Privacy Notice

1. Who we are

Agents of Output ("we", "us") is a trading name of Synextra Ltd, a company registered in England and Wales (company number 09134843). Our registered office is Fifth Floor, 401 Faraday House, Faraday Street, Birchwood Park, Warrington, WA3 6GA. We design, build and run AI agents for business clients on infrastructure we manage.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Synextra Ltd is the controller of the personal data described in this notice, except where we process data on a client's behalf (see section 5). Synextra Ltd is registered with the Information Commissioner's Office (ICO).

You can contact our privacy team at [email protected], or by post at the address above.

2. What this notice covers

This notice explains how we handle personal data when you visit this website, contact us, book or attend a discovery session, or become a client. Data we process while delivering agent services to a client is governed by the contract with that client, summarised in section 5.

3. Personal data we collect

Data you give us

• Enquiry and booking data. When you book a discovery session or contact us, we collect the details you give us. This is usually your name, work email address, phone number, company name and job title, and anything you tell us about your processes.
• Call recordings. We record and transcribe discovery sessions so we have an accurate note of what was discussed. We may also record other calls with prospects and clients for staff training, coaching and quality assurance. We tell you at the start of every recorded call, and you can ask us not to record. If you do, we take written notes instead.
• Correspondence. We keep emails and other messages between us.
• Client data. Once you are a client, we hold the contact, contract and billing details of the people we deal with. We also hold account details for anyone who signs in to view agent outputs or export an audit trail. This data comes from you or your employer.

Data we collect automatically

• Website data. Our servers log standard information, such as your IP address, browser type and the pages you request, so we can run and secure the website. With your consent, analytics and advertising cookies also record how you use the site. Our Cookie Policy lists them.

Data from other sources

• Business contact and company information. We collect this from publicly available sources and business data providers, such as LinkedIn, Companies House and data enrichment services. It may include your job title, employer, business contact details and company size. We use it to understand who we are speaking to and to keep our records accurate.

You do not have to give us any personal data. If you do not, we may not be able to respond to your enquiry, run a discovery session or provide our services.

4. How and why we use it

• To respond to you and run discovery sessions. We use your details to reply to your enquiry, run discovery sessions (including recording them) and keep a record in our CRM. Our lawful basis is legitimate interests in responding to an enquiry you started, or taking steps you have asked us to take before entering a contract.
• To train our staff and check the quality of our service. We may use call recordings for internal training, coaching and quality assurance. Our lawful basis is legitimate interests in improving our service and developing our team.
• To prepare for and follow up on conversations. We may use AI tools to summarise call transcripts and enquiry notes. We only use AI tools that are contractually prevented from using your data to train their models. Our lawful basis is legitimate interests in working efficiently.
• To keep our records accurate. We add business contact and company information from the sources in section 3, so we understand who we are speaking to. Our lawful basis is legitimate interests in keeping accurate records.
• To deliver our services to clients. We use client details to provide our services, manage the relationship and bill for work. Our lawful basis is performance of a contract, or legitimate interests in serving our clients where the contract is with your employer.
• To send you updates and marketing. We may email you about our services. Our lawful basis is legitimate interests in promoting our services. If you are a sole trader or partnership, we only do this with your consent or where you have bought or asked about similar services. Every marketing email includes an unsubscribe link, and you can object at any time.
• To show you our adverts on other platforms. With your consent, we use advertising cookies and pixels on this website so that platforms such as LinkedIn, Google and Meta can show you our adverts. Our lawful basis is consent, given through the cookie banner. You can withdraw it at any time with the "Cookie settings" link at the foot of every page.
• To show our adverts to business contacts we already know. If you have contacted us, booked a call or are a client, we may share your work email address with these platforms in hashed (scrambled) form so they can show our adverts to you. We never do this for people we have not dealt with directly. Our lawful basis is legitimate interests in reaching people who have dealt with us, and you can object at any time.
• To run this website and keep it secure. We use server logs and security tools to keep the site working and protect it from attacks and misuse. Our lawful basis is legitimate interests in keeping the site safe and available.
• To understand how the website is used. With your consent, analytics cookies show us how people use the site and which pages they read before getting in touch. Our lawful basis is consent, given through the cookie banner. You can withdraw it at any time with the "Cookie settings" link at the foot of every page.
• To meet our legal obligations. We keep certain records, such as accounting records, because the law requires it. Our lawful basis is legal obligation.
• To deal with legal claims. We may use your data to establish, exercise or defend legal claims, and to get advice from our insurers and professional advisers. Our lawful basis is legitimate interests in protecting the business.
• To protect someone's life or safety. In the rare case where it is needed to protect someone's vital interests, we may use your data for that purpose. Our lawful basis is vital interests.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by yours. You can ask us for details of that assessment.

We do not sell personal data.

5. Data we process for clients

When we run AI agents for a client, the client remains the controller of the data those agents process, and we act as a processor under a written agreement. That data is processed on isolated Azure tenancies that we manage, with no co-mingling between clients. UK data residency is available. Clients own every input and output, and a full audit trail is exportable on request. The client's own privacy notice governs that processing, and questions or complaints about it should go to the client first.

The sub-processors used for an engagement, including Microsoft Azure and the AI model providers, are listed in the client agreement.

6. Transfers outside the UK

Our service infrastructure runs on Microsoft Azure, and UK data residency is available for client workloads. Some of the providers in section 7 are based in the United States. These include Cloudflare (website hosting), HubSpot (our CRM and booking) and Google (website analytics), as well as some of our meeting recording, AI, data enrichment and advertising providers.

We only transfer personal data outside the UK where the law allows it, in one of two ways.

• To countries approved by UK regulations. For US providers, this is the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), where the provider is certified under it.
• Otherwise, under appropriate safeguards. We use the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and we assess whether the protection in the destination country meets the UK data protection test.

You can ask us for more information about the safeguards we use.

7. Who we share it with

• Our group. We share data with other Synextra companies where needed to deliver services or run the business.
• Service providers. We use suppliers to support the website and our operations. They act under contract and only on our instructions. They include:
  • Microsoft, for hosting, email and video calls
  • Cloudflare, for hosting and securing this website
  • HubSpot, for our CRM, booking and, with your consent, website tracking
  • Google, for website analytics, with your consent
  • Meeting recording and transcription providers
  • AI model providers, for summarising notes and transcripts
  • Business data and enrichment providers
  • Email delivery providers, for sending our emails
  You can ask us for a current list of the providers we use.
• Advertising platforms. We share data with platforms such as LinkedIn, Google and Meta for the advertising described in section 4. Where these platforms use data for their own purposes, they act as independent controllers and their own privacy notices apply.
• Professional advisers and insurers. We share data with them where needed for the purposes in section 4.
• Authorities. We share data with regulators, law enforcement and other authorities where the law requires or allows it.

8. How long we keep it

• Enquiry, booking and correspondence data and CRM records. We keep these for as long as we have a legitimate interest in doing so, unless you become a client. To decide this, we consider how recently we have been in contact, whether you are still interested in our services, and whether we need the record to deal with a query or complaint. We review these records at least once a year and delete or anonymise those we no longer need.
• Call recordings. We keep these only as long as we need them to prepare for an engagement or for staff training, and then delete them. Only authorised staff can access them.
• Contract and billing records. We keep these for as long as we need them, and for at least 6 years from the end of the financial year they relate to, as HMRC requires.
• Marketing preferences. If you unsubscribe, we keep a record of that so we do not contact you again.
• Cookie data. We keep this for the periods listed in our Cookie Policy.

We may keep data longer where we need it to deal with a legal claim or complaint.

9. Your rights

Under the UK GDPR, you have the following rights.

• Access. You can ask for a copy of the personal data we hold about you.
• Correction and erasure. You can ask us to correct inaccurate data and, in some circumstances, to erase it.
• Restriction and objection. You can ask us to restrict our processing, or object to processing based on legitimate interests.
• Direct marketing. You can object to direct marketing at any time, and we will stop.
• Portability. Where processing is based on consent or contract, you can ask for your data in a portable format.
• Withdrawing consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing we carried out before you withdrew it.

To exercise any of these rights, email [email protected] or write to us at the address in section 1. There is no charge. We will respond within one month. If a request is complex, we may extend this by up to two further months, and we will tell you why.

10. Complaints

If you are unhappy with how we have handled your personal data, you can complain to us. Email [email protected] or write to us at the address in section 1, and tell us what has happened. You do not need to use any particular wording or form.

We will acknowledge your complaint, investigate it without undue delay, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk. The ICO usually expects you to raise the matter with us first.

11. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

12. Security

We protect personal data with technical and organisational measures appropriate to the risk, including isolated client tenancies, access controls and audit logging. Synextra Ltd holds Cyber Essentials Plus and ISO/IEC 27001 certification.

13. Changes to this notice

We will post any changes on this page and update the date at the top. If a change significantly affects how we use your data and we have your email address, we will also tell you by email.

14. Contact

If you have questions about this notice or how we handle your data, email our privacy team at [email protected] or write to us at the address in section 1.