Privacy Policy

1. Who we are

Odris Systems Ltd ("Odris", "we", "us") is the data controller for personal data collected through this website and in connection with the Speed to Lead service. We are registered in England and Wales.

Contact: privacy@odrissystems.com

2. What data we collect and why

2.1 Enquiry and audit booking data

When you complete the audit booking form on this website, we collect:

• Your name and business name
• Email address and phone number
• Monthly enquiry volume and any other details you provide in the form

Why: To contact you about your audit request, provide the Speed to Lead service, and send relevant follow-up communications.

Legal basis: Legitimate interest (responding to a business enquiry you have initiated) and, where a contract follows, performance of that contract.

2.2 Client account data

If you become a client of Odris Systems, we will hold your business contact details, billing information, and configuration data necessary to operate the service.

Legal basis: Performance of contract.

2.3 Website usage data

We may collect standard server log data (IP address, browser type, pages visited, referrer) for security and performance purposes. We do not currently use third-party analytics or advertising trackers on this site.

Legal basis: Legitimate interest (keeping our website secure and understanding basic traffic patterns).

3. How Speed to Lead processes your customers' data

Speed to Lead is a B2B automation system. When deployed for a client, it processes personal data belonging to that client's prospects and customers (names, email addresses, phone numbers, enquiry content).

In that context, our client is the data controller for their customers' data, and Odris Systems acts as a data processor on their behalf. We process that data only on the client's documented instructions and in accordance with a Data Processing Agreement (DPA) entered into at the point of subscription.

Speed to Lead operates on a Bring Your Own Accounts (BYOA) model: clients supply their own Twilio (SMS/WhatsApp), Anthropic (AI processing), and SMTP (email) credentials. Personal data transmitted via those channels passes through the client's own third-party accounts, not through Odris-controlled infrastructure. Clients are responsible for ensuring their own use of those services complies with applicable data protection law.

4. Who we share your data with

We do not sell personal data. We may share data with:

• Netlify, Inc., website hosting. Netlify may process data on servers outside the UK/EEA. We rely on Netlify's standard contractual clauses and adequacy decisions for any such transfers.
• Our sub-processors, where we use third-party tools to deliver the service (e.g. Airtable for configuration management). We maintain a current list of sub-processors and will inform clients of any material changes.
• Legal or regulatory authorities, where required by law.

5. International data transfers

Some of our hosting and infrastructure providers are based outside the UK. Where personal data is transferred to countries not covered by a UK adequacy regulation, we ensure appropriate safeguards are in place (standard contractual clauses or equivalent) in line with UK GDPR Chapter V.

6. How long we keep your data

• Enquiry/audit booking data: Up to 24 months from last contact, unless you ask us to delete it sooner or we enter a contract (in which case we retain it for the duration of the contract plus 6 years for legal purposes).
• Client account data: For the duration of the contract and 6 years thereafter, to comply with our legal and accounting obligations.
• Server logs: Up to 90 days.

7. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right of access, to obtain a copy of the personal data we hold about you.
• Right to rectification, to have inaccurate data corrected.
• Right to erasure, to request deletion where there is no legitimate reason for us to continue holding it.
• Right to restriction, to ask us to pause processing in certain circumstances.
• Right to data portability, to receive your data in a structured, machine-readable format (where the legal basis is consent or contract).
• Right to object, to processing based on legitimate interest. We will stop unless we have compelling legitimate grounds that override your interests.
• Rights related to automated decision-making, Speed to Lead uses AI scoring to prioritise leads. This scoring is an automated process. If you are a prospect whose data is processed by a client's installation of Speed to Lead, you may have the right to request human review of any automated decision. Please contact the relevant client (the data controller) to exercise this right.

To exercise any of these rights, email privacy@odrissystems.com. We will respond within one calendar month.

8. Cookies

This website does not currently use advertising or analytics cookies. We may use essential session cookies required for the website to function. No cookie consent banner is displayed because no non-essential cookies are set. If this changes, we will update this policy and implement appropriate consent mechanisms.

9. Right to complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

• Website: ico.org.uk
• Helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concern directly before you contact the ICO. Please email us first at privacy@odrissystems.com.

10. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Where changes are material, we will notify active clients by email.