Privacy policy

Last updated: 4 November 2026

Who we are

Applied Business Realities (ABR) is a trading division of C-14 Space Ltd, a company registered in England and Wales with company number 16905182. Our registered office is 94 Gloucester Avenue, London, England, NW1 8HX.

This policy explains how we handle personal data in two different roles:

• As a controller, for the people who visit our website, contact us, apply for a job with us, or work with us as a client contact. We decide how this data is used and we are responsible for it.
• As a processor, for the personal data inside our clients' systems that the AI systems and automations we build for them handle. In that case our client is the controller, and we only act on their written instructions under a data processing agreement.

For any privacy question or request, email hello@appliedbusinessrealities.com or write to us at the address above. We have not appointed a data protection officer, because the law does not require one for the kind of processing we do.

What we collect and why

When you contact us

Our contact form asks for your name, company, email address and a message. We use these details to reply to you, arrange a call and prepare a free assessment if you want one. If you email us directly, we use your details in the same way.

Our lawful basis is legitimate interests. We have a genuine business need to answer enquiries, and you would expect us to use your details to reply. If you are contacting us for yourself, for example as a sole trader, we also rely on taking steps you have asked for before entering into a contract.

Giving us your details is up to you. The contact form needs your name, company, email address and a message before it will send. Please leave sensitive information, such as health details, out of your message.

When you message us on WhatsApp

If you contact us on WhatsApp at +44 7354 084174, we receive your phone number, your WhatsApp profile name and the messages you send. We use them to reply, understand your business and arrange a call. Our lawful basis is legitimate interests, as above.

We take messages through the WhatsApp Business Platform, provided by WhatsApp Ireland Limited (part of Meta). Messages are end-to-end encrypted in transit, but WhatsApp processes your account information under its own privacy policy. Our team answers your messages. When our booking assistant goes live, it will draft replies using OpenAI's API, and a person will review the conversation before any decision is made about you.

When you apply for a job

If you apply for a role on our careers page, you email us your CV, your answer to our application task, your contact details and anything else you choose to include. We use these to assess your application, contact you and, if you are successful, prepare an offer.

Our lawful basis is taking steps at your request before entering into a contract, and our legitimate interest in recruiting the right people. For the London role we also need to confirm your right to work in the UK, which is a legal obligation. Please don't include sensitive information, such as health details, in your CV.

Applications are seen only by the founders, at careers@appliedbusinessrealities.com. We keep applications from unsuccessful candidates for 6 months after the role is filled, in case a similar role opens, then delete them. You can ask us to delete your application sooner.

When you visit the site

Our host, Cloudflare, receives the technical information your browser sends with every request, such as your IP address and browser type. It uses this to deliver the pages and protect the site from attacks. Our lawful basis is our legitimate interest in running a secure website. We don't use analytics, advertising or tracking, and we don't use this information to identify you. Our fonts and videos are served from our own website, not from third parties. This site stores nothing in your browser, as our cookie notice explains.

Our team profiles link to LinkedIn. If you follow those links, LinkedIn's own privacy policy applies.

We won't add you to a mailing list or send you marketing. We don't make decisions about you by automated means.

When we build AI systems for our clients

Our clients use the systems we build to handle their own data, which can include personal data about their customers, suppliers and staff (for example names and contact details on invoices, orders and emails). For this data our client is the controller and we are a processor under Article 28 of the UK GDPR and, where it applies, the EU GDPR.

How we protect client data

• Data processing agreement. We sign a data processing agreement with every client before any personal data is processed.
• Instructions only. We process client data only to build, run, support and improve the system the client asked for, and never for our own purposes.
• Hosting and data residency. We agree with each client where their data is hosted and how it flows. Our own enquiry and WhatsApp records sit in Cloudflare's eastern North America region, with no jurisdiction restriction. Client projects are hosted in Cloudflare's EU jurisdiction or, where the client prefers, on their own infrastructure.
• No training on your data. We use AI providers through business or API terms that do not use client data to train their models, and we switch off data retention where the provider allows it. We do not use an AI provider that will not put this in writing, which today means OpenAI's API business terms.
• Least-privilege access. Each automation and AI agent gets only the access it needs in the client's tools, and our own staff access is limited to the people working on the project.
• Human-in-the-loop. A person at the client approves anything that matters before it goes out. Our systems are not used to make decisions with legal or similarly significant effects on individuals without human review.
• Audit trail. Automated steps are logged so the client can see what happened and when. We keep these logs for the length of the project plus up to 12 months.
• Security. Data is encrypted in transit and at rest, and credentials are stored in a secrets store rather than in the systems we build. We tell the client without undue delay, and in any case within 48 hours, if we become aware of a personal data breach affecting their data.
• End of the project. When a project or continuity plan ends, we return or delete client data as the client instructs, unless the law requires us to keep it.

Sub-processors

To run client systems we may use sub-processors such as cloud hosting and AI model providers. We use them only with the client's prior written approval and under contracts that give the same protection as our data processing agreement. A current list is available on request.

If you are a customer of one of our clients and want to use your data protection rights, please contact that business directly. We will help them respond.

Who can see your details

Enquiries sent through our contact form, to our contact email address or to us on WhatsApp are seen by Elia Orfeini, our Chief Executive, and Ryan Kearney, our Chief Technology Officer, and by our business developers once they are hired. Access is given to the people who need it for the work, and to nobody else.

These service providers handle your details on our behalf:

• Cloudflare, Inc., which hosts this website. Our contact form sends your details to our own website, which uses Cloudflare to email them to our mailbox.
• Purelymail, which hosts our mailbox. It forwards contact form enquiries to our email account.
• Google, which hosts Elia's email account.
• WhatsApp (Meta), if you contact us on WhatsApp. When our booking assistant goes live, OpenAI, which drafts the replies.

They may only use your details to provide their service to us. We don't sell your details. We share them with anyone else only if the law requires it, or with our professional advisers if we need legal or accounting advice.

Transfers outside the UK

Cloudflare, Purelymail, Google and WhatsApp may process your details in the United States or elsewhere. They protect UK personal data with a safeguard recognised by UK law, such as certification under the UK-US "data bridge" or the UK's International Data Transfer Agreement or Addendum. Purelymail, which is based in the United States, relies on the UK's data bridge or the Addendum.

For client systems, we keep personal data in the UK or the EU unless the client agrees otherwise in writing. If a sub-processor outside the UK or EU is needed, we use one of the safeguards above.

You can ask us for details or a copy of the safeguards we use for any of these transfers.

How long we keep your details

We keep enquiries for up to 24 months after we last hear from you, then delete them. WhatsApp conversations are kept for up to 12 months unless you become a client. If you become a client, we keep your details while we work together and for up to 6 years afterwards, to meet tax and accounting rules and to deal with any legal claims. Job applications are kept as described above.

Our website does not store what you send through the contact form. It emails it straight to our mailbox. Cloudflare and Purelymail keep technical and email delivery logs for a limited period under their own rules.

Your rights

You have the right to:

• get a copy of the personal data we hold about you
• have it corrected if it is wrong
• have it deleted
• limit how we use it
• receive it in a format you can pass to another organisation, where we hold it to take steps towards a contract with you

Your right to object. You can object at any time to us using your details on the basis of our legitimate interests. Email us and we will stop, unless we have compelling legitimate grounds to continue or need the details for a legal claim.

To use any of these rights, email hello@appliedbusinessrealities.com. We will reply within one month. We may ask you to confirm who you are first. Some rights have limits, and if one applies we will explain why.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first at hello@appliedbusinessrealities.com. We will confirm we have received your complaint within 30 days and keep you updated while we look into it.

You also have the right to complain to the ICO, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

If you are in Italy or elsewhere in the EU, you can complain to your local authority, such as the Garante per la protezione dei dati personali in Italy. We have not appointed an Article 27 EU representative yet. We are reviewing whether one is required for the work we do with clients in Italy, and we will update this page when that is settled.

Changes to this policy

If we change how we handle personal data, we will update this page and the date at the top.