Skip to content

Legal

Privacy Policy

How we handle your data across the UK, US, Canada, and Australia.

Who we are

7 Minds Systems is a trading name of Seven Minds Media Group Ltd, a company registered in England and Wales ("we", "us", "our"). Our company number is 17048444 and our registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the data controller responsible for the personal data described in this policy.

For any privacy question or request, contact us at privacy@7mindshq.com or by post at the registered office above. If we appoint a data protection officer or a representative for a particular region, we will name them here.

Scope of this policy

This policy explains how we handle personal data when you visit our website, enquire about or book a strategy call, engage us to design and build a website (an "Autonomous Digital Branch"), or deploy and operate our standalone AI Employees. It applies to individuals in the United Kingdom, the United States, Canada, Australia, and elsewhere.

Where we deliver services to a client, we typically act as the data controller for data we collect about you directly (for example, enquiry and account data). Where we process personal data within a system we operate on a client's behalf, the client is the controller and we act as their processor under a separate data processing agreement; in that case the client's own privacy notice governs that processing.

What we collect and why

Information you give us. Your name, email address, telephone number, company name and role, and the details you include in enquiries, forms, our booking flow, and correspondence. We use this to respond to you, schedule and conduct strategy calls, prepare proposals, and deliver and support our services.

Account and engagement data. Information generated while we deliver a service, such as project communications, configuration choices, billing contact details, and records of the services provided. We use this to perform our contract with you and to keep proper business records.

Payment information. Billing details needed to take payment. Card and bank details are handled by our payment processor; we do not store full payment card numbers ourselves.

Usage and device data. Limited technical data your browser sends with each request, such as approximate (city-level) location, referring source, browser, and device type, together with server logs we keep to maintain security and reliability. We do not run advertising trackers. Where we offer privacy-respecting analytics, it loads only after you opt in through our consent banner; if you decline or do not respond, no analytics and no analytics cookies are set.

Cookies and similar technologies. As described in the Cookies section below.

We do not intentionally collect special category data (such as health, ethnicity, or biometric data) through our website, and we ask that you do not send it to us through general enquiry channels. We do not knowingly collect personal data from children.

Referrals and introductions

If you introduce someone to us through our referral form, you give us their name or business and one way to contact them (an email address or phone number), along with any context you choose to add. When you submit the form you confirm that you have that person's permission to share their details and that they are happy to be contacted, and we record that confirmation with the introduction.

If someone has referred you. We use a referred person's details only to make contact about 7 Minds Systems and the introduction, relying on our legitimate interest in business introductions together with the referrer's confirmation of permission. We do not add referred contacts to marketing without a separate opt-in. If you would prefer we did not hold or use your details, email privacy@7mindshq.com and we will erase them promptly.

We keep referral contact details only for as long as we need them to follow up the introduction, and delete them if it does not progress, in any event within the enquiry-data period set out under Retention below.

Lawful bases (UK GDPR and EU GDPR)

We rely on the following lawful bases under Article 6 of the UK GDPR (and the EU GDPR where it applies):

  • Contract. To take steps at your request before entering a contract, and to perform our contract to deliver and support our services and process payment.
  • Legitimate interests. To respond to enquiries, operate, secure, and improve our website and services, keep business records, and carry out limited business-to-business marketing. Where we rely on legitimate interests, we have balanced them against your rights, and you may object at any time.
  • Consent. For non-essential cookies and analytics, and for optional marketing communications. You may withdraw consent at any time without affecting processing carried out before withdrawal.
  • Legal obligation. To comply with tax, accounting, and other legal requirements.

Processors and sub-processors

We share personal data only with service providers that help us operate, under written contracts that require them to protect it and to act only on our instructions. Our current categories of processor include:

  • Hosting and deployment. Vercel Inc. (website hosting and delivery).
  • Database and backend. Supabase, Inc. (database, authentication, and storage).
  • Email and communications. Our transactional and business email providers, used to send service-related and (where you have opted in) marketing messages.
  • Scheduling. Our booking and calendar provider, used to arrange strategy calls.
  • Payments. Our payment processor, used to take and reconcile payments.
  • Analytics. Google Analytics 4 (Google), loaded only where you have opted in through our consent banner, used to measure aggregate website usage with IP anonymisation enabled.
  • AI and model providers. The third-party AI platforms that power our AI Employees and the on-site chat assistant. Where personal data is processed by these providers, we use business or enterprise terms that prohibit the use of your data to train their general models, except where you have specifically agreed otherwise.

We will keep an up-to-date list of named sub-processors and provide it on request. We do not sell your personal data.

International transfers

We are based in the United Kingdom, and some of our processors are located in the United States or other countries outside the UK and the European Economic Area. Where personal data is transferred outside the UK or EEA, we put in place an appropriate safeguard recognised under UK and EU data protection law, which may include:

  • transfers to a country covered by UK "adequacy regulations" or an EU adequacy decision (for example, transfers to certified organisations under the UK Extension to the EU-US Data Privacy Framework); or
  • the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, together with any additional measures needed to protect the data.

You can request a copy of the relevant safeguard by contacting us.

Retention

We keep personal data only for as long as we need it for the purposes set out in this policy, and then delete or anonymise it. In general:

  • enquiry and unsuccessful prospect data is kept for up to 24 months from your last contact with us;
  • client account and engagement data is kept for the duration of the engagement and for up to 7 years afterwards to meet contractual, tax, and accounting requirements;
  • payment and accounting records are kept for the period required by law (typically 6 to 7 years); and
  • analytics data is kept in identifiable form for a limited period and is otherwise aggregated.

Where we process personal data as a processor on a client's behalf, retention follows the client's instructions and our data processing agreement.

Your rights

Depending on where you live, you have rights over your personal data. Under the UK GDPR and EU GDPR, you may have the right to:

  • access a copy of your personal data;
  • have inaccurate data corrected;
  • have your data erased in certain circumstances;
  • restrict or object to processing, including direct marketing;
  • data portability; and
  • withdraw consent where we rely on it.

To exercise any right, email privacy@7mindshq.com. We will respond within one month, as required by law, and will not charge a fee in most cases. We may need to verify your identity before acting on a request.

United States (CCPA/CPRA and state laws)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what personal information we collect and how we use and disclose it, to access and delete it, to correct inaccurate information, and to opt out of any "sale" or "sharing" of personal information and of targeted advertising. We do not sell or share your personal information as those terms are defined under the CPRA, and we do not use sensitive personal information for purposes that require an opt-out. We will not discriminate against you for exercising your rights. Residents of other US states with comparable laws (such as Virginia, Colorado, Connecticut, Texas, and Utah) have similar rights. To exercise these rights, contact us at privacy@7mindshq.com; you may use an authorised agent where the law allows.

Canada (PIPEDA)

If you are in Canada, we handle personal information in line with the Personal Information Protection and Electronic Documents Act and applicable provincial privacy laws. We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate, obtain consent where required, and give you the right to access and correct your information and to challenge our handling of it. You may direct a complaint to us or to the Office of the Privacy Commissioner of Canada.

Australia (Australian Privacy Principles)

If you are in Australia, we handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may request access to and correction of your personal information, and may complain about how we handle it. We will respond to a complaint within a reasonable time, and if you are not satisfied you may contact the Office of the Australian Information Commissioner.

Cookies and similar technologies

We use a minimal set of storage, and no advertising cookies:

  • Essential browser storage that the site uses to function, for example remembering your currency choice, that you have already seen the intro or closed a prompt, and your analytics choice. This is kept in your browser's local and session storage, is not a tracking cookie, and does not require consent.
  • Analytics cookies, only with your consent. If you accept analytics in our consent banner, Google Analytics 4 sets cookies to measure aggregate usage with IP anonymisation. If you decline or do not respond, none are set, and you can change your mind at any time by clearing your stored choice.

We do not use cookies to sell your data or to build cross-site advertising profiles. Because non-essential analytics load only after you opt in, we show a consent banner so the choice is yours. You can clear cookies and stored choices at any time through your browser settings. Blocking essential storage may affect how the site works.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date above and, for material changes, take reasonable steps to bring them to your attention.

How to complain

If you have a concern, please contact us first at privacy@7mindshq.com so we can try to resolve it. You also have the right to complain to a data protection authority.

In the UK, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, by calling 0303 123 1113, or by writing to: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. If you are in the EEA, Canada, Australia, or a US state with a relevant regulator, you may instead contact your local authority (see the regional sections above).