Privacy Policy
This Privacy Policy explains how Cyberstaff Ltd (“Cyberstaff”, “we”, “us” or “our”) handles Personal Data.
Cyberstaff provides AI-powered communications and automation services to businesses. Where we process Personal Data on behalf of a business using our Services, that business is generally the Controller and Cyberstaff is its Processor. That processing is governed by our agreement with the business, including our DPA.
This Policy primarily describes how we handle Personal Data where Cyberstaff determines the purposes and means of processing and therefore acts as Controller.
1. Information We Collect
Depending on how you interact with Cyberstaff, we may process information you provide to us, information processed through or generated by the Services, technical and usage information, and information received from third parties or integrations.
This may include account and contact information, communications and other content, information about use of the Services, and related technical information.
Where we process Personal Data solely on behalf of a customer, we do so as their Processor.
2. How We Use Personal Data
We process Personal Data where we have an appropriate lawful basis.
| Purpose | How we use information | Lawful basis |
|---|---|---|
| Providing our Services | To provide, administer, maintain and support Cyberstaff and our customer relationships. | Lawful basis: Contract; legitimate interests |
| Security and reliability | To protect our Services, prevent misuse, investigate problems and maintain their security and reliability. | Lawful basis: Legitimate interests; legal obligations |
| Understanding and improving our Services | To understand use and performance and analyse, develop and improve our products and services. | Lawful basis: Legitimate interests |
| Research and development | To research, develop, evaluate, train and improve our technologies, including AI systems and models. | Lawful basis: Legitimate interests |
| Communications and marketing | To communicate with users and customers and, where permitted, about our products and services. | Lawful basis: Legitimate interests; consent where required |
| Legal and business purposes | To comply with law, administer our business, protect our rights and support corporate transactions. | Lawful basis: Legal obligations; legitimate interests |
Where we rely on legitimate interests, we consider our interests, whether the processing is necessary and its potential impact on individuals. Where we rely on consent, it may be withdrawn at any time without affecting processing that has already occurred.
Customers may contact [email protected] to request that new content associated with their account is excluded from future research and development.
We may use information that has been aggregated or anonymised so that it no longer identifies an individual for research, analytics, development and other lawful purposes.
3. Sharing Personal Data
We may share Personal Data where reasonably necessary with service providers and partners that help us provide and operate Cyberstaff, including providers of technology, communications, infrastructure, payments, security and other services.
We may also disclose information to professional advisers, authorities or other parties where reasonably necessary to comply with law, protect rights, address security or fraud, establish or defend legal claims, or in connection with a financing, reorganisation, acquisition, sale or other corporate transaction.
Where third parties process Personal Data on our behalf, we use appropriate contractual and other safeguards.
We do not sell Personal Data in the ordinary meaning of selling information for money.
4. International Transfers
Cyberstaff and our service providers may process Personal Data in countries other than the country in which it was collected.
Where applicable law requires safeguards for an international transfer, we use an appropriate lawful mechanism.
5. Retention and Security
We retain Personal Data for as long as reasonably necessary for the purposes for which it is processed, taking into account the nature of the information, our Services, legal and contractual requirements and legitimate business needs.
Information may remain in backups and other systems for a period after it is removed from active systems. Information that has been anonymised so that it is no longer Personal Data may be retained and used without a fixed retention period.
We use technical and organisational measures designed to protect Personal Data. No system can guarantee absolute security.
6. Your Rights
Depending on applicable law and the circumstances, you may have rights to access, correct or delete your Personal Data, restrict its processing, receive certain information in a portable format or withdraw consent.
You also have the right to object to processing based on legitimate interests.
Where Cyberstaff processes Personal Data on behalf of a business you interacted with, that business is normally responsible for handling requests relating to that processing and you should generally contact it directly.
Where Cyberstaff acts as Controller, you can exercise these rights, including the right to object, by contacting [email protected]. These rights may be subject to conditions and exceptions under applicable law.
You can also complain to the UK Information Commissioner's Office or another competent data protection authority.
7. Cookies
We may use cookies and similar technologies for functionality, security, preferences, analytics and other purposes. Where required by law, we obtain consent before using non-essential cookies.
8. Changes and Contact
We may update this Privacy Policy from time to time to reflect changes to Cyberstaff, our practices or applicable law. The current version will be made available through our website.
The Controller responsible for processing described in this Policy is:
Cyberstaff Ltd
1 Colleton Crescent, Exeter EX2 4DG
Company number 16797237
Last updated: 8 October 2026