Privacy notice

1. Who I am

Warm Desk is a trading name of Conor Forde, a sole trader in England. I am the controller of the personal data described here, which means I decide how it is used and I am responsible for it.

• Email: conor@warmdesk.co.uk
• Postal address: available on request by email

I'm a one-person business, so there is no data protection officer. Questions about this notice come straight to me.

2. People at businesses I contact

Warm Desk offers AI workshops, audits and builds to small and medium-sized UK businesses. At the moment that means recruitment agencies, customer success teams at business software companies, and estate and letting agents. To do that I research businesses that might find my services useful and email the people who run them.

Which businesses

Only limited companies, PLCs and limited liability partnerships registered at Companies House. I never cold email sole traders or ordinary partnerships, and this is enforced in software before anything is written.

What I collect

• Company details: name, company number, status, registered office, industry codes, the average number of employees from its filed accounts, its website and its office locations.
• For a named contact: name, job title or officer role, and work email address. Where a company publishes a general address such as hello@ or info@, I use that instead of a named person.
• What the business says about itself in public: the kinds of roles or services it advertises, the tools it says it uses, and similar business facts.
• A record of what I sent, when, whether you replied, and any opt-out.

I don't collect anything about your personal life, and nothing in the special categories (health, ethnicity, religion and so on).

Where it comes from

• The Companies House register, including the officers list and filed accounts.
• The company's own website.
• Job adverts the company has published, through the Reed job search service.
• Web search, through Exa, to find a company's website. Exa receives company names and web addresses only. I never collect data from anyone's LinkedIn profile and I never log in to LinkedIn to research anyone.
• Google Maps business listings, through Google's Places service, only to find a company's website. I keep the listing's reference number and nothing else from it.
• Hunter, an email-finding and verification service, to find or check the work address of a director named at Companies House. I only use an address Hunter confirms is valid.
• Public customer stories published by recruitment software providers, to note which software an agency uses. I take the agency's name and nothing else.
• Public membership registers of trade and redress bodies, to check a business is a member.

I never buy or rent contact lists.

Why, and the lawful basis

I use this data to decide whether a business is a good fit and to send a short sequence of business emails about my services: one email and at most two shorter follow-ups, then I stop for good unless you reply.

The lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). My interest is telling relevant businesses about a business service. I've written a legitimate interests assessment that weighs this against your interests and sets out the safeguards I use. You can ask for a copy.

The Privacy and Electronic Communications Regulations allow marketing emails to companies and LLPs without prior consent, as long as the sender is identified and you can opt out easily. Every email I send names me, gives a working way to opt out and links to this notice.

Stopping it

You have an absolute right to object to direct marketing. Reply "no thanks", use your email app's unsubscribe button, use the unsubscribe page, or email me. I stop within minutes and never later than 48 hours, cancel any scheduled follow-up, and add your address to a suppression list so it isn't contacted again.

People I already know

If I know you personally, my software is set never to cold email you. I'll contact you myself or not at all.

3. People who contact me

If you email me, reply to an email or use the contact form, I keep your name, email address, company and what you wrote, so I can reply and keep a record of our conversation. The lawful basis is legitimate interests in answering you, or taking steps at your request before a contract. If your message is a request about your data or a complaint, I also keep the record I need to show how it was handled.

4. Clients and workshop attendees

For a business that books with me, I keep the contact details of the people I deal with, what we agreed, invoices and payments. The lawful basis is the contract with your business, and my legal obligations for tax records.

Before a workshop, attendees fill in a short survey about how long admin tasks take, which AI tools they use and how confident they feel. I use the answers to tailor the session and to measure what changed at 30 days. The lawful basis is the legitimate interests of your employer and me in running and measuring the training. Workshop exercises use made-up data only, so I never handle candidate or client data during a workshop.

If I write a case study, it uses team-level numbers. I only name a business or quote a person with their written permission.

If an audit or build means I process personal data on your business's behalf, we sign a separate data processing agreement first, and your business remains the controller of that data.

5. Visitors to this website

This website sets no cookies and loads no advertising or social media trackers. It is hosted by Cloudflare, which processes your IP address and basic browser information to deliver the pages and protect them from attacks. I use Cloudflare Web Analytics to count page views. It doesn't use cookies and doesn't identify individual visitors.

The contact and unsubscribe forms use Cloudflare Turnstile to check they're sent by a person rather than a bot. Turnstile looks at technical signals from your browser for that purpose only.

6. How I use AI

I use software, including AI models from Anthropic, to help me research businesses, summarise what I find, draft emails and sort replies, for example so that an opt-out is acted on straight away. I set the rules the software follows and check its work. AI is never used to make a decision that has a legal or similarly significant effect on you.

The AI providers I use process this data under business terms and don't use it to train their models.

7. Who I share data with

I don't sell personal data. I share it only with service providers who process it for me under contract, and with authorities where the law requires it.

I may also share data with an accountant or HMRC for tax purposes, with professional advisers, or if the law requires it.

8. Data outside the UK

Some of these providers process data in the United States or the European Economic Area. Where data goes to the US, it's protected either because the provider is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), or by the International Data Transfer Addendum approved by the UK Information Commissioner, built into the provider's terms. The UK recognises the European Economic Area as providing adequate protection. Ask me if you'd like details for a particular provider.

9. How long I keep it

10. Keeping it safe

Only I can see this data. My accounts use two-factor authentication, data is encrypted in transit, and the software that reads websites and incoming emails is kept apart from the software that can send email. I use the least data each task needs.

11. Your rights

You can ask me to:

• give you a copy of the personal data I hold about you;
• correct anything that's wrong or incomplete;
• delete it (I'll keep your address on the suppression list only if you also want to stay off my list, and I'll tell you if I do);
• restrict how I use it while a question is sorted out;
• stop using it, which for marketing I always do;
• give you data you provided in a reusable format, where that right applies.

Use the contact form or email conor@warmdesk.co.uk. It's free, and I'll respond within one month. If I need to confirm who you are, I'll ask for as little as possible.

12. Complaints

If you're unhappy with how I've used your data, please tell me first through the contact form or by email. I acknowledge every complaint within 30 days, look into it properly, keep you updated and tell you the outcome.

You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

13. Changes to this notice

I'll update this notice when what I do changes, and change the version and date at the top. If a change affects you significantly, I'll tell you before it takes effect where I can.