Privacy Notice

1. Who is responsible for your information?

Trading brand: Lorenwick Systems.

Legal operator: Mateusz Ryszard Drozd, sole trader trading as Lorenwick Systems.

Postal/service address: Flat 1, 62 Hounslow Road, Hanworth, Feltham, TW13 6QH, United Kingdom.

Privacy contact: [email protected].

For information submitted directly to Lorenwick Systems through this website, the legal operator will normally act as controller. When Lorenwick Systems handles customer enquiries on behalf of a client business, that client will normally decide why the customer information is used and Lorenwick Systems will generally act as its processor under the client’s instructions.

2. Information we may collect

• name and business name;
• email address and telephone number;
• the contents of a contact or support enquiry, including any question about a trial;
• if you use the chat assistant on our website (“Ask Lorenwick”), the messages you type, the address of the page you are viewing and a short extract of your recent chat, which is sent with each new message so that the assistant can follow the conversation;
• limited public business-contact information used for targeted B2B prospecting, such as business name, public business phone/email, named business contact where relevant, source and outreach/objection status;
• technical/security information needed to operate and protect the website or service;
• for client enquiry workflows, customer message content and details supplied in that message, such as vehicle/job information, requested booking time and contact details.

Website contact enquiries: where the online contact form is enabled, it collects the business/contact details you enter, the service you are asking about and your message. Online trial requests are not currently offered through the website; if a trial-request form is separately enabled in future, it would also collect your postcode, current enquiry channels, approximate enquiry volume and optional business notes. Please do not include passwords, payment details, private customer messages or other sensitive information.

Where prospect information is obtained from a public business source rather than directly from the individual, Lorenwick records only what is reasonably needed for targeted business outreach and suppression/objection handling.

3. Connected messaging channels

If a client business connects a supported Facebook, Instagram or WhatsApp business channel to Lorenwick, we may process the minimum platform information needed to provide that connection. Depending on the channel, this may include business/Page/account/phone identifiers, message and event identifiers, message content, sender details supplied by the platform, timestamps and delivery/status information.

We use this information to bind the selected channel to the correct Lorenwick client workspace, receive and organise enquiries, send permitted replies, prevent duplicate processing, identify delivery or connection problems and support the service requested by the client business.

We do not ask a client business to give Lorenwick its Facebook, Instagram or WhatsApp password, app secret, access token, verification code or recovery code. Provider credentials required by a live integration are intended to be handled server-side and not exposed in customer-facing browser code.

A client business can ask Lorenwick to disconnect a connected channel. Personal-data deletion requests can be made using our data deletion instructions.

4. Why we use information and our expected lawful bases

We do not plan to use contact-form information for unrelated marketing without an appropriate legal basis and required electronic-marketing permissions.

You can object to Lorenwick using your personal data for direct marketing at any time by asking us to stop. We keep a minimal suppression record where necessary so that an objection is respected and you are not contacted again through the relevant marketing channel.

5. AI-assisted processing and human handover

The service may use automated tools, including AI, to classify enquiries, extract useful details and prepare or send routine responses within configured limits. V1 is designed so that prices, booking availability, safety advice and other matters requiring human judgement are handed back to the client business rather than invented or automatically decided.

The website contact form delivers your submitted details to Lorenwick for review. Online trial requests are not currently offered through the website. Sending an enquiry, including an email or a question about a trial, does not start a trial, confirm a channel connection or create a paid subscription. Lorenwick does not route these form submissions through its Make/AI enquiry Assistant for email delivery; the website chat assistant has its own processing path, described below.

Website chat assistant: “Ask Lorenwick” is an automated assistant that answers general questions about Lorenwick’s services, pricing and enquiries. It cannot book appointments, start a trial, take payment, confirm availability or arrange a callback. It is not designed to collect your contact details and does not forward your conversation to our team; if your question needs a person, it will ask you to email [email protected]. Each message is sent from our website, which is hosted by Cloudflare, to our workflow provider Make, which uses OpenAI to write the reply. Messages that appear to contain passwords, verification codes, payment-card numbers, API keys or access tokens are blocked before they leave our website, and the number of messages that can be sent is limited to prevent misuse. Please do not enter personal, financial or other sensitive information in the chat.

We do not intend V1 to make solely automated decisions that produce legal or similarly significant effects on individuals.

6. Who we may share information with

Information may be processed by service providers used to operate Lorenwick, including hosting/runtime, workflow automation, AI, authentication, business email/storage and the selected messaging provider. Depending on the enabled service these may include providers such as Cloudflare, OpenAI, Make, Google Workspace, Clerk and Meta products.

Online contact-form delivery: Cloudflare hosts the form and provides Turnstile verification. Resend (Plus Five Five, Inc.) processes the submitted enquiry details to deliver an email to [email protected], which forwards to the existing [email protected] business mailbox provided by IONOS. This delivery route is used only where the online form is enabled; it would also be used for any trial-request form that is separately enabled in future.

Website chat assistant: Cloudflare hosts the website and its abuse protection, Make provides the workflow that passes each message on, and OpenAI generates the reply.

Cloudflare Turnstile processes technical signals, including IP address and browser/device signals, to detect abuse. Cloudflare also processes signals to improve Turnstile. See its Turnstile Privacy Addendum.

Only providers needed for the relevant service are used. Lorenwick maintains a sub-processor and transfer record and reviews applicable data-processing terms before production use.

We may also disclose information where required by law, to protect legal rights, or in connection with a legitimate business restructuring, subject to appropriate safeguards.

7. International transfers

Some technology providers may process information outside the UK. Where a restricted transfer applies, Lorenwick uses an appropriate UK transfer mechanism where required, such as an adequacy regulation, UK International Data Transfer Agreement, UK Addendum to Standard Contractual Clauses, or another lawful safeguard.

Resend: its published provider information says customer message content and delivery data are stored in the United States. A selected Ireland sending region does not mean that stored email data stays in the EU. Resend's Data Processing Addendum includes Standard Contractual Clauses and the UK Addendum for relevant transfers. You can contact our privacy address for information about applicable safeguards and how to obtain a copy.

Website chat assistant: Make and OpenAI may process chat messages outside the UK. Where this is a restricted transfer, the safeguards described above apply.

Provider location and transfer safeguards are recorded as part of Lorenwick's supplier review and are kept under review as the production stack changes.

8. How long we keep information

We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, plus any justified legal, security or dispute period.

Live end-customer enquiries: Lorenwick's V1 default is 90 days after the last relevant activity or closure. A client business may instruct a shorter period. A longer period requires a documented purpose and instruction.

End of service or non-converted trial: after any agreed return/export window, live client-controlled customer data is targeted for deletion within 30 days, subject to legal obligations and unavoidable provider backup-expiry periods.

Operational/audit metadata: content-free reliability/security metadata may be kept for up to 180 days by default where needed for incident investigation, delivery reconciliation or service reliability.

Lorenwick prospects and non-converted trial requests: personal contact/details are normally kept for up to 90 days after the last meaningful sales/trial interaction unless the person asks us to stop sooner, the business converts to a client, or a separate lawful reason requires a different period.

Website-form security records: the dedicated abuse guard stores secret-salted hashes of IP/request identifiers and submitted-payload digests, quota counters and expiry information; it is not the enquiry-message archive. Request identifiers expire after 26 hours and quota records use short UTC-window expiry periods. Cleanup is configured during request processing and through a daily scheduled job. Mailbox correspondence and provider delivery history are separate copies governed by the enquiry policy and relevant provider retention; deleting a mailbox email does not by itself delete provider records or backups.

Website chat assistant: our website does not keep a transcript of your chat; the conversation is held only in your browser until you close or reload the page. To prevent misuse, we store a secret-salted hash of your IP address with a short-lived message counter, which expires about an hour later and is deleted when the assistant is next used; shared hourly and daily counters contain no visitor identifier. Our Make workflows are configured not to keep the content of chat messages in their run history; Make keeps basic run records. OpenAI does not use API data to train its models by default and generally keeps it for up to 30 days to monitor for abuse; depending on how a request is made, it may also keep a stored copy of the response for a limited period.

Direct-marketing suppression: where someone objects or opts out, Lorenwick may keep the minimum contact identifier and objection metadata for as long as reasonably necessary to make sure that person or business is not contacted again through the relevant marketing channel.

Client contract and acceptance evidence: after a client relationship ends, Lorenwick may keep a minimal record of the contract, accepted legal-document versions, acceptance identity/role and related contractual evidence for up to six years as a working England-and-Wales limitation/defence period. This is kept separately from live customer-enquiry content and is not used to continue the service.

Business Blueprint onboarding: uploaded reference images, extraction candidates and editable onboarding source data are kept for up to 30 days after successful Blueprint submission. Approved Blueprint information is retained for the service relationship and then handled under the client offboarding process.

If an onboarding link expires without being submitted, its draft onboarding data and uploads are scheduled for deletion after a 30-day grace period.

9. Your rights

Depending on the circumstances and lawful basis, UK data-protection law may give you rights to access, correct, erase or restrict use of your information, object to certain processing, and receive portable data. Where processing relies on consent, you may withdraw that consent.

If your request relates to an enquiry handled for one of our client businesses, we may need to pass the request to that business as controller and assist it in responding.

For a clear deletion-request route, see our data deletion instructions.

10. Complaints

Please contact us first using the privacy contact above. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator.

11. Security

We aim to use access controls, business-controlled accounts, appropriate authentication and least-privilege access. Public forms and integrations will not intentionally expose API keys, access tokens or raw automation webhooks in browser code.

12. Changes to this notice

We will update this notice when the website, service providers, data flows or legal position materially change. The current version and its last-updated date are shown below.