This Privacy Policy explains how INSTRUCTION WORKS LTD collects, uses, stores and protects personal data in connection with our website, enquiries, suitability assessments, bookings, quotations, and our Master Services Agreement, payment administration, AI Advisory and Practical Training, and Bespoke AI Services.
This Privacy Policy applies to INSTRUCTION WORKS LTD. It does not govern personal data processing independently undertaken by clients or third-party providers for their own purposes.
1. Who we are
INSTRUCTION WORKS LTD is a company registered in England and Wales.
For the purposes of UK data protection law, INSTRUCTION WORKS LTD is the controller of the personal data we collect and use for our own business purposes. We do not act as a processor on behalf of our clients.
2. What we do
Instruction Works Ltd provides business clients with AI Advisory and Practical Training and, following an initial suitability assessment (usually a short scoping call), Bespoke AI Services.
Our services may include:
· AI Advisory and Practical Training, normally delivered online and charged by booked time; and
· Bespoke AI Services, individually scoped and quoted, which may include agreed instruction design, source-material organisation, workflow design, creation, configuration, testing and handover support.
Our standard model is client-controlled. Clients control their own AI platform accounts, subscriptions, managed workspaces, connected applications, permissions, settings, publication or deployment decisions and use of any AI assistant or agent.
We do not request client passwords, host, publish or operate a client's AI assistant or agent, or provide ongoing management or continuous monitoring. We do not process personal data on our clients’ behalf. If limited access beyond guided screen sharing is required for a bespoke project, it must be expressly agreed in a signed quotation, and any necessary security and confidentiality arrangements must be put in place before access is provided.
3. Personal data we collect about you
We may collect enquiry and contact information, including:
· name;
· business name;
· job title or role;
· email address;
· telephone number;
· website address;
· social media or business profile details; and
· details of your enquiry.
If you become a client, we may collect client and order information, including:
· company name;
· company number;
· VAT number, where applicable;
· registered office or trading address;
· main contact details;
· delivery email address;
· signed quotations;
· signed service agreement;
· booking, quotation and order details;
· communications;
· delivery records; and
· session, project, delivery and support records.
Where relevant to a suitability assessment or bespoke project, we may use publicly available business information from the client's website and related public business pages, together with information and materials the client is authorised to provide, which may include:
· service descriptions;
· pricing information;
· FAQs;
· contact details;
· public policies;
· public biographies;
· testimonials;
· case studies; and
· other public business information relevant to the agreed service.
We do not collect private customer data, passwords, authentication codes, API keys, confidential customer records, special category data, criminal offence data or trade secrets as part of our services. Clients must not send us personal data about their own customers, staff or other individuals, and we do not process such data on their behalf.
We may process payment and transaction information such as:
· payment status;
· invoice details;
· payment reference;
· billing contact details; and
· accounting or tax records.
Invoices are issued through our accounting software and are usually paid by bank transfer. We do not receive or store full card details.
When you use our website, we may collect website and technical information such as:
· IP address;
· device and browser information;
· pages visited;
· date and time of visits;
· referring website;
· cookie preferences; and
· analytics data where analytics tools are used.
We may collect marketing information such as:
· marketing preferences;
· mailing list sign-up details;
· records of marketing emails sent;
· unsubscribe information; and
· engagement information where our email tools provide it.
4. How we collect your personal data
We may collect personal data in the following ways:
Directly from you. We may collect personal data directly from you when you:
· contact us;
· complete an enquiry form;
· communicate with us by email, telephone, website, social media or messaging platform;
· make a payment;
· attend an advisory, training, suitability-assessment, project, setup or handover call; or
· provide information for the service.
From publicly available business sources. We may collect data from publicly available sources, including:
· the client’s website;
· public business pages;
· Companies House;
· LinkedIn; or
· other public business profiles where relevant to preparing the agreed service.
From third parties who support our services. We may receive personal data from third parties who help us deliver our services, including:
· payment processors, and our accounting software, in connection with invoicing and processing payments and transactions; and
· other technical service providers who support the delivery of our services.
Automatically, through your use of our website. When you use our website, we may automatically collect technical information about your equipment, browsing actions and patterns, such as your IP address, device and browser information, and pages visited. We collect this using cookies and similar technologies; please see our Cookie Policy for further detail.
5. How we use your personal data
We use contact and enquiry information to:
· respond to questions;
· provide information about our services;
· assess whether our service is suitable;
· carry out a high-level suitability assessment and prepare a quotation or proposal where requested; and
· follow up with prospective clients.
We use client, booking, quotation and order information to:
· prepare quotations;
· confirm customer details;
· issue invoices;
· process payments;
· record acceptance of our quotations and Master Services Agreement;
· book and administer sessions, projects and the client relationship; and
· deliver the agreed service.
We use public business information and client-approved information to prepare:
· suitability assessments, quotations and project plans;
· bespoke AI assistant or agent instructions, guardrails and workflows;
· agreed source review, testing, configuration and handover materials; and
· other deliverables expressly included in a signed quotation.
Where an advisory, training, scoping, project, setup, handover or support call has been agreed, we use relevant contact, booking, quotation and service information to provide and administer that work.
We may also use information to:
· keep records;
· manage accounting;
· comply with tax requirements;
· manage disputes;
· prevent fraud;
· enforce our terms;
· operate our business;
· improve our services; and
· send relevant B2B marketing where permitted by law.
We may refer to the client’s business name and a general description of the project in internal business records.
We will not use the client’s name, logo, testimonial, detailed case study, confidential information, private documents, sensitive data, full deliverables or project details in public marketing, public portfolio materials or promotional content without the client’s prior written permission.
6. Lawful bases for using personal data
We will only use personal data where we have a lawful basis to do so under UK data protection law.
Where you contact us with an enquiry, we usually rely on our legitimate interests to respond, provide information about our services, assess whether our service may be suitable and follow up with you. This reflects our interest in running an efficient and relevant enquiry process for prospective clients.
Where we carry out suitability assessments or prepare quotations, proposals or service information, we rely on our legitimate interests and, where relevant, taking steps at your request before entering into a contract with you personally. This reflects our interest in converting relevant enquiries into appropriately assessed and scoped work.
Where we use publicly available business information, such as content from a client's website, Companies House or LinkedIn, for an agreed suitability assessment or service, we rely on our legitimate interests in assessing and delivering the work efficiently, using relevant information already made public and avoiding unnecessary requests for duplicate information.
Where you become a client, we use personal data to prepare and manage quotations, administer bookings, deliver sessions or projects, provide agreed setup, handover or support, issue invoices, process payments and manage the client relationship. Where you contract with us personally, for example as a sole trader, we rely on contract where processing is necessary to take steps you request before contracting or to perform our agreement with you. Where you represent a business client, we rely on our legitimate interests in communicating with that business and administering and delivering its services.
Where we keep accounting records, tax records, business administration records or legal records, we rely on legal obligation where the law requires us to keep or use the information. We may also rely on legitimate interests where the information is needed to manage our business, prevent fraud, resolve disputes or enforce our terms.
Where we use data to improve our website, services, processes or client experience, we rely on our legitimate interests. This reflects our interest in keeping our service accurate, relevant and fit for purpose for our clients.
Where we send relevant business-to-business marketing, we rely on legitimate interests where permitted by law, or consent where consent is required. You can object to marketing or unsubscribe at any time. This reflects our interest in reaching relevant business contacts about services that may be useful to them.
We rely on consent for non-essential cookies and associated personal data processing. For personal data processing necessary to operate and secure the website, we rely on our legitimate interests in providing a functioning and secure website.
7. AI tools and third-party platforms
Instruction Works Ltd may use software tools, productivity tools, cloud services, email services, payment providers and, where appropriate, AI tools to help prepare and deliver services.
We aim to use only the information reasonably necessary for the agreed service. Advisory and training sessions normally use information discussed or demonstrated during the session. Suitability assessments and bespoke projects may use public business information and client-supplied materials relevant to the agreed scope.
Clients should not send private customer data, API keys, special category data, criminal offence data, confidential customer records or trade secrets. Clients must not disclose account passwords or authentication codes. Any required access must use an agreed secure access method.
Clients are responsible for their own use of ChatGPT, OpenAI and any other AI platform, managed workspace or connected application, including:
· the information they upload;
· the AI assistants, agents or workflows they create, configure or use;
· their account, workspace, application, access and platform settings;
· their privacy settings;
· how their AI systems and connected applications are deployed and used; and
· any personal data processed through their own accounts, AI systems, applications or connected workflows.
We do not act as a processor for our clients. Clients must not show, send or give us access to personal data during sessions or projects, including through screen sharing, and we use public, fictional or anonymised examples wherever possible. If, exceptionally, a project ever required us to process personal data on a client's behalf, we would not do so until the required written data-processing terms and safeguards were in place.
8. Who we share personal data with
We may share personal data with trusted third parties where necessary for our business, including:
· email and communication providers;
· website hosting providers, including Squarespace;
· cloud storage providers;
· payment processors;
· accounting, invoicing and bookkeeping providers;
· CRM or project management tools;
· e-signature or document management providers;
· professional advisers;
· insurers;
· IT support providers;
· AI or productivity tools used to help prepare or deliver the service; and
· legal, regulatory or public authorities where required by law.
We only share information where necessary and we expect service providers to protect personal data appropriately.
We do not sell personal data.
9. International transfers
Our website is hosted through Squarespace, whose services involve processing personal data in the United States and other countries. Other service providers, such as our email, cloud storage and accounting providers, may also process personal data outside the United Kingdom.
10. How long we keep personal data
We keep personal data only for as long as necessary for the purposes for which it was collected, including legal, accounting, tax, contractual and dispute-resolution purposes.
General enquiries that do not become clients may usually be kept for up to 24 months after the last contact, unless we need to keep the information for longer for legal, regulatory or dispute-related reasons.
Client contracts, invoices and payment records may usually be kept for up to 6 years to help us meet our accounting, tax, contractual and legal obligations.
Service delivery records and correspondence may usually be kept for up to 6 years after the end of the client relationship. This helps us keep an accurate record of the work provided, deal with any follow-up queries and protect our legal position if needed.
Public business information used for suitability assessments or to prepare agreed deliverables may usually be kept for up to 6 years as part of the service record, unless earlier deletion is appropriate.
Non-public project materials are retained only for as long as necessary for the agreed purpose. Limited records may be retained separately where necessary and lawful for our own contractual, accounting or legal purposes.
Marketing records may be kept until you unsubscribe, ask us to stop contacting you, or we no longer need the record. We may keep a limited suppression record to make sure we respect your opt-out.
The retention of website analytics data depends on the provider and features used. We keep identifiable analytics data only for as long as necessary to review website performance, maintain security and resolve related issues.
Squarespace’s cookie preference cookies last 30 days unless deleted earlier. Any separate consent records are retained only for as long as necessary to demonstrate and honour your choices and meet our legal obligations.
We may keep information for longer where required by law, where a dispute arises, where we need to defend legal claims or where another valid legal reason applies.
11. How we protect personal data
We take reasonable steps to protect personal data from unauthorised access, loss, misuse, alteration or disclosure.
These steps may include:
· access controls;
· password protection;
· secure cloud storage;
· limiting access to those who need it;
· keeping records of client deliverables and delivery;
· avoiding unnecessary sensitive data;
· deleting or anonymising information when no longer needed; and
· using reputable service providers.
No system can be guaranteed to be completely secure. Clients should avoid sending unnecessary personal, sensitive or confidential information.
12. Your data protection rights
Depending on the circumstances, you may have the right to:
· be informed about how your personal data is used;
· access your personal data;
· ask us to correct inaccurate information;
· ask us to delete your information;
· ask us to restrict how we use your information;
· object to certain uses of your information;
· request transfer of your information;
· withdraw consent where we rely on consent;
· object to automated decision making; and
· complain to the Information Commissioner’s Office.
You have the right to object to certain uses of your personal data, including direct marketing and processing based on legitimate interests.
We may need to verify your identity before responding. We will respond within one month of receiving your request. This may be extended by up to two further months where a request is complex or you have made several requests, in which case we will tell you within the first month.
If you have a complaint about how we handle your personal data, you can contact us at hello@instructionworks.co.uk or write to our registered office. We will acknowledge your complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome. You also have the right to complain to the Information Commissioner’s Office.
You can ask us to stop sending marketing communications at any time by using the unsubscribe link in our emails or by contacting us directly at hello@instructionworks.co.uk.
Even if you opt out of marketing, we may still send important service, contract, payment or legal communications where necessary.
14. Children
Our services are intended for business customers and are not directed at children. We do not knowingly collect personal data from children.
15. Client Responsibility for Their Own AI Systems and Accounts
Clients are responsible for their own AI platform accounts, subscriptions, managed workspaces, connected applications, administrator approvals, access permissions, platform and privacy settings, publication or deployment decisions, AI assistants, agents, workflows, user access and information entered into or generated by those systems.
Instruction Works Ltd provides advisory and training services and Bespoke AI Services only within the agreed scope, using public business information and authorised client materials as applicable.
Instruction Works Ltd does not host, publish or operate a client's AI assistant or agent and does not provide ongoing management or continuous monitoring. Any limited project access beyond guided screen sharing must be expressly included in a signed quotation and supported by any necessary security and confidentiality arrangements.
Clients are responsible for ensuring that their use of AI systems and connected applications complies with applicable data protection law, including any personal data processing carried out through them.
Clients should provide appropriate privacy information to users of their AI systems or connected workflows where required.
Clients are responsible for personal data processing they undertake independently. Instruction Works Ltd remains responsible for the data protection obligations that apply to its own activities as a controller.
16. Cookies
Our Squarespace website uses cookies and similar technologies.
Essential cookies may be needed for the website to work.
Non-essential cookies, such as analytics, performance or marketing cookies, should only be used where appropriate consent has been obtained or where another lawful exception applies.
We will provide information about the cookies we use and how visitors can manage their choices on our website.
Please see our separate Cookie Policy for more information.
17. Links to other websites and platforms
Our website may link to third-party websites or platforms, including AI platforms, payment providers, scheduling tools, social media sites or other external services.
We are not responsible for the privacy practices, content or security of third-party websites or platforms. You should review their privacy policies before using them.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
The latest version will be posted on our website with the updated date.
Where changes are significant, we may take additional steps to notify affected individuals.
19. Contact us
If you have questions about this Privacy Policy or how we use personal data or if you wish to exercise your privacy rights, please contact:
