Privacy policy

Last updated: 10 August 2026

This policy explains how North West Data Products Ltd collects, uses, shares and protects personal information. It covers this website and Hujra, our software for handling customer enquiries, bookings and job records.

1. Who we are

North West Data Products Ltd (“we”, “us”) is a company registered in England and Wales, company number 17388764. Our registered office is Unit A, 82 James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE.

For questions about this policy or about how we handle personal information, contact us at privacy@northwestdata.io.

2. Our two roles

We handle personal information in two distinct roles, and your rights differ slightly depending on which applies.

As a controller

For information about visitors to this website, people who contact us, and our own clients and suppliers, we decide why and how the information is used. We are the data controller for that information.

As a processor

When a business uses Hujra to handle enquiries from its own customers, that business decides why and how their customers' information is used. It is the controller; we act as its processor, handling that information on its instructions. We act as a processor only under a written agreement with that business, which sets out what we may do with the information and what happens to it when the arrangement ends. If you are a customer of a business that uses Hujra, that business is your first point of contact — though you may also contact us and we will help.

3. Information we collect, and why

3.1 Visitors to this website

This website sets no cookies and uses no analytics, advertising or tracking of any kind. We do not build profiles of visitors. Our hosting provider records standard server logs, which may include IP addresses, for security and to keep the site running reliably.

3.2 People who contact us

If you email or call us, we hold your contact details and the content of your message, so that we can reply and keep a record of our correspondence.

3.3 Information handled through Hujra

When someone contacts a business that uses Hujra, we handle the following on that business's behalf:

• contact details — name, telephone number, WhatsApp profile name, and email address where given;
• the content of messages exchanged between the customer and the business, including any photographs or files sent;
• job details — the service requested, the address where work is to be carried out, access notes, and how urgent it is;
• appointment and scheduling information, including dates, times and which engineer is assigned;
• job records — what was quoted, what work was carried out, its status, and what is owed.

We use this information only to deliver the service to the business that instructed us: routing and answering enquiries, booking work in, keeping job records accurate, and supporting and securing the system. We do not use it for our own marketing, we do not sell it, and we do not share it with anyone for their own purposes.

4. Messaging channels, including WhatsApp

Hujra receives and sends messages over the WhatsApp Business Platform, operated by Meta, as well as by telephone and web form. Where a conversation happens over WhatsApp:

• we receive the messages sent to the business, along with the sender's telephone number and WhatsApp profile name;
• we send replies on the business's behalf, through the same channel;
• Meta handles the delivery of those messages, and its own handling of your information is governed by the WhatsApp privacy policy, not by this one.

Messaging a business is voluntary. You can stop at any time by asking the business not to contact you further, and that request will be honoured.

5. Automated processing and AI

Parts of Hujra are automated. Incoming messages may be classified by topic and urgency, structured details may be extracted from them, and replies may be drafted automatically. Some of these steps use AI language models supplied by third-party providers.

Three things are worth stating plainly:

• A person stays in control. Automated replies follow rules the business configures, and staff can review, edit or override them. Anything falling outside those rules is escalated to a person.
• No solely automated decisions with legal or similarly significant effects are made about you within the meaning of Article 22 of the UK GDPR.
• Your information is not used to train AI models. We do not permit our providers to use information handled through Hujra to train or improve their models, and we do not do so ourselves.

6. Our lawful bases

Where we act as a controller, we rely on:

• Legitimate interests — to respond to enquiries, to run and secure our business, and to maintain our records. We have considered your rights and do not believe this processing overrides them.
• Contract — to provide our services to clients and to take steps at their request before entering a contract.
• Legal obligation — to meet our accounting, tax and other legal duties.

Where we act as a processor, the lawful basis is determined by the business that instructed us, not by us.

7. Who we share information with

We share personal information only with service providers who help us run the service, each bound by contract to protect it and to use it only on our instructions. These fall into the following categories:

• cloud hosting and database providers;
• Meta Platforms, for delivery of WhatsApp messages;
• AI language model providers, for the automated steps described in section 5;
• email and communication providers.

We may also disclose information where the law requires it, or to establish, exercise or defend legal claims. We do not sell personal information, and we do not share it for advertising.

8. Where information is stored

We store information within the United Kingdom or the European Economic Area wherever we can. Where a provider processes information outside those areas, we rely on UK adequacy regulations or on standard contractual clauses together with the UK International Data Transfer Addendum, so that your information keeps an equivalent level of protection.

9. How long we keep it

We keep personal information only as long as it is needed for the purpose it was collected for.

• Enquiries to us: up to two years from our last contact.
• Information handled through Hujra: for as long as the business that instructed us remains our client, and in line with its instructions. When our agreement with that business ends, we return or delete the information within the period that agreement sets, unless the law requires us to keep it.
• Records we must keep by law, such as accounting records: for as long as the relevant law requires.

10. Security

We take appropriate technical and organisational measures to protect personal information, including encryption of data in transit and at rest, access controls restricting who can reach it, and logging and monitoring. No system can be perfectly secure, but we take this seriously and review our measures as the service develops.

11. Your rights

Under the UK GDPR you have the right to:

• ask for a copy of the personal information we hold about you;
• have inaccurate information corrected;
• ask us to delete information, in certain circumstances;
• ask us to restrict how we use it, in certain circumstances;
• object to processing carried out on the basis of legitimate interests;
• receive information you gave us in a portable format, in certain circumstances;
• withdraw consent at any time, where we relied on consent.

To exercise any of these, contact us at privacy@northwestdata.io. We will respond within one month. There is no charge. If your request concerns information we hold as a processor for another business, we will pass it to that business promptly and support them in answering it.

12. Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

13. Children

Our services are provided to businesses and are not directed at children. We do not knowingly collect information about children. If you believe we hold information about a child, contact us and we will delete it.

14. Changes to this policy

We may update this policy as our services develop or as the law changes. The date at the top shows when it was last revised. Where a change materially affects how we use your information, we will take reasonable steps to tell you.

15. Contact us

North West Data Products Ltd
Unit A
82 James Carter Road
Mildenhall
Bury St. Edmunds
IP28 7DE
privacy@northwestdata.io