Privacy policy

1. Who we are

BarakahX is a business operating system for professional services firms, provided by BarakahX Ltd, a company registered in England and Wales with company number 16564021 and registered office at 1 Gawthorpe Lane, Wakefield, WF2 0SR, United Kingdom (referred to in this policy as we, us or BarakahX).

For questions about this policy or about how we handle personal data, write to privacy@barakahx.com or to the registered office address above, marked for the attention of the data protection lead.

2. When we are a controller and when we are a processor

The distinction matters, because it decides who you should approach about your data.

• We are a controller for the personal data of website visitors, people who enquire about the product, the named contacts and administrators at customer firms, and our own marketing contacts. We decide why and how that data is processed, and this policy describes it.
• We are a processor for the content a customer firm places in the service, which will often include personal data about that firm’s own clients and staff. The customer firm is the controller of that content. We process it only on the firm’s documented instructions, under a data processing agreement that forms part of our terms of service. If you are a client of a firm that uses BarakahX and you want to exercise your rights over your data, please contact that firm in the first instance. We will help them respond.

3. What personal data we collect

Data you give us

• Your name, email address, telephone number, firm name and role, when you enquire, correspond with us or set up an account.
• Billing details, including the billing contact and the firm’s address and tax details.
• The content you place in the service, such as documents, emails, matter and engagement records, notes, and anything you instruct BarakahX to draft or analyse. This is customer content and we handle it as a processor.

Data we collect automatically

• Technical data about your device and connection, including IP address, browser type and version, operating system, and the pages you requested.
• Application and security logs, including sign in events and a record of significant actions taken inside the service.

Data we receive from others

• Business contact information from publicly available sources and business directories, where we are considering approaching a firm.
• Measurement data from the advertising platforms we use, in aggregate form, about how our campaigns performed.

We do not deliberately collect special category data as defined in Article 9 of the UK GDPR. Customer content may contain it, because professional practices handle sensitive matters. Where it does, the customer firm remains the controller and is responsible for having a lawful basis and an Article 9 condition for it.

4. Why we use it, and our lawful bases

Under the UK GDPR we must have a lawful basis for each purpose. Ours are set out below.

This table covers only the personal data for which we are the controller. For the content a customer firm places in the service we act on that firm’s documented instructions and rely on the firm’s own lawful basis, as explained in section 2.

Where we rely on legitimate interests we have carried out a balancing assessment. You can ask us for a summary of it, and you can object to that processing at any time using the details in section 11.

5. How your data is used with AI models

BarakahX uses large language models to draft, summarise, classify and answer questions about the content in the service. That means content you place in the service, which may contain personal data, is sent to the model providers named in section 7 for processing.

• We use the business and enterprise arrangements offered by those providers, under which content submitted through their interfaces for business use is not used to train their general purpose models.
• Model output is a draft. BarakahX does not take decisions that produce legal effects concerning you or similarly significantly affect you without a person at the customer firm reviewing and deciding. In other words, we do not carry out solely automated decision making within the meaning of Article 22 of the UK GDPR.
• Model output can be wrong. The customer firm is responsible for reviewing anything produced by the service before it is relied on or sent to a client.

6. Cookies and similar technologies

This marketing website uses only the cookies that are strictly necessary for it to work and to stay secure. It does not currently set analytics or advertising cookies, and it does not run an advertising pixel.

The BarakahX application uses strictly necessary cookies to keep you signed in and to protect against request forgery. Strictly necessary cookies do not require consent under the Privacy and Electronic Communications Regulations.

If we introduce analytics or advertising cookies in future, we will ask for your consent first and give you a way to change your mind. Where we advertise on Google or Meta, those platforms process data about how their own users interact with our advertisements on their own platforms, under their own privacy notices.

7. Who we share personal data with

We do not sell personal data. We share it with the subprocessors listed below, each of which is bound by a written contract that restricts what they may do with it. This list is current as at the date at the top of this policy, and we will update it when it changes.

One qualification. For the advertising they deliver on their own platforms, Google and Meta act as independent controllers under their own privacy notices, as described in section 6. They are not processors of customer content, and they receive none.

We may also disclose personal data:

• to our professional advisers, such as our accountants, insurers and solicitors, where they need it to advise us;
• to a buyer or successor, if we sell or reorganise our business, in which case the data stays subject to this policy;
• where we are required to do so by law, by a court order or by a regulator, and where we are permitted to do so we will tell the affected customer firm first.

8. Transfers outside the United Kingdom

Several of the subprocessors above process personal data outside the United Kingdom, principally in the United States and the European Economic Area.

• For transfers to the European Economic Area we rely on the UK adequacy regulations that cover it.
• For transfers to the United States and elsewhere we rely on the International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission standard contractual clauses, together with a transfer risk assessment. Where the receiving organisation is certified under the UK Extension to the EU-US Data Privacy Framework, we may rely on that instead.

You can ask us for a copy of the safeguards we rely on for any particular transfer by writing to privacy@barakahx.com.

9. How long we keep personal data

We keep personal data only for as long as we need it for the purpose we collected it for, and then delete it or make it permanently anonymous.

Where a customer firm instructs us to keep or delete its content on a different timetable, that instruction takes priority for that content, subject to any legal obligation we have to keep it.

10. Security

We take appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access control on a least privilege basis, multi factor authentication for administrative access, logging of significant actions, separation of customer data, and regular review of the access our staff hold.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to people’s rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will tell affected customer firms without undue delay so that they can meet their own obligations.

11. Your rights

Under the UK GDPR you have the following rights over personal data for which we are the controller.

• Access. To be told whether we hold personal data about you and to receive a copy of it.
• Rectification. To have inaccurate data corrected and incomplete data completed.
• Erasure. To have data deleted where we no longer have a good reason to keep it.
• Restriction. To have us pause our use of your data while a question about it is resolved.
• Portability. To receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another organisation where that is technically feasible.
• Objection. To object to processing based on legitimate interests, and to object at any time and without reason to the use of your data for direct marketing.
• Withdrawal of consent. Where we rely on consent, to withdraw it at any time. That does not affect processing carried out before you withdrew it.
• Automated decisions. Not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. As explained in section 5, we do not take decisions of that kind.

To exercise any of these rights, write to privacy@barakahx.com. We will respond within one month. If your request is complex, or if you have made several requests, we may extend that by up to two further months and we will tell you why within the first month. Exercising your rights is free. We may charge a reasonable fee, or refuse, if a request is manifestly unfounded or excessive, and we will explain our reasons if we do.

We may ask you for information to confirm your identity before we act, so that we do not disclose personal data to the wrong person.

12. Complaining to the Information Commissioner

If you are unhappy with how we have handled your personal data, please tell us first at privacy@barakahx.com so that we have a chance to put it right. You also have the right to complain to the UK supervisory authority at any time.

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

13. Children

BarakahX is a product sold to businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18 in our capacity as controller.

14. Changes to this policy

We update this policy when our processing changes, including when we add or replace a subprocessor. The date at the top shows when it last changed. Where a change is significant, we will tell customer firms by email before it takes effect.