Privacy Notice
We need enough information to resolve a case. We do not need an excuse to hoard it.
1. Controller and contact details
The controller is WEIRD WISDOM LIMITED (company number 15665363), trading as HANDLED, registered office 1 Alfriston Park, Seaford, England, BN25 3LS.
2. Information we may process
- identity, contact and business details;
- counterparty, account, order, contract and complaint details;
- case descriptions, chronology, desired outcome and value;
- invoices, contracts, screenshots, photographs, messages, emails and other evidence;
- call recordings, transcripts, complaint references and commitments made during a case;
- payment and invoicing records (we do not intend to store full payment card details ourselves);
- technical and security information from the website and case portal;
- information about employees, representatives and other people contained in case evidence.
3. Where information comes from
We receive information from you; other people authorised by you; counterparties and their staff; ADR or ombudsman schemes; public registers and public sources; payment/communications providers; and professional or enforcement providers involved in a case.
4. Purposes and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Assessing an enquiry and entering a Case Mandate | Steps at your request before contract; contract |
| Running an accepted case and communicating with you | Contract; legitimate interests where another person's data is involved |
| Communicating with counterparty staff, organising evidence and pursuing complaints | Legitimate interests in resolving and documenting legitimate business disputes |
| Accounting, tax, company and regulatory records | Legal obligation |
| Fraud prevention, security, misuse detection and legal claims | Legitimate interests; legal obligation where applicable |
| Optional marketing to business contacts | Consent where required, or legitimate interests where lawful and appropriately balanced |
Where we rely on legitimate interests, we assess necessity and balance those interests against individuals' rights. You can ask for information about a relevant assessment.
5. Special category and criminal offence data
Most HANDLED cases should not require sensitive personal data. However, evidence may incidentally contain health, trade union, racial/ethnic, religious, political or other special category information, or allegations/records concerning criminal offences.
Where necessary for establishing, exercising or defending legal rights or prospective legal proceedings, special category data may be processed under Article 9(2)(f) UK GDPR. Criminal offence data is processed only where an Article 6 basis and an appropriate Schedule 1 Data Protection Act 2018 condition apply; for legal rights and proceedings that may include Schedule 1 paragraph 33. We minimise and restrict access to such data.
6. Calls, transcription and AI processing
Calls may be recorded or transcribed where this is necessary and proportionate for evidence, transaction records, case accuracy, quality or dispute resolution. Participants will be told that recording is taking place and why.
We may use AI tools for document extraction, classification, chronology, drafting, next action suggestions and verification. We design the service so that AI does not have unlimited authority to settle claims, admit liability or issue court proceedings. We do not intend to use case evidence to train public foundation models.
Where automated screening helps assess eligibility, final decisions with significant contractual or legal effect will be subject to appropriate human oversight.
7. Who we share information with
Where necessary and proportionate, information may be shared with the counterparty and its representatives; ADR/ombudsman providers; cloud hosting, communications, e-signature, payment and security processors; professional advisers; authorised legal providers; court or enforcement providers where separately instructed; regulators, courts or authorities where required by law; and acquirers during a genuine business sale subject to appropriate confidentiality.
8. International transfers
If a processor stores or accesses personal data outside the UK, we will use an appropriate lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any required transfer risk assessment.
9. Retention
| Record | Default retention |
|---|---|
| Unaccepted enquiries | 6 months after final contact, unless needed for fraud/security or a legal dispute |
| Accepted case file, mandate, authority, communications and outcome evidence | 6 years after case closure, unless a longer period is reasonably required by litigation, limitation, enforcement or law |
| Call recording/transcript | 12 months by default; if evidentially material, retained with the case record for the case retention period |
| Invoices, VAT/accounting records | At least 6 years where required for tax/VAT record keeping |
| Cookie/consent preferences | Up to 24 months, unless refreshed sooner |
| Suppression list for people who opt out of marketing | As long as reasonably necessary to respect the request to opt out |
Retention is reviewed and data may be deleted or anonymised earlier where it is no longer needed and no legal reason requires retention.
10. Your rights
Depending on the circumstances, you may have rights to access, rectify, erase or restrict personal data; object to certain processing; receive portable data; withdraw consent where consent is relied upon; and complain to the Information Commissioner's Office. Rights are subject to lawful exemptions, including where information is needed for legal claims or the rights of others.
11. Information about other people
If you upload information about another person, only provide what is reasonably relevant to the case. Do not send unnecessary medical, criminal, identity or financial information. We may redact, quarantine or delete irrelevant material.
12. Security
Production controls should include encryption in transit and at rest, role based access, strong authentication, malware scanning for uploads, audit logs, least privilege access, backup/recovery controls and incident response procedures.
13. Complaints and updates
Privacy complaints can be sent to privacy@handledhere.com. You may also complain to the ICO. We may update this notice where the service, law or processing changes; material changes will be highlighted.