Privacy Policy

1. Who we are

Cranmore Consulting Limited (“Cranmore”, “we”, “us”) is a company registered in Northern Ireland (company number NI070910), with its registered office at 73 Church View, Holywood, BT18 9LN. We are registered with the Information Commissioner’s Office under registration number ZA926392.

This policy explains how we collect, use, share and protect personal data when you visit our website, contact us, work with us, or use a service we provide on behalf of one of our clients.

2. Our two roles

When we are the controller. We decide how and why your data is used when you visit cranmore.ai, make an enquiry, receive our marketing, or work with us as a client, supplier or partner.

When we are the processor. We build and operate digital, AI and messaging services for organisations (our clients). When we handle personal data inside those services, such as messages exchanged with a client’s customers over WhatsApp, we act on that client’s documented instructions under a written data processing agreement. The client is the controller and its own privacy notice applies. If you have a question about how a client uses your data, please contact that client; we will help them respond.

3. Information we collect

• Website visitors: IP address, device and browser information, pages visited and cookie data (see section 12).
• Enquiries and demonstrations: name, job title, organisation, email address, phone number and the details of your enquiry.
• Clients, suppliers and partners: business contact details, contract and billing information, project correspondence and meeting records.
• Data processed for clients: whatever the client’s service requires. For messaging services this typically includes phone numbers, profile names, message content (text, images, files), message timestamps and delivery status, and business account identifiers.

4. How we use your information and our lawful basis

5. Messaging services, including WhatsApp

Some of the services we provide to clients use the WhatsApp Business Platform, operated by Meta Platforms Ireland Limited (“Meta”) and its affiliates. When a client connects its WhatsApp Business Account to our platform, Meta grants us permission to send and receive messages and to manage message templates and account settings on that client’s behalf.

In providing these services:

• We process WhatsApp data only to deliver the service the client has asked for, and only on its instructions.
• We do not sell this data, use it for our own marketing, or share it with anyone other than the client and the processors listed in section 6.
• We do not use message content to train AI models, other than models dedicated to that client and only where the client has agreed in writing.
• Meta processes the same messages as an independent provider under its own terms and privacy policy, available at https://www.whatsapp.com/legal/business-policy and https://www.facebook.com/privacy/policy.
• When a client stops using our service or revokes our access, we stop processing its WhatsApp data and delete or return it as set out in our agreement with that client.

6. Who we share data with

We share personal data only where necessary, with:

• Meta, as provider of the WhatsApp Business Platform (for messaging services);
• our cloud hosting provider, [provider, e.g. Microsoft Azure], which hosts our platform in [region];
• other service providers who support our business, such as IT, email, CRM, analytics and digital marketing suppliers, each bound by a contract that requires them to protect your data;
• professional advisers, regulators, law enforcement or courts, where the law requires it.

7. International transfers

We host our own systems in [the UK / the UK and EEA]. Some providers, including Meta and Microsoft, may process data outside the UK and EEA, including in the United States. Where this happens we rely on adequacy regulations (such as the UK Extension to the EU-US Data Privacy Framework) or on appropriate safeguards such as the International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum.

8. How long we keep data

• Enquiries that don’t lead to a contract: [24 months] from last contact.
• Client, supplier and partner records: the length of the relationship plus [6 years], for legal and accounting purposes.
• Marketing data: until you unsubscribe or object, after which we keep a suppression record so we don’t contact you again.
• Data processed for clients: as instructed by the client and set out in our agreement with them.

9. How we protect data

We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, multi-factor authentication, logging and monitoring, staff confidentiality obligations and supplier due diligence.

10. Your rights

You have the right to access your personal data, have it corrected or erased, restrict or object to its use, receive it in a portable format, and withdraw consent at any time where we rely on consent. To exercise any right, contact us through our dedicated contact form. We will respond within one month. If we hold the data as a processor, we will pass your request to the relevant client and help them respond.

11. Data deletion requests

To ask us to delete your data, email [privacy address] with the subject “Data deletion request”, stating your name and the email address or phone number linked to your data. We will confirm when deletion is complete.

If your organisation connected a Facebook or WhatsApp Business account to our platform, you can also remove our access at any time in Meta Business Settings, under Integrations or Business integrations. We will then delete the associated data we hold within [30] days, unless the law requires us to keep it.

12. Cookies

We use essential cookies to make our website work and, with your consent, analytics cookies to understand how it is used. You can change your choices through our cookie banner or your browser settings.

13. Children

Our website and services are aimed at organisations and are not directed at children under 13.

14. Changes to this policy

We review this policy regularly and will post any changes on this page with a new “last updated” date.

15. Contact us and complaints

Privacy questions: [privacy address], or write to the Data Protection Lead, Cranmore Consulting Limited, 73 Church View, Holywood, BT18 9LN. Phone: +44 (0)28 9039 4431.

You can complain to the Information Commissioner’s Office (ico.org.uk) or, if you are in the Republic of Ireland, the Data Protection Commission (dataprotection.ie). We would appreciate the chance to resolve your concern first.