Enacture Ltd respects your privacy and is committed to handling personal information responsibly.

This policy explains what information we collect, why we use it, how we protect it, how long it is retained and your rights under UK data protection law.

01. Who we are

Enacture Ltd provides consultancy services through Enacture Workplace and Enacture Education.

We are the data controller for personal information collected and used for our own business purposes.

Company: Enacture Ltd
Registered in: England and Wales
Company number: 17553270
Registered office: 74 College Road, Maidstone, ME15 6SL
Website: www.enacture.co.uk
Email: hello@enacture.co.uk

Where we process information on behalf of a client under their instructions, we may act as a data processor. Such processing is governed by the relevant contractual arrangements.

02. Information we collect

Depending on how you interact with us, we may collect:

• Contact information: Names, email addresses, telephone numbers, job titles and organisations.

• Enquiry information: Details submitted through our website, correspondence or initial discussions.

• Professional information: Meeting notes, project correspondence and information relevant to consultancy engagements.

• Financial information: Information needed for contracts, invoicing, payments and accounting.

• Website information: Technical information associated with website operation and security.

We generally receive information directly from individuals, although professional contact information may also come from referrals, organisational contacts or publicly available professional sources.

We do not ask visitors to provide sensitive personal information or information identifying children through our website enquiry form.

03. Why we use your information

We process personal information to:

• Respond to enquiries and discuss potential services.

• Prepare proposals, manage agreements and deliver consultancy services.

• Maintain necessary business and professional records.

• Manage invoicing, accounting and legal obligations.

• Protect the security and operation of our website and business systems.

• Send relevant professional communications where permitted by law.

Depending on the activity, our lawful basis is legitimate interests, contractual necessity, compliance with a legal obligation or consent where required.

Our legitimate interests include responding to enquiries, maintaining professional relationships and operating our business effectively and securely, balanced against individuals' rights.

We respect objections to marketing and obtain consent where required by law.

04. Who can access your information

Enacture is currently operated by its founder.

The founder is the sole human user of Enacture's internal Notion workspace. No other staff members, clients or external collaborators have general membership access to that workspace.

Authorised integrations and technology providers may process information as necessary to deliver their services. Individual information may also be shared with appropriate recipients when justified by a business purpose.

Our principal technology providers include:

• Squarespace: Website hosting and enquiry forms.

• Microsoft 365: Outlook email, Teams meetings, SharePoint and business documents.

• Notion: Internal business organisation, project records and meeting notes.

• OpenAI and Notion AI: AI-assisted research, drafting, meeting documentation and other approved activities.

• FreeAgent: Accounting and financial administration.

Connected systems

Enacture uses authorised integrations between business systems, including Notion and Microsoft Outlook.

These connections can enable information from one service to be retrieved and processed through another, according to the permissions and functions enabled.

They do not grant general workspace membership to additional people.

We limit access to what is appropriate for the relevant business purpose and review permissions where necessary.

We may share information with authorised professional advisers or where required by law.

We do not sell personal information.

05. Our use of artificial intelligence

Enacture uses AI-assisted tools to support research, drafting, organisation, meeting documentation and other appropriate business activities.

AI model training

Enacture's ChatGPT account has the "Improve the model for everyone" setting disabled. This setting has been disabled since the account's use for Enacture began.

Under OpenAI's published data controls, eligible new conversations are not used for model training when this setting is disabled.

Notion states that neither it nor its AI providers use customer data to train AI models, and that its providers are contractually prohibited from doing so.

These protections do not mean that information is never processed or temporarily retained by the providers. Service operation, security and other permitted processing may still take place.

Settings and contractual protections may differ across other AI products or integrations. We assess these arrangements before processing confidential or personal information.

Human oversight

AI-generated material is reviewed as appropriate before being used for professional decisions or external communications.

AI systems do not independently authorise contractual commitments, consequential client communications or final professional judgements on Enacture's behalf.

Confidentiality

We aim to minimise the amount of personal and confidential information supplied to AI services.

Where contractual requirements or the sensitivity of information make particular AI processing inappropriate, we use alternative arrangements.

06. AI-assisted meeting notes

Enacture may use Notion AI to transcribe meetings and prepare draft summaries or action points.

Permission

We explain the proposed use of AI transcription before recording and obtain express permission from every participant.

We will not proceed with AI recording if a participant declines. We also consider applicable confidentiality, contractual and data protection requirements.

Access

Meeting transcripts and AI-generated notes are held within restricted business systems.

They are not automatically shared with clients, participants or other external parties.

Retention

Our policy is to retain raw AI meeting transcripts and draft AI-generated meeting notes for a maximum of 30 days from the meeting date, unless a specific legal or contractual obligation justifies longer retention.

During this period, verified decisions, agreed actions and information necessary for the professional relationship may be transferred to ordinary business records.

These records may be retained for longer where justified by contractual, legal or legitimate business requirements.

The original transcripts and draft notes are deleted in accordance with our retention procedure.

Enacture’s Meeting Notes system schedules a manual retention review 21 calendar days after the meeting date. This reminder does not automatically delete transcripts or draft notes.

Provider retention

Notion states that AI providers serving its Business plan retain information submitted for AI processing for no more than 30 days.

This is separate from information saved within Enacture's own Notion workspace, which must be managed under our retention procedure.

07. How long we keep other information

We retain other personal information only for as long as reasonably necessary for its purpose.

Relevant considerations include:

• Whether an enquiry or professional relationship remains active.

• Contractual obligations.

• Legal and financial record-keeping requirements.

• The need to establish, exercise or defend legal claims.

We review and delete or anonymise information when it is no longer required.

The 30-day meeting-material retention period does not automatically apply to ordinary business correspondence, contracts, invoices or verified project records.

08. Information security

We take proportionate measures to protect personal information, including:

• Restricting access to authorised accounts and integrations.

• Using authentication and account security controls.

• Managing document-sharing permissions.

• Limiting unnecessary disclosure to AI services.

• Reviewing information before external sharing.

• Retaining information only for justified purposes.

Although Enacture currently has one human workspace user, authorised technology providers and integrations necessarily have access to certain information to operate their services.

No digital system can guarantee absolute security.

09. International data transfers

Some technology providers may process information outside the United Kingdom.

Where international transfers occur, we assess and apply the protections required by UK data protection law, including applicable adequacy arrangements or appropriate contractual safeguards.

Further information may be requested using our contact details.

10. Cookies

Our website uses cookies and similar technologies to support essential functionality, security and cookie preferences.

Non-essential cookies are subject to the applicable consent controls.

Further details are available in our separate Cookie Policy, including information about managing your preferences.

11. Your data protection rights

Subject to applicable legal conditions, you may have the right to:

• Access personal information we hold about you.

• Request corrections to inaccurate information.

• Request deletion or restriction of processing.

• Object to certain uses of your information.

• Request data portability where applicable.

• Withdraw consent where processing relies on consent.

To exercise your rights, contact privacy@enacture.co.uk.

We may need to verify your identity before responding.

12. Complaints

If you are concerned about how Enacture handles your information, please contact privacy@enacture.co.uk.

We will acknowledge data protection complaints within 30 days, investigate them appropriately, keep you informed and communicate the outcome without undue delay.

You may also complain to the Information Commissioner's Office:

www.ico.org.uk

13. Changes to this policy

We may update this policy when our services, technology, information-handling practices or legal obligations change.

The current version will be available on our website, showing the date of its most recent update.