Privacy notice
Last updated: 11 July 2026
Who we are
This website is run by Damien Riley, trading as Five Star CS Systems (“we”, “us”, “our”), a sole trader based in the United Kingdom. We’re the data controller for the personal data described in this notice, and we’re registered with the ICO, registration number ZC192015.
- Contact: damien@5starcssystems.com
- Postal address: Unit 167998, PO Box 7169, Poole, BH15 9EL
What we collect, why, and our lawful basis
Here’s what we collect, when, and why.
| What we collect | When | Why | Lawful basis |
|---|---|---|---|
| Your name, email and message | When you use our contact or enquiry form | To read and reply to your enquiry | Legitimate interest (you asked us to get in touch) |
| Your email address | When you sign up for a guide or our updates | To send you the thing you asked for and our updates | Consent (you opted in, and you can opt out any time) |
| Your business and contact details, and billing records | When you become a client | To deliver the service and meet our tax and legal duties | Contract, and legal obligation for the records the law makes us keep |
| Basic, privacy-first usage data | When you browse the site | To keep the site working and secure | Legitimate interest. If a non-essential analytics or tracking cookie is ever added, the basis becomes consent and a cookie banner is required, see the cookie policy. |
| Your chat messages, plus a session and device reference stored in your browser | When you use the website chat | So the assistant can answer you, hold the thread of the conversation, and offer to pick up a recent topic on the same device. Chat records are auto-deleted within 90 days | Legitimate interest (you asked it something), and you can ask us to erase your chat at any time |
| Your name and contact details, if you choose to leave them in the chat | When you ask us to get back to you | To respond to your enquiry. Kept for 12 months, then reviewed | Legitimate interest (you asked us to get in touch) |
| Your name, email and chosen time | When you book a call with us in the chat | To hold the meeting and send you the confirmation with the video call link | Legitimate interest (you asked for the call) |
We don’t sell your personal data, and we don’t use it for automated decisions that significantly affect you.
The website assistant (AI transparency)
If our site has a chat assistant, it’s an AI assistant and it answers your questions directly. It sticks to general information, never takes payment, and passes you to a person for anything significant or that it can’t handle. It’s built to keep sensitive details (card and bank numbers, passwords, national identifiers) out of its working data, so please don’t type those into the chat.
Every message you send goes through two AI models: Claude (provided by Anthropic) writes the reply, and Gemini (provided by Google) runs an independent safety check before anything comes back to you. Both process the words you type.
Chat memory. The assistant remembers what has been said within your conversation so you never have to repeat yourself. If you come back on the same device within 30 days, it may offer to pick up the topic you were asking about. It will never assume who you are from an earlier visit. Chat records are automatically deleted within 90 days, and you can ask us to erase your chat at any time.
If you leave your details or book a call. If you choose to give the assistant your name and contact details so we can get back to you, we keep those details for 12 months and then review whether we still need them. We use them to respond to your enquiry, not for marketing lists. If you book a call in the chat, your name, email and chosen time are stored in our Google Workspace calendar so the meeting can happen, and you get a confirmation email with the video call link. You can ask us to delete any of this at any time.
How long we keep it
- Enquiries that do not become work: kept for up to 12 months, then deleted.
- Website chat conversations: kept in our own database for 90 days, then automatically deleted. You can ask us to erase yours sooner.
- Our updates list: kept while you stay subscribed, removed when you unsubscribe.
- Client records: kept for the life of the engagement plus the period the law requires for tax and accounting, then deleted.
Who we share it with
We use a small number of trusted providers to run the business. They act on our instructions under data-processing terms:
- Website hosting: Cloudflare (Cloudflare Pages).
- Email and updates: Kit (email platform).
- Enquiry handling and automation: our own self-hosted automation (n8n) on infrastructure we control.
- The AI behind the website assistant: Anthropic (the model that writes replies) and Google (an independent safety check on each reply).
- Secure storage for chat records and enquiry details: Supabase (a hosted database, stored in the UK in the London region).
- Calendar bookings and email alerts: Google Workspace (a call you book in the chat is stored in our calendar, and enquiry alerts reach us by email).
We don’t share your data with anyone else except where the law requires it.
Sending data outside the UK
Your chat records and enquiry details themselves are stored in the UK. Some of our providers are based outside the UK: this includes the email platform (Kit) and the AI providers behind the website assistant, Anthropic and Google, which are US-based. Where that happens, the transfer is covered by a recognised safeguard: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or otherwise standard contractual safeguards approved for UK use (the UK International Data Transfer Agreement or the UK Addendum), supported by a risk assessment. We confirm each provider’s current status before relying on it.
Your rights
Under UK data-protection law you have the right to:
- be told how your data is used (this notice),
- ask for a copy of your data,
- have inaccurate data corrected,
- ask us to delete your data (this is not absolute, some records we must keep),
- ask us to restrict or object to certain uses,
- ask for your data in a portable form,
- and withdraw consent at any time, where we relied on consent.
To exercise any of these, email us at damien@5starcssystems.com. We respond within one month. There’s normally no charge. We may ask you to confirm your identity first.
Cookies
Our site uses only the cookies it needs to work. The chat also stores a session reference and a device reference in your browser’s local storage. These exist to make the chat work and to let the assistant remember you between visits on this device. They are not used to track you across other sites. The detail, and what happens if we ever add a non-essential cookie, is in our cookie policy.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator, at ico.org.uk or on 0303 123 1113.
Changes to this notice
If we change this notice we update the date at the top and, for a significant change, we’ll tell you.