Privacy Policy

1. Scope and responsibility

This Privacy Policy explains how Bexford Automata handles personal information in connection with this website, business inquiries, client relationships and the administration of AI automation and workflow optimization services. It describes the kinds of information involved, why it is used, how it may be shared and the choices available to you.

For information about our own visitors and business contacts, Bexford Automata determines the purposes of processing. When we work with personal information held in a client’s systems solely on that client’s documented instructions, the client determines the purposes of that processing. In that situation, the project agreement and any applicable data-processing terms govern the work. This policy does not replace a client’s own notice to its customers, employees or other contacts.

2. Information you choose to provide

When you contact us, discuss a project or purchase services, the information you provide may include your name, business name, role, email address, telephone number, billing details and the contents of your communications. Project information may describe a recurring task, the tools you use, your preferred service, operating requirements, approvals and delivery arrangements.

We may also hold proposals, invoices, payment status, correspondence, support requests and records of the work agreed with you. Payment information available to us depends on the method used. Please do not include full payment card details, account passwords, government identification numbers or unnecessary sensitive personal information in an ordinary project inquiry. If a project needs protected information, handling requirements should be agreed before access is provided.

3. Website and technical information

When you visit a website, the hosting platform and related infrastructure may process technical information such as an IP address, browser and device characteristics, requested pages, access times, referring information and basic security events. This supports website delivery, protection against misuse, troubleshooting and the operation of platform features.

Cookies or similar technologies may support necessary functions and, when enabled with the appropriate permissions, optional preferences or measurement. The Cookie Policy explains these categories and the available controls. The exact platform information depends on the features operating at the time of your visit. We do not require advertising tracking as a condition of viewing the service information on this website.

4. Information used during a project

A workflow or integration project may involve access to business records, sample documents, message categories, system configuration, data fields, user permissions or test results. The information needed depends on the approved scope. We seek to use limited samples and the least access reasonably necessary for the agreed task. Where feasible, sample or de-identified information should be used before live personal information is introduced.

A project involving customer or employee information requires an appropriate basis for the client to provide that information and instructions on its permitted use. We do not acquire an unrestricted right to use a client’s records for our own purposes merely because we configure a workflow. If a request requires new categories of data, broader access or a new processing purpose, those requirements should be reviewed before the change is made.

5. Why information is used

We use business contact information to respond to inquiries, discuss requirements, prepare proposals, communicate about agreed work and provide project-related assistance. Client administration may require information for billing, payment reconciliation, recordkeeping and the resolution of service questions. Project information is used to assess feasibility, configure the approved setup, run agreed tests, document the result and support the handover.

Technical information may be used to operate the website, investigate errors, identify harmful activity and maintain the security of business systems. We may use relevant records to comply with legal obligations, respond to a lawful request, establish or defend a claim and enforce the project agreement. We do not treat a request for a proposal as permission to add you to an unrelated marketing campaign.

6. Legal bases where required

Where applicable law requires a legal basis, processing may be necessary to take steps at your request before entering a contract or to perform an agreed service. Some processing is necessary for legal obligations, including appropriate business and tax records. We may rely on legitimate interests in running a business, maintaining security and communicating with business contacts where those interests are not overridden by applicable individual rights.

Where consent is required, including for certain optional tracking or direct marketing activities, we will seek the appropriate choice before that activity. You may withdraw consent for future processing without affecting the lawfulness of processing that occurred before withdrawal. We assess the basis that fits the particular activity rather than assuming that one basis covers every use of information.

7. Service providers and other recipients

Information may be available to providers that support website hosting, business email, document storage, invoicing, payment administration, technical operations or the delivery of an approved project. This website is designed for Shopify, whose platform may process information necessary to host and operate its enabled storefront features. Providers receive information appropriate to their role and are subject to the relevant contractual and legal arrangements.

For a project, an integration or AI provider may process the data routed through its service under the accounts and settings approved for that engagement. The use of a provider does not remove the need to review permissions, retention, confidentiality and the provider’s terms. We do not authorize the use of confidential client material for general-purpose model training as part of ordinary project delivery; any materially different use requires an appropriate separate agreement and lawful basis.

We may disclose relevant information to professional advisers, public authorities or other parties where necessary to comply with law, protect legal rights, investigate misuse or respond to a legitimate business transaction such as a transfer of the business. Any transaction-related use must remain subject to appropriate confidentiality and applicable privacy obligations. We do not sell personal information for money.

8. Advertising, sale and sharing choices

The service information on this website can be viewed without agreeing to optional advertising technologies. We do not authorize a general sale of client contact lists. If optional marketing features are introduced, they must be assessed separately and disclosed through the relevant notice and controls. Some laws define “sale,” “sharing” or “targeted advertising” more broadly than an exchange for money, and available rights depend on the actual activity and the law that applies.

Where applicable, you may request an opt-out from covered sale, sharing or targeted advertising, even if the current response is that the relevant activity is not carried out. Recognized browser-based preference signals should be honored where required and technically supported by the relevant platform. A privacy request will not be treated as permission to collect additional information unrelated to resolving it.

9. Retention and deletion

We retain personal information for as long as reasonably necessary for the purpose for which it was collected and any applicable legal or operational obligations. Factors include whether an inquiry remains active, the length of a client relationship, the need to support or document completed work, statutory recordkeeping duties, limitation periods and unresolved disputes. We do not adopt indefinite retention merely because storage is available.

Project access should be removed or reduced when it is no longer needed. Copies of project information are returned or deleted under the applicable agreement, subject to lawful retention requirements. Business records, limited backup copies or material needed for a legal obligation may remain for the relevant period. When information is no longer required, it should be deleted, securely disposed of or de-identified as appropriate.

10. Security

We use reasonable administrative, technical and organizational measures appropriate to the information and the work involved. The approach may include controlled access, limited permissions, secure account features, appropriate provider selection and care in transferring project materials. Your own account controls, approved access settings and handling of credentials are also important to the security of a connected workflow.

No website, device or communication channel can be guaranteed completely secure. If you believe that project access or a communication has been compromised, contact us promptly with enough information to identify the concern. Do not send the suspected password, full payment information or unrelated sensitive data in that report. Where a security incident requires notification, we will follow applicable legal and contractual obligations.

11. Your privacy rights

Depending on your location, the applicable law and any relevant eligibility thresholds, you may have rights to request access to personal information, obtain a copy, correct inaccuracies, request deletion, restrict particular processing or object to processing based on legitimate interests. You may also have rights to data portability, withdraw consent, opt out of certain uses or appeal a decision on a privacy request.

To make a request, use the contact details below and describe what you are asking us to do. We may need proportionate information to verify your identity and locate the records. We will not ask for more information than is reasonably needed for that purpose. An authorized agent may submit a request where applicable law allows, subject to appropriate proof of authority. We respond within the time required by the applicable law and explain any relevant exception or inability to fulfill a request.

We will not unlawfully discriminate against you for exercising a privacy right. If you disagree with a response, you may ask us to review it and provide the basis for your concern. Where available, you may also complain to the competent privacy regulator or other authority. A deletion request may be limited by duties to retain tax records, defend legal claims or protect the rights of others.

12. Client-controlled information

If the information you are asking about is held in a system controlled by one of our clients, that client is normally the correct contact for an individual rights request. We can assist the client within the agreed processing arrangement, but we should not independently alter or disclose its records without appropriate instructions or a legal requirement. If you are unsure who controls the information, describe the relationship and we will consider how to route your question.

Clients are responsible for their notices, lawful instructions and decisions about the use of personal information in their business processes. Our work on a configuration does not by itself establish that every proposed use of client information is lawful or suitable. Requirements involving sensitive data, regulated activities or significant automated decisions should be raised before the project scope is accepted.

13. International processing

Business software and hosting providers may operate in more than one country. Depending on the services used, information may be processed outside the jurisdiction where it was collected. We consider the provider, the data involved and the applicable transfer requirements before using a service for a project. Where a law requires a particular safeguard or contractual mechanism, that requirement must be addressed for the relevant transfer.

A provider’s global presence does not mean every project sends information to every location in which that provider operates. The actual arrangements depend on the approved tools, account settings and scope. You may contact us with a specific question about the services used for your engagement.

14. Children and third-party services

Our services are intended for businesses and adult business contacts. This website is not directed to children under 13, and we do not knowingly seek their personal information. If you believe that a child has provided personal information to us, contact us so we can review the situation and take appropriate action.

Business tools operated by other providers have their own privacy practices. Their handling of information under your direct account relationship is governed by their applicable terms and notices. This policy describes Bexford Automata’s handling of information and does not make a guarantee about another provider’s independent practices.

15. Changes and questions

We may revise this policy when our services, website features or legal obligations change. The effective and updated dates appear at the top. Material changes will be communicated as required by applicable law. A revised notice does not itself authorize an incompatible new use of previously collected information where further consent or another lawful step is required.

For a privacy question, a rights request, a correction or a concern about a particular project, use the contact details below. Please state whether your request relates to the website, a business inquiry, billing records or a client-controlled system so that it can be assessed in the appropriate context.