Agentic Autonomy LTD, trading as Mandate ("Mandate", "we", "us", "our"), is committed to protecting your privacy. This policy explains how we collect, use and protect your personal data when you use our website and services.
Who we are
Agentic Autonomy LTD, trading as Mandate, is registered in England and Wales (Company No. 16863317). Our registered office is 3 St Peters Place, St Peters Street, Wallingford, Oxfordshire, OX10 0BG.
For personal data collected through this website and in running our business, we are the data controller. When we process our clients' data through the Mandate platform, we act as a data processor on our client's behalf and only on their documented instructions.
We are registered with the Information Commissioner's Office, registration number ZC248912. You can contact us at info@runmandate.co.uk.
What data we collect
We collect information you provide directly to us, including:
- Contact information (name, email address, phone number)
- Company information (company name, job title, company size)
- Communications you send to us
We also collect certain information automatically when you visit our website:
- Device and browser information
- IP address and approximate location
- Pages visited and time spent on site
We may also obtain business contact details (name, job title, company and work email address) from publicly available sources and business data providers, such as LinkedIn and lemlist, to identify organisations that may benefit from our services.
How we use your data
We use your personal data to:
- Respond to your enquiries and provide our services
- Send you reports, insights and other materials you request
- Follow up on business enquiries with relevant information
- Contact businesses that may benefit from our services, with an option to opt out in every message
- Improve our website and services
- Comply with legal obligations
Legal basis for processing
We process your personal data on the following legal bases:
- Consent: when you submit a form or request information from us
- Legitimate interests: to follow up on business enquiries, contact businesses that may benefit from our services, and improve our services
- Contract: to provide services you have engaged us for
- Legal obligation: to comply with applicable laws
How we protect your data
Our platform and its database are hosted on Amazon Web Services in the eu-west-2 (London) region. Access is restricted to named, authenticated accounts protected by multi-factor authentication, data is encrypted in transit and at rest, and each client's data is isolated at the database level. We hold Cyber Essentials Plus certification.
Some of the service providers we use operate outside the UK. Where that happens, the transfer is protected by one of the safeguards listed under "Service providers and international transfers" below.
Data sharing
We do not sell your personal data. We may share your data with:
- Service providers who help us operate our business, listed below
- Professional advisors where necessary
- Regulatory authorities if required by law
Service providers and international transfers
- Amazon Web Services — platform hosting — UK (London) — no transfer
- Supabase — platform database — UK (AWS London) — no transfer
- Google Workspace — email and file storage — data stored in Europe — UK adequacy for the EEA; any processing outside Europe is covered by Google's Data Processing Addendum including the UK International Data Transfer Addendum
- Anthropic — AI model processing within the platform — United States — Anthropic's Data Processing Addendum including the UK International Data Transfer Addendum
- Resend — transactional email notifications from the platform — Ireland (AWS eu-west-1) — UK adequacy for the EEA; Resend's Data Processing Addendum
- Google Analytics — website analytics — United States — UK–US Data Bridge and Google's data processing terms
- lemlist — outreach and website company identification — France — UK adequacy for the EEA
- HubSpot — CRM and website — Europe (EU instance) — UK adequacy for the EEA; HubSpot Data Processing Agreement
- Cloudflare — website security and delivery — global network — Cloudflare Data Processing Addendum including the UK International Data Transfer Addendum
- Xero — our own accounting — United States — Xero data processing terms
We do not transfer personal data outside the UK except to these providers under the safeguards shown.
Cookies and analytics
We use the following tracking services on this site, all loaded only after you accept cookies:
- Google Analytics 4 to understand how visitors use the website. Collects pseudonymised usage data, processed in the United States. You can opt out by installing the Google Analytics Opt-out Browser Add-on.
- lemlist visitor tracking to identify which companies visit the site so we can follow up with relevant offers. This uses IP-based company identification and is used to identify organisations rather than individual visitors.
You can withdraw consent at any time by clearing your cookies for this site. The cookie banner will reappear on your next visit.
Your rights
Under UK GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate personal data
- Erase your personal data
- Restrict processing of your personal data
- Object to processing of your personal data
- Data portability
- Withdraw consent at any time
To exercise any of these rights, contact us at info@runmandate.co.uk. We will respond within one month.
You can also ask us at any time to stop contacting you or to remove your details from our records by emailing info@runmandate.co.uk. We will act on this promptly.
Data retention
We retain your personal data only for as long as necessary for the purpose it was collected, or as required by law. Contact and enquiry data is reviewed annually and typically retained for up to 3 years after our last interaction. Client data processed through our platform is retained for the contract term and deleted or returned within 30 days of it ending, unless a longer period is agreed in writing or required by law. Financial records are retained for six years, as HMRC requires.
Changes to this policy
We may update this privacy policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "last updated" date.
Complaints
If you have concerns about how we handle your personal data, please contact us first at info@runmandate.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.