This policy explains how Aenigma Consulting ("Aenigma", "we", "us", "our") collects, uses and protects personal information when you visit aenigma.co.uk, book a call with us, use our Customer Portal, or work with us as a client or supplier.

We keep this short and plain. If anything is unclear, email info@aenigma.co.uk.

1. Who we are

Aenigma Consulting is the controller of the personal information described in this policy.

• Legal entity: Aenigma Consulting Ltd, a company registered in England and Wales, company number 13333428 — OR — Ulugbey Karagoz trading as Aenigma Consulting

• Address: 43 Sutherland Road, London, E17 6BU, United Kingdom

• Email: info@aenigma.co.uk

• Phone: +44 7923 987074

We are not required to appoint a Data Protection Officer. Questions about privacy go to info@aenigma.co.uk.

2. Information we collect

When you contact us or book a call Your name, email address, phone number (if given), company name, job title and anything you tell us about your business or project. Discovery calls are booked through Google Calendar's appointment scheduling, which collects your name and email address and any answers you give in the booking form.

When you become a client Contact details of your team members we work with, billing details (business name, address, VAT number, purchase order references), contracts, correspondence, meeting notes and project documentation.

When you use the Customer Portal (portal.aenigma.co.uk) Your name, email address, login details, and the information you view, submit or upload in the portal (for example project updates, requests, files and approvals).

When you visit our website Technical information such as pages viewed, referring page, approximate location (country/city derived from IP address), browser and device type. See section 7 (Cookies and analytics).

When you are a supplier, subcontractor or partner Business contact details, and payment and contract information.

We do not intentionally collect special category data (such as health, religion or ethnicity) and ask that you don't send it to us unless a project specifically requires it and we have agreed how it will be handled.

3. How we use your information and our lawful bases

What we doLawful basis under UK GDPRRespond to enquiries and hold discovery callsLegitimate interests (responding to people who contact us) or steps prior to entering a contractPrepare proposals and quotesSteps prior to entering a contractDeliver projects, provide the Customer Portal, provide supportPerformance of a contractInvoicing, accounting and tax recordsLegal obligationKeep the website and portal secure, prevent misuseLegitimate interests (security)Understand how the website is used so we can improve itLegitimate interests; consent where the law requires it for cookiesOccasional updates about our services to business contactsLegitimate interests (you can opt out at any time)Establish, exercise or defend legal claimsLegitimate interests

Where we rely on legitimate interests, we have considered your rights and expectations and concluded that our interests are not overridden by them. You can ask us for more detail on this.

We do not sell your personal information, and we do not use it to make decisions about you by automated means that have a legal or similarly significant effect.

4. Client data we process on your behalf

Much of our work involves building AI agents, automations, portals and integrations that handle our clients' own data (for example their customers, staff, candidates or event guests).

For that data, our client is the controller and Aenigma acts as a processor. We process it only on the client's documented instructions, under a written contract or data processing agreement, and not for our own purposes. If your information is in a system we have built or operate for one of our clients, please contact that organisation first; we will help them respond to you.

5. Who we share information with

We use trusted service providers to run our business. They process personal information on our behalf and under contract:

• Website hosting: Framer

• Email, calendar and documents: Google Workspace

• Customer Portal: Glide

• Transactional email: Resend

• Accounting and banking: Starling

• Professional advisers: accountants, lawyers and insurers, where necessary

We may also share information with subcontractors or delivery partners working with us on your project (you will be told who they are), with authorities where the law requires it, or with a buyer if our business is sold or restructured.

We keep an up-to-date list of the providers we use and will share it on request.

6. International transfers

Some of our providers are based in, or store data in, the United States or other countries outside the UK. Where this happens, we make sure the transfer is protected by one of the safeguards recognised under UK data protection law, such as:

• the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge"), where the provider is certified;

• UK adequacy regulations for the destination country; or

• the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Contact us if you'd like details of the safeguard used for a particular provider.

7. Cookies and analytics

Our website uses a small number of cookies and similar technologies:

• Strictly necessary – needed for the website and Customer Portal to work and stay secure (for example keeping you signed in to the portal). These do not require consent.

• Analytics – we use [Framer Analytics] to count visits and see which pages are popular. It gives us aggregated statistics only; we don't use it to identify you, build advertising profiles or track you across other websites. [Framer Analytics does not use cookies — confirm; if you add Google Analytics or similar, update this section and add a consent banner.] Under UK law, statistical analytics of this kind can be used without prior consent provided you can easily object. To opt out, [use the "Cookie settings" link in the footer / email info@aenigma.co.uk / use your browser's Do Not Track or tracker-blocking settings].

• Third-party services – if you click through to Google Calendar to book a call, or to our LinkedIn page, those services set their own cookies under their own privacy policies.

We do not use advertising or cross-site tracking cookies. If that changes, we will ask for your consent first.

8. How long we keep information

InformationRetentionEnquiries that don't become projectsUp to 2 years from last contactClient contracts, project records and correspondenceDuration of the engagement plus 6 years (legal claims limitation period)Invoices and accounting records6 years from the end of the financial year (HMRC requirement)Customer Portal accountsDuration of the engagement; deleted or anonymised within 90 days of it ending, unless the contract says otherwiseClient data processed on a client's behalfAs set out in our contract with that client; returned or deleted at the end of the engagementWebsite analyticsAggregated statistics kept indefinitely; no identifiable dataMarketing contactsUntil you opt out, or 2 years after last engagement

9. How we protect your information

We use appropriate technical and organisational measures, including: multi-factor authentication on business accounts, role-based access so only people who need data can see it, encryption in transit (HTTPS/TLS) and at rest where our providers support it, careful selection of providers with strong security practices, and deleting data we no longer need.

No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify the ICO and, where required, you.

10. Your rights

Under UK data protection law you have the right to:

• access the personal information we hold about you;

• rectify inaccurate or incomplete information;

• erase your information in certain circumstances;

• restrict how we use it in certain circumstances;

• object to our use of it where we rely on legitimate interests — including an absolute right to object to direct marketing;

• data portability, where processing is based on consent or contract and carried out by automated means;

• withdraw consent at any time, where we rely on it.

To exercise any of these rights, email info@aenigma.co.uk. We may need to confirm your identity. We will respond within one month of receiving your request (or of receiving any information we reasonably need to confirm your identity or clarify the request). For complex or numerous requests we may extend this by up to two further months and will tell you if so. There is normally no fee. When searching for information in response to an access request, we will carry out reasonable and proportionate searches.

11. Complaints

If you are unhappy with how we have handled your personal information, please complain to us first at info@aenigma.co.uk with the subject line "Data protection complaint". You can raise a complaint in any way that is convenient for you. We will:

1. acknowledge your complaint within 30 days of receiving it;

2. take appropriate steps to investigate it without undue delay and keep you updated on progress; and

3. tell you the outcome without undue delay.

If you are not satisfied with our response, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint

• Helpline: 0303 123 1113

• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Children

Our website and services are intended for businesses. We do not knowingly collect personal information from children under 18.

13. Links to other websites

Our website links to other sites, such as LinkedIn, Google Calendar and client websites in our case studies. We are not responsible for how those sites handle your information; please read their privacy policies.

14. Changes to this policy

We review this policy regularly and will update it when our services, providers or the law change. The "Last updated" date at the top shows when it was last revised. If we make significant changes that affect clients, we will tell you directly.