Privacy
Privacy notice
Who we are
Medlock Systems is a commercial transformation and intelligent automation consultancy. This notice explains how we collect and use personal information, and what rights you have.
The controller responsible for your information is MEDLOCK SYSTEMS LTD, a company registered in England and Wales under company number 17552122, with its registered office at 20 Wenlock Road, London, N1 7GU.
You can contact us about anything in this notice, including your rights, at:
- Email: tom@medlocksystems.com
- Post: MEDLOCK SYSTEMS LTD, 20 Wenlock Road, London, N1 7GU
We are a small, founder-led business and are not required to appoint a data protection officer. Our founder, Tom Calder, is responsible for data protection.
Summary
We use business contact information to respond to enquiries, hold discovery calls, find and contact potential clients, and deliver our services.
- We work with businesses, not consumers. Most of the information we hold is about people in their professional role: name, job title, employer and business contact details.
- Our website uses no cookies, analytics or tracking.
- We may contact you about our services if you work in a role relevant to them. You can tell us to stop at any time, and we will.
- We do not sell personal information, and we do not make decisions about you using automated processing alone.
- When we work for a client, any personal information the client gives us is used only to deliver that engagement, under the client's instructions.
Information we collect
What we collect depends on how you deal with us.
| Activity | Information | Where it comes from |
|---|---|---|
| Visiting our website | IP address, browser type, pages requested and time of request, held in our hosting provider's server logs | Your browser, automatically |
| Sending an enquiry | Name, work email, organisation, role (optional), area of interest, your message, preferred next step (optional), and which page you contacted us from | You, through our enquiry form |
| Booking a discovery call | Name, email, chosen time, and any answers you give on the booking form | You, through our booking page |
| Emailing or meeting us | Your contact details, what we discuss, and our notes of the meeting | You, and our own notes |
| B2B prospecting | Name, job title, employer, business email, business phone number, professional profile URL, company details (sector, size, location), and a record of our contact with you | Business contact data providers, professional networking sites such as LinkedIn, company websites and public registers such as Companies House |
| Client engagements | Contact details of client staff, contract and billing records, and information the client provides for the work | Our clients and their staff |
| Suppliers and partners | Business contact details and correspondence | You or your organisation |
We do not intentionally collect special category information, such as health, religion or ethnicity, or information about criminal convictions. Please do not include it in enquiries or in information you share with us.
Our services are for businesses. We do not knowingly collect information about anyone under 18.
How we use information, and our lawful bases
Data protection law requires a lawful basis for each use. Ours are set out below.
| Purpose | Lawful basis |
|---|---|
| Running and securing our website | Legitimate interests: keeping the site available and protected from misuse |
| Responding to enquiries and arranging discovery calls | Legitimate interests: responding to people who contact us about our services |
| Holding discovery meetings and keeping notes | Legitimate interests: understanding a potential client's needs and preparing a proposal |
| Finding and contacting potential clients (B2B prospecting) | Legitimate interests: promoting our services to organisations likely to benefit. Where the law requires consent for marketing emails, we rely on consent (see B2B prospecting) |
| Delivering client engagements | Contract, where the client is an individual such as a sole trader. Otherwise legitimate interests: working with the client's staff to deliver the contract with their organisation |
| Invoicing, accounting and tax records | Legal obligation |
| Keeping a record of people who have asked us not to contact them | Legal obligation and legitimate interests: making sure we respect that request |
| Handling complaints, and establishing or defending legal claims | Legitimate interests and legal obligation |
We only rely on legitimate interests where they are not outweighed by your rights and interests. We only contact people in their professional capacity, about matters relevant to their role.
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
B2B prospecting and marketing
We may contact people whose role suggests our services could be relevant to their organisation, typically owners, directors and commercial or operations leaders.
Where your details come from. We obtain business contact information from business contact data providers, professional networking sites such as LinkedIn, company websites and public registers such as Companies House. Our first message to you will say where your details came from.
How we contact you.
- Email. We email named contacts at limited companies, limited liability partnerships and public bodies about matters relevant to their role. We do not send marketing emails to sole traders or ordinary partnerships unless they have agreed to hear from us. Every email identifies us and includes a simple way to opt out.
- Phone. Before calling, we check numbers against the Corporate Telephone Preference Service, the Telephone Preference Service and our own do-not-contact list. We do not make automated marketing calls.
- LinkedIn. We may send connection requests or messages through LinkedIn, in line with LinkedIn's terms and the same rules as email.
Telling us to stop. You can object to marketing at any time, and we will stop. Reply to any message, use the opt-out link in our emails, tell us on a call, or email tom@medlocksystems.com. We keep your name, contact details and the date of your request on a suppression list so we do not contact you again, including if your details later reach us from another source.
Keeping it current. We remove prospecting information we no longer need. See How long we keep information.
Meetings, transcription and AI-assisted analysis
Video meetings. We hold meetings using Google Meet, unless you prefer another platform. We do not record meetings by default.
AI note-taking. We may use an AI tool to transcribe a meeting and produce notes. If we do, we will tell you before the meeting starts, and we will not use it if you object. Transcripts and notes are used only to record what was discussed and agree next steps. Transcripts are deleted within 90 days; the notes are kept with the rest of our records about you.
AI-assisted analysis. We use AI tools, including Claude by Anthropic, to help with research, analysis and drafting recommendations. When this involves information about you or a client:
- we only use information that identifies you or a client with AI tools covered by data processing terms with the provider
- we share only what the task needs, and remove personal details where we can
- recommendations are reviewed and finalised by a person; AI does not make decisions about you
Client engagements
When an organisation engages us, we hold contact details for the people we work with there, along with contract, billing and project records. We are the controller of that information.
Clients may also share information about their own staff, customers or suppliers so we can review processes and systems, for example CRM records or job data. For that information, the client is the controller and we act as its processor. We use it only to deliver the agreed work, under the terms of our contract with the client, and return or delete it when the engagement ends.
If your information reaches us through one of our clients, please contact that client first about how it is used. We will help them respond.
International transfers
Several of our providers process information in the United States, and some may use other countries. When information leaves the UK, we rely on the transfer safeguards in each provider's terms, which include:
- a UK government adequacy decision for the destination country, including the UK Extension to the EU–US Data Privacy Framework for certified US companies
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, in the provider's terms
You can ask us for details of the safeguard that applies to a particular provider.
How long we keep information
We keep information only as long as we need it. After that, we delete it or make it anonymous.
| Information | How long we keep it |
|---|---|
| Enquiries and discovery call bookings that do not lead to work | 24 months from our last contact with you |
| Enquiry form submissions held by our website host | Up to 30 days, after transfer to our own records |
| Prospecting information, if you do not engage with us | 12 months from when we obtained it |
| Prospecting information, if you engage but do not become a client | 24 months from our last contact with you |
| AI meeting transcripts | Up to 90 days |
| Client contracts, invoices and engagement records | 6 years after the end of the financial year in which the engagement ends |
| Information a client provides for an engagement | Until the engagement ends, then returned or deleted as the contract requires |
| Suppression list (do-not-contact) | For as long as we carry out marketing, so we can respect your request |
| Website server logs | As set by our hosting provider, for security and troubleshooting |
We may keep information longer if we need it for a legal claim or complaint, or if the law requires.
Your rights
You have the right to:
- access the information we hold about you and get a copy
- correct information that is inaccurate or incomplete
- delete your information in certain circumstances
- restrict how we use your information in certain circumstances
- object to our use of your information based on legitimate interests
- object to direct marketing at any time. This right is absolute: if you object, we stop
- data portability, where we rely on contract or consent and process information by automated means
- withdraw consent at any time, where we rely on consent
To use any of these rights, email tom@medlocksystems.com. We will respond within one month. We may need to confirm your identity first. There is normally no charge.
Complaints
If you are unhappy with how we have handled your information, please tell us first at tom@medlocksystems.com. We will acknowledge your complaint within 30 days and respond as quickly as we can.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
Security
We protect information with access controls, encrypted connections, and by limiting access to those who need it. We choose service providers with appropriate security measures.
Changes to this notice
We will update this notice when our practices change, and show the date of the latest version below.
Last updated: 30 October 2026