Automata Agency | CITY SKLEP LTD

Website: https://automataagency.co.uk/

Last updated: 10 October 2026

1. About this Privacy Policy

Automata Agency is a trading name of CITY SKLEP LTD (company number 10979973), a company registered in England and Wales. In this Privacy Policy, “Automata Agency”, “we”, “us” and “our” refer to CITY SKLEP LTD.

We provide AI-assisted content creation, digital advertising, marketing consultancy, business automation and related services. This notice explains how we handle personal data when you visit our website, contact us, request a quotation, communicate with us, or have a business relationship with us.

We process personal data in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and relevant amendments made by the Data (Use and Access) Act 2025.

This notice describes our processing as an independent data controller. When we process personal data solely on a client’s documented instructions in providing client services, we may instead act as that client’s data processor. The client will normally be the controller of that project data, and the applicable contract and data processing agreement will govern our role.

Reading this notice or using our website does not amount to consent to activities that legally require consent.

2. Who is responsible for your data?

Data controller: CITY SKLEP LTD, trading as Automata Agency

Companies House registration number: 10979973

Registered office: C/O The Accountancy Partnership, Suite 5, 5th Floor, City Reach, 5 Greenwich View Place, London, United Kingdom, E14 9NN

Email (including privacy requests and complaints): automataagency.uk@gmail.com

Telephone: +44 7435 756468

Website: https://automataagency.co.uk/

Contact form: https://automataagency.co.uk/contact/

For data protection enquiries, you can email us with the subject “Privacy Request”. To complain about the way we handle personal data, use the subject “Data Protection Complaint”. You do not have to use those exact words for your request or complaint to be valid.

We will provide details of any data protection officer or representative if an appointment becomes legally required. Our general contact details above can be used for privacy matters in the meantime.

3. Personal data we collect

The personal data we handle depends on your interaction with us. It may include:

• Enquiry and contact details: name, email address, telephone number, organisation, job title, message content, requested services, and supporting documents you choose to send.
• Client, supplier and partner information: business contact details, contracts, quotes, project instructions, approvals, invoices, billing information, transaction records, meeting notes and correspondence.
• Website and device information: IP address, device and browser details, log data, visit times, referring pages and website interactions, to the extent collected by our systems and permitted technologies.
• Marketing information: business contact information, areas of professional interest, marketing preferences, subscription or consent records, communication history and opt-out records.
• Project data: files, images, video, audio, written content, CRM records, customer enquiries, workflow data and other materials supplied by a business client to deliver an agreed service. Such materials may contain personal data about the client’s staff or customers.

We do not ask you to submit special-category personal data (such as health information or information revealing racial or ethnic origin) or criminal-offence data through our ordinary contact form. Please avoid including such information unless we have expressly arranged a suitable, lawful and secure way to receive it. If a project requires sensitive data, the relevant legal conditions and safeguards must be assessed separately.

4. Where we obtain personal data

We may receive data directly from you; from your employer or colleagues; from our existing or prospective clients, suppliers and partners; from public professional sources (such as company websites, professional directories and business networking services); or through website hosting, security and other technologies.

If we obtain personal data about you from someone else while acting as a controller, we provide the information required under Article 14 UK GDPR within the relevant time limits, including, where applicable, at our first communication with you and generally within one month, unless a lawful exception applies. We assess the source and use of the data before contacting individuals.

5. Why we process personal data and our lawful bases

We rely on the following lawful bases, as appropriate to the specific processing activity:

5.1 Enquiries, consultations and quotations

We use contact and project information to reply to questions, arrange discussions and prepare quotations. Depending on the relationship, the lawful basis is Article 6(1)(b) (steps requested before entering into a contract with you) or Article 6(1)(f) (our legitimate interest in responding to business enquiries and building commercial relationships).

5.2 Delivering services and managing business relationships

We use information to enter into and perform contracts, coordinate projects, communicate with relevant business contacts and provide support. Where the data subject is a party to the contract, we may rely on Article 6(1)(b). For contacts representing corporate customers, suppliers or partners, we may rely on Article 6(1)(f) (legitimate interests in delivering services and managing professional relationships). Where we act as a processor, the client’s instructions and contractual terms apply.

5.3 Administration, accounting and legal requirements

We process contracts, invoices, payment-related records and business correspondence for bookkeeping, tax, compliance and ordinary administration. Our bases are Article 6(1)(c) (legal obligation) and, where applicable, Article 6(1)(f) (legitimate interests in business administration).

5.4 Direct marketing and business development

Subject to PECR and your rights, we may use relevant professional contact information to communicate about our services. We rely on Article 6(1)(a) (consent) where required or Article 6(1)(f) (legitimate interests in appropriate business-to-business marketing) where lawful. We assess necessity, reasonable expectations and potential impacts before relying on legitimate interests. See section 6.

5.5 Website operation, safety and permitted measurement

We process necessary technical information to deliver web pages, keep systems functional, prevent abuse, diagnose faults and protect information. Depending on the activity, our bases include Article 6(1)(f) (legitimate interests in secure website operation), Article 6(1)(c) (legal obligation) or Article 6(1)(a) (consent for processing that requires it). Device storage and access, including cookies and similar technologies, are also subject to PECR: see section 10.

5.6 Legal claims and safeguarding our rights

We may retain or use relevant records where necessary to establish, exercise or defend legal claims, deal with fraud or misuse, and cooperate with lawful requests. The relevant bases may include Article 6(1)(f) or Article 6(1)(c).

Where we rely on legitimate interests, we consider the purpose, necessity and the balance against your interests, rights and freedoms. You may request further information about those interests by contacting us.

6. Marketing communications

We may communicate with current and prospective business customers about AI content, automation, advertising, consultancy and related services, but only where permitted by data protection and electronic marketing law.

• Corporate subscribers: Under PECR, marketing emails or texts sent to corporate subscribers (such as limited companies and limited liability partnerships) generally do not require prior consent. When we process a named person’s personal data, UK GDPR still applies. We identify ourselves, provide a valid opt-out route and respect objections.
• Individual subscribers: For individuals, sole traders and certain partnerships, marketing emails or texts generally require consent unless a valid exception, such as the *soft opt-in*, applies and all its conditions are met.
• Telephone or other marketing: We assess the separate PECR requirements and applicable preference services for the relevant channel before using it.

Your right to object to direct marketing: You may object at any time to our use of your personal data for direct marketing, including associated profiling, by emailing automataagency.uk@gmail.com or using an unsubscribe option provided. We will stop the relevant marketing when you object or withdraw consent. We may retain minimal information on a suppression list to ensure that we respect your request.

Submitting an enquiry does not automatically subscribe you to marketing. Where consent is required, it must be separately and freely given and can be withdrawn without affecting earlier lawful processing.

7. When providing data is necessary

You are not legally required to submit a general website enquiry. If you choose not to provide your contact details or a description of your request, we may be unable to respond or provide a quotation. Fields marked as required in an enquiry form are necessary to handle that enquiry; other fields are optional unless clearly stated otherwise.

For a contract, we may need sufficient identification, contact, billing and project information to provide the service and meet statutory obligations. Where particular information is required by law or contract, we will explain this and the consequences of not providing it when relevant.

Please do not send unnecessary personal data about other people through our contact form or by ordinary email.

8. Sharing personal data

We do not sell personal data. We share it only where reasonably necessary and lawful. The recipients involved depend on the services you use and our relationship with you. They may include:

• Website hosting, maintenance, cybersecurity and IT-support providers;
• Email and communication services, including Google (Gmail) for messages sent to our published Gmail address;
• Cloud storage, document collaboration, customer relationship management, scheduling and videoconferencing providers, where used;
• AI and automation services engaged for an agreed project, subject to the relevant permissions, arrangements and safeguards;
• Advertising, analytics and measurement providers, but only where the applicable privacy and PECR requirements have been satisfied;
• Accountants, legal advisers and other professional service providers;
• Regulators, law-enforcement bodies, courts or other recipients where legally required or justified.

Our website includes Google Tag Manager. A tag manager can enable scripts, but its presence does not establish that any particular analytics or advertising tag is active. Any cookies or comparable technologies enabled through it are subject to the rules described in section 10.

Where an organisation processes personal data on our behalf, we put in place appropriate arrangements required by Article 28 UK GDPR and applicable law. Certain recipients may be independent controllers and explain their own activities in their privacy notices. Client-project sub-processors are addressed in the relevant contract or data processing agreement. You may contact us for further information about the categories of recipients relevant to your interaction with us.

9. International transfers

Some of the service providers we use may process or access personal data outside the United Kingdom, including from the European Economic Area or the United States.

For any restricted international transfer to which the UK GDPR transfer rules apply, we use a legally recognised mechanism appropriate to the recipient and destination. This may include UK adequacy regulations; the UK Extension to the EU–US Data Privacy Framework for an eligible and properly certified US recipient; the UK International Data Transfer Agreement (IDTA); or the UK Addendum to the EU Standard Contractual Clauses.

Where required, we carry out the applicable transfer risk assessment (also referred to in UK legislation as a data protection test) and apply supplementary measures. We do not assume that all US recipients are covered by the UK Extension. You may request further information on relevant safeguards by emailing us.

10. Cookies, pixels and similar technologies

Our website may use cookies, browser storage, pixels, tags and similar technologies. The technologies involved depend on the live site configuration, your browser and any choices you make. Some are needed to operate or secure the website; others, if enabled, may support preferences, statistics or marketing.

Strictly necessary technologies may operate without consent where an applicable PECR exception covers their specific purpose, such as transmitting communications or providing a service that you requested.

Appearance and preference technologies may require consent or qualify for a limited statutory exception. Where an exception requires transparency and an objection route, clear information and a simple, free means of objecting must be provided.

Statistical and analytics technologies generally require consent unless the particular use meets the statutory statistical-purposes exception. This exception is limited to statistics used solely to improve our website or service and requires clear information and a simple, free objection mechanism. Advertising, cross-site identification or unrelated purposes do not qualify merely because the same tool also provides analytics.

Advertising and targeting technologies are not covered by the statistical-purposes exception merely because they produce reports. Where PECR requires consent, these technologies must remain inactive until valid consent has been obtained.

Google Tag Manager may be used to manage website scripts, but it does not by itself prove that any particular tracking cookie or pixel is active. Information about the technologies actually used, including their providers, purposes and storage periods, should be made available through the live website’s cookie information and any relevant choice controls. You can also request details using the email address below.

Where consent is required, a visitor must be given the relevant choice before non-essential storage or access takes place. Accepting and rejecting optional technologies should be comparably straightforward. Consent must be capable of being withdrawn as easily as it was given, using an accessible consent or preferences mechanism where consent is collected. Where a statutory exception requires an opt-out rather than consent, a simple, free way to object must be available.

To ask which cookies or similar technologies are currently used, or to raise a concern about website privacy choices, email automataagency.uk@gmail.com. Your browser may also let you block or remove cookies, although that can affect website functionality.

11. How long we keep personal data

We do not retain personal data indefinitely. We assess retention by reference to the reason it was collected, the age and relevance of the information, the existence of a current business relationship, contract terms, statutory duties, legal limitation periods and the need to resolve disputes. We periodically review data and delete or anonymise it when no longer required.

Our standard retention periods are set out below. The exact period may depend on the nature of the records, the applicable legal requirements and any justified need to preserve evidence:

• Enquiries and quotations that do not lead to a contract: ordinarily up to 24 months from the last meaningful business communication, unless an active follow-up, a legal requirement or another justified purpose warrants longer retention.
• Client and supplier contracts, correspondence and project administration: during the relationship and ordinarily up to six years after the relationship ends, or longer if required for a particular legal obligation or claim.
• Accounting, invoice and tax records: normally at least six years for the relevant statutory accounting/tax period, subject to the applicable record-keeping rules and exceptions.
• Marketing contact details: only while marketing is lawful and relevant; contacts should be reviewed at least every 24 months for continued relevance. Where we have no continuing basis or purpose, we remove them. Objections are honoured immediately for future relevant marketing.
• Marketing suppression records: minimal details for as long as reasonably necessary to prevent renewed unwanted contact.
• Technical and security logs: ordinarily up to 90 days, unless required longer for a security incident, investigation or other justified purpose.
• Cookies and similar identifiers: for the periods appropriate to the particular technology, as described in the applicable website cookie information or available from us on request.
• Client data processed on a client’s behalf, including data used in AI/automation projects: returned or deleted according to the client agreement, documented instructions, applicable law and any agreed backup-deletion arrangements.

If there is a dispute, complaint, regulatory matter, legal hold or other valid reason, a limited part of the relevant data may be retained beyond a usual period. Backups are handled under separate rolling deletion and recovery arrangements. We take appropriate steps to delete or anonymise information when it is no longer required.

12. Your data protection rights

Depending on the circumstances and applicable legal conditions, you may have the right to:

1. Access personal data we hold about you and receive relevant information about its use.
2. Rectify inaccurate personal data and complete incomplete information.
3. Erase data in circumstances where the law gives you this right.
4. Restrict certain processing.
5. Receive or transfer certain data in a structured, commonly used, machine-readable format (data portability).
6. Object to processing based on legitimate interests and, at any time and without needing to give a reason, to the use of personal data for direct marketing.
7. Withdraw consent where our processing is based on consent, without affecting processing carried out lawfully before withdrawal.
8. Obtain the relevant safeguards concerning significant solely automated decisions, where applicable, including information about the decision and ways to make representations, seek human involvement and contest the decision, subject to the law.

To exercise a right, email automataagency.uk@gmail.com, use https://automataagency.co.uk/contact/ or write to our registered office. We may ask for reasonable identification information where necessary to protect your data from unauthorised disclosure. We do not routinely require identification documents without a justification.

We normally respond to valid rights requests within one month, subject to lawful extensions, clarification provisions and applicable exceptions. We will tell you if an extension applies. Rights are not absolute: where we cannot comply fully, we will explain the reason and any available complaint options.

13. How to complain

You may complain directly to us about any aspect of how we handle personal data by emailing automataagency.uk@gmail.com, using our online contact form or writing to our registered office. Please describe your concern and provide sufficient information for us to investigate; you do not need to use a particular template.

We will acknowledge a data protection complaint within 30 days of receiving it, take appropriate steps to investigate it without undue delay, keep you informed of relevant progress and notify you of the outcome without undue delay, in accordance with applicable law.

You may also complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator:

ICO website: https://ico.org.uk/

How to complain: https://ico.org.uk/make-a-complaint/

You do not lose your right to contact the ICO by raising a complaint with us.

14. Security and data breaches

We implement security measures appropriate to the nature and risks of the personal data we handle. Measures may include secure communications, restricted role-based access, multifactor authentication where appropriate, confidentiality arrangements, software maintenance, backups, supplier checks, incident-response processes and suitable contract terms.

No technology or transmission is completely risk-free. Where a personal data breach occurs, we investigate, document and assess the event, notify the ICO within the applicable period where required (ordinarily within 72 hours of becoming aware of a notifiable breach, where feasible) and notify affected individuals without undue delay where the law requires it.

15. Artificial intelligence and automation

We use AI and automation to assist with content production, marketing, business workflows and related services. Depending on the agreed service, project data may pass through selected software, AI providers or connected systems. Our responsibilities depend on whether we act as a controller or a processor for the activity.

Where personal data is involved, we seek to minimise what is shared and assess the purpose, lawful basis, provider security, confidentiality, retention, international transfers and relevant contract terms. Before including client personal data in an AI workflow, we consider the provider’s terms and account settings relating to input and output retention, model training and other secondary use. Public availability of information does not remove our data protection duties.

Model training and secondary use: Whether an AI provider retains inputs or outputs or uses them to improve or train models depends on the relevant service, settings and contract. For client projects, we address those conditions in project documentation and, where required, the data processing agreement. Where we act as a processor, use of client personal data must stay within the client’s documented instructions and agreed sub-processor arrangements. We do not authorise unrelated secondary use of client personal data without an appropriate legal basis and the necessary authorisation.

AI-assisted content generation, classification, summaries and workflow automation do not automatically amount to a legally significant solely automated decision about an individual. If we propose processing that makes a significant decision solely by automated means, we will assess the applicable UK GDPR requirements, explain the processing where required and provide the legally required safeguards. Special-category data needs additional protection and applicable lawful conditions.

If we process information under a client’s instructions, the client determines its own purposes, lawful basis and relevant transparency obligations; we support the client as required by our contract and data protection law.

16. Children and vulnerable individuals

Our website and services are designed principally for organisations and professional users and are not directed at children. We do not knowingly solicit children’s personal data through our general business enquiry form. If information about a child has been provided to us inappropriately, please contact us so we can assess and take the necessary steps.

Where a client’s project involves children or other higher-risk processing, additional contractual, technical and legal safeguards may be required.

17. Third-party links and social media

Our site may link to external websites, social networks or embedded services. Separate organisations may collect personal data when you interact with those services, subject to their own privacy notices. We are not responsible for their independent processing, although we remain responsible for our own decisions to integrate third-party tools and for meeting the applicable transparency and consent rules.

18. Changes to this notice

We review this Privacy Policy when relevant laws, services, suppliers or data practices change. The current version will be available on our website and will show its last-updated date. Where the law requires additional notice, a new lawful basis or consent before a material change, we will take the necessary steps before that change is implemented.

19. Contact us

For privacy enquiries, rights requests, marketing objections, requests for international transfer safeguards or complaints, contact Automata Agency — CITY SKLEP LTD at automataagency.uk@gmail.com, by phone on +44 7435 756468, through https://automataagency.co.uk/contact/, or by writing to the registered office shown in section 2.

Last updated: 10 October 2026