell us. We match our records on the details we are given. So if it is a telephone number you want stopped, give us the number. If it is an email address, give us the address. If you want us to stop altogether, give us both and say so, and we will record it against each of them.
We do not send cold text messages. If you have never been in touch with us and never spoken to us, we will not text you.
We will only text you if one of these has already happened, and we keep a dated record of which one it was.
Even then we keep it short. A text refers to the conversation it follows, so you know why you are getting it. We send at most three texts after any one of those, unless you reply and carry the conversation on. We text on weekdays only, between 8am and 6pm. Every text says who it is from and tells you how to stop.
Reply STOP to any text and we stop texting you. We treat it as telling us to stop calling and emailing you as well, unless you say otherwise, and a person applies that to the records we hold for you.
If you telephone one of our numbers, your call may be handled by an automated agent rather than by a person, and the call is recorded.
We keep four things: a recording of the call, a written transcript of it, a short summary of what was discussed, and the time the call started, the time it ended and how long it lasted.
We use them to act on what you asked for, to check what was actually said if there is ever a question about it, and to check call time against what is billed. We do not use them for anything else.
How long we keep them. The recording, 180 days from the date of the call. The transcript and the summary are kept with the record of your business and are deleted with it. The times are kept for twenty four months, because that is what a billing question is answered from.
Our lawful basis is that we are taking steps at your request before entering into a contract, under Article 6(1)(b), for the substance of what you asked for. For keeping the recording itself we rely on our legitimate interests under Article 6(1)(f), the interest being an accurate record of what was said.
If you would rather not be recorded, or would rather speak to a person, say so and we will deal with you another way. You can say it on the call, or email us. You can also ask us for a copy of a recording, or ask us to delete one, using the details at the end of this page.
The call is carried and converted between speech and text by Retell AI, Inc., which acts as our processor under a data processing agreement we have signed. The telephone connection is provided by Twilio. Both appear in the table under "Who we share it with" below.
Our clients use our AI agents to answer their calls and messages, to follow up enquiries, and to follow up quotes after a visit. If you enquired with one of our clients and an agent then called, texted or emailed you, it did so on that business's behalf, from that business's number or address, in that business's name, and about that business's work. The business is the controller of your data. We are its processor.
Where a call to or from one of those agents is recorded, the recording, the transcript and the summary belong to that business, and its own privacy notice governs them.
Every message carries a way to opt out. If you opt out by any route, including replying STOP, using an unsubscribe link, or simply saying so on a call, we record it and we stop contacting you on every channel, not only the one you used. Where a channel is not yet joined up automatically, a person checks the record before you are contacted again, so the answer to you is the same either way. We keep the minimum record needed to keep honouring that opt-out, because deleting it would allow you to be contacted again.
If you are contacted after opting out, tell us and we will stop it and tell you what went wrong.
To exercise any data protection right, contact the business you enquired with. You can also contact us and we will pass it on without delay.
Where we rely on your consent, you can withdraw it at any time, and withdrawing it is as easy as giving it. Withdrawing consent does not affect anything we did before you withdrew it.
We do not sell your personal data. We do not use any personal data held inside a client's system to train or improve any general purpose AI model.
One of our agents can score an enquiry, so that the business receiving it can decide who to ring back first. That score changes the order of a call list. It does not decide anything about you, and a person decides what happens next. We do not make decisions about you by automated means alone that produce legal effects or that similarly significantly affect you.
We use third party providers to run our business. We name them rather than describing them in general terms. Each table below says what the provider does with your data, where it processes it, and what protects it if it leaves the United Kingdom.
| Provider | What it does with your data | Where it processes it | What protects it |
|---|---|---|---|
| Hetzner Hetzner Online GmbH |
Provides the server each client's system runs on, and the separate storage that holds its backups. Hetzner provides the machine. It does not look inside it. | Germany, inside the European Union. The server sits in Hetzner's Falkenstein region, and our agreement with them commits to processing only within the European Union or the wider European Economic Area. | Your data stays in the EU, so no international transfer safeguard is needed. We concluded a data protection agreement with Hetzner on 27 August 2026. Note what that does and does not cover. Hetzner secures the building, the network and the machine. Everything inside the server is ours to secure, and we do it. See "How we keep it safe" below. |
| Anthropic Anthropic Ireland, Limited |
Provides the AI model behind what the agents say. Receives message content, call transcripts and the business's own information. | Routed through the United States, Europe, Asia and Australia. Stored in the United States. | The UK Addendum to the EU standard contractual clauses. Their data protection terms apply automatically when the account is opened, rather than being signed separately. |
| Twilio Twilio Ireland Limited |
Carries telephone calls and text messages. Receives telephone numbers, message content and delivery information. | The United States. | The UK International Data Transfer Agreement. Their data protection terms apply automatically when the account is opened, rather than being signed separately. |
| Retell Retell AI, Inc. |
The voice layer. Carries the call and converts speech to text and text back to speech. Receives call audio, transcripts and telephone numbers. | The United States. | The UK Addendum to the EU standard contractual clauses. We signed a data processing agreement with Retell on 20 August 2026. |
| OpenAI Engaged by Retell, not by us |
Runs the language model behind what the voice agent says on a call. Receives the call data onward from Retell. We have no contract with OpenAI. Retell engages it and stays responsible to us for what it does. | OpenAI's published sub-processor list, last updated 9 July 2026, names OpenAI, LLC, OpenAI Ireland Ltd. and OpenAI UK Ltd. among its entities, and records cloud infrastructure across a set of countries that includes the United States and the United Kingdom. The call data reaches it onward from Retell in the United States. | Retell engages OpenAI under section 4 of the agreement we signed with Retell on 20 August 2026. That section requires Retell to bind it by written agreement to obligations substantially the same as Retell's own, and keeps Retell liable to us for its acts and omissions. The instrument covering the leg out of the United Kingdom is the Retell one in the row above. We name OpenAI from our own configuration of the voice agent, read on 6 September 2026, and not from Retell's published sub-processor list, which returned no list when we read it. |
| ElevenLabs Eleven Labs Inc., engaged by Retell, not by us |
Produces the voice the agent speaks in. Receives the call data onward from Retell. We have no contract with ElevenLabs. Retell engages it and stays responsible to us for what it does. | The United States. Its published privacy policy, updated 20 May 2026, names Eleven Labs Inc. of New York and states that all personal data is transferred to the United States for storage. | Retell engages ElevenLabs under section 4 of the agreement we signed with Retell on 20 August 2026, on the same terms as the row above. Its own policy relies on the UK Extension to the EU-US Data Privacy Framework and the EU standard contractual clauses. The instrument covering the leg out of the United Kingdom is the Retell one. We name ElevenLabs from our own configuration of the voice agent, read on 6 September 2026, and not from Retell's published sub-processor list, which returned no list when we read it. |
| Cal.com Cal.com, Inc. |
Holds the diary the voice agent books into, and sends each booking back to the client's own system. Receives the enquirer's name, telephone number, the address of the job and the appointment time. Where an enquirer gives no email address, the booking is recorded against a holding address in our own mailbox so that the diary accepts it. The enquirer then gets no confirmation email. | The United States. Its published privacy policy, effective 20 August 2026, states: "We're a US company and data is processed in the United States. Some subprocessors process it elsewhere." | Not yet established, and we are not going to imply otherwise. Cal.com's policy says that for transfers out of the EEA, the UK or Switzerland it relies on standard contractual clauses or an adequacy mechanism such as the EU-US Data Privacy Framework. Which of those applies to our own account, and whether a data processing agreement is concluded on it, we have not yet read. We are working through it and we will say here what we find. |
Each client's data sits in its own separate database and is never pooled with another client's. If a client connects its own email or calendar provider, that provider is the client's own and the client's contract with it governs.
| Provider | What it does with your data | Where it processes it |
|---|---|---|
| Stripe | Takes card payments. We never see or store your full card details. | Not yet established. See below. |
| Smartlead | Sends our own business email to businesses we approach, and stores those contact records. If we emailed you about Qualforge, your details are in here. | Not yet established. See below. |
| Google Workspace | Our own mailboxes and file storage. | Not yet established. See below. |
| Netlify | Hosts this website. | Not yet established. See below. |
| Our scheduling tool | Books calls with us. | Not yet established. See below. |
Two things we would rather tell you than gloss over.
We have not yet established where each of the providers in the second table processes data, and we are not going to guess. We are working through them, starting with the one that holds the most, and we will fill this in as each is confirmed. If you want to know the position on a particular one, ask us.
Four of the seven providers in the first table are covered by a data protection agreement we hold, and three are not. We signed one with Retell on 20 August 2026 and concluded one with Hetzner on 27 August 2026. Anthropic's and Twilio's build into their contracts automatically, which is how those two companies work. OpenAI and ElevenLabs are engaged by Retell rather than by us, so we hold no agreement with either, and Retell stays responsible to us for what they do. On Cal.com we have not yet read which transfer instrument applies to our own account, or whether a data processing agreement is concluded on it, so we are not going to tell you that one is.
The second table is not there yet. For those providers we have not finished establishing the agreement position or where they process data. So we are not going to tell you that every provider we use is bound by a written agreement to process your data only on our instructions, because for that second group we have not checked. We would rather say that than say something that sounds better.
We share only what is necessary, and we do not sell your personal data.
Our hosting provider secures the building, the network and the machine. Everything inside the server is ours, and these are the things we do rather than the things we buy.
One thing we should say plainly: we hold no external security certification. We have no ISO 27001, no SOC 2 and no Cyber Essentials, and no third party has audited the measures above. They are real and they are ours, and they have not been inspected by anybody else. If that changes we will say so here.
Some of the providers named above process data outside the United Kingdom. Where they do, we rely on a safeguard permitted by Chapter V of the UK GDPR. The tables above say which safeguard applies to which provider, rather than leaving you to ask.
In plain terms, those safeguards are standard legal terms approved for use in the United Kingdom, which bind the provider to protect your data to the United Kingdom standard wherever it processes it. The two we rely on are the UK International Data Transfer Agreement and the UK Addendum to the EU standard contractual clauses.
Our hosting sits in Germany and nothing about a client's system leaves the European Union, so no transfer safeguard is needed for it. Our AI model provider, our telephony provider and our voice provider all process in the United States, and each is covered by one of the two safeguards above.
We have assessed the risk of the transfers to our AI model provider and our telephony provider. We have not yet done that assessment for our voice provider, and we would rather say so than let you assume it is done. If a provider is not named in the tables above, ask us and we will tell you the position.
We keep personal data only as long as we need it, or as long as the law requires, whichever is longer. Financial records are kept for as long as tax law requires.
If you become a client, we keep your records for as long as our contract requires and as long as tax law requires, and your contract sets out the periods.
When you tell us to stop contacting you, we put you on our suppression list. It is checked before any list of people to email or telephone is built, so that you are taken out before anyone contacts you rather than after.
To get on it, tell us to stop. Click the unsubscribe link in any email, reply to any email and say so, reply STOP to any text, say so on a call, or contact us using the details below. You do not have to give a reason, and it costs you nothing.
If you tell us to stop, we keep one short record and delete the rest. That record holds the contact details we need in order to recognise you again, the date you told us, how you told us, what you said, and who recorded it. It holds nothing else. We keep it for as long as we are in business, and we will not delete it even if you ask us to erase everything else.
We know that sounds like the opposite of what you asked for, so here is the reason. We cannot honour an instruction we have deleted. Your business details are published in places we look. If we deleted the record of your instruction, we would find you again, and nothing in our systems would know you had already told us no. Keeping the smallest possible record is the only way your instruction keeps working. If you want to see exactly what that record holds, ask us and we will send it to you.
Nothing comes off the suppression list except by a written decision of a director, recorded on the record itself.
Under UK data protection law you have the right to access your personal data, to have it corrected, to have it deleted, to restrict how we process it, to object to processing, and to data portability.
You have an absolute right to object to direct marketing. There is no balancing test for it. If you tell us to stop marketing to you, we stop. You do not have to give a reason, you do not have to explain, and it costs you nothing.
You do not need any particular form of words. Saying stop, take me off your list, do not call again, unsubscribe, or anything that means the same thing, is enough. If you say something that could be read either as turning down the offer or as telling us to leave you alone, we treat it as telling us to leave you alone.
Unless you tell us to limit it, we treat an objection as covering every way we might contact you, not only the one you used. A person applies it to the records we hold for you.
We match our records on the details we are given, so what you tell us matters. If you want the calls stopped, give us the number. If you want the emails stopped, give us the address. If you want all of it stopped, give us both and say so. We would rather ask you for the detail than assume it and get it wrong.
We act on it as soon as we receive it. One thing we should be straight about: our outbound email is sent through a third party tool that builds its sending list in batches, so if you unsubscribe partway through a sequence it is possible for one more message to reach you before the list is next rebuilt. If that happens, it is not us ignoring you. Tell us and we will confirm you are off.
If your data sits inside a client's system, the business you contacted is the controller, and we will pass your request to them without delay.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put things right first.
We do not use analytics cookies, advertising cookies or tracking pixels. There is no analytics tag on this site. We checked the site's own code rather than assuming, because the previous version of this page said we "may use analytics cookies" and that was never true.
Our own code sets no cookies at all. One thing is stored on your device: our chat widget keeps a single marker in your browser's session storage, so that it does not repeat itself to you during one visit. It holds no personal data, and your browser clears it when you close the tab.
Anything else set while you are here is limited to what our website host needs in order to serve you the page.
Because we set nothing that needs your permission, there is no cookie banner on this site and there is nothing for you to opt out of. If we ever add analytics or advertising, we will ask you first, and this section will change before it happens. You can block or clear storage at any time through your browser settings.
We may update this policy from time to time. The "last updated" date at the top shows when it last changed.
Questions about this policy, questions about your data, or to tell us to stop contacting you: email team@qualforge.co.uk.
If you are telling us to stop contacting you, you do not have to use this address. Any route works, and they are listed under "Your rights" above.