Privacy notice

Who we are

Highguard Limited is a company registered in England and Wales, number 16780383. Our registered office is Unit 501 Omega Works, 4 Roach Road, London, E3 2NY.

We are the data controller for our website, enquiries and business relationships. This means we decide why and how this personal information is used. Contact us at hello@highguard.ai or write to our registered office, marked for the attention of the privacy lead.

When we handle personal information in a customer’s compliance documents or connected systems on their behalf, we act as a data processor. The customer decides why that information is used. See Customer data and AI.

Information we collect

• Enquiries and bookings. Your name, work email, organisation, role, meeting details and anything you choose to tell us by email, in a call or in our booking form.
• Accounts and business records. Your account identifiers, contact details, organisation, correspondence and billing or transaction information.
• Technical information. IP address, browser and device information, request times, error reports and activity needed to operate and protect our services. Where product analytics is enabled, this also includes app usage linked to your account.
• Customer content. Personal information in evidence, policies, staff registers, messages and other records that customers upload or make available through integrations.

We receive information directly from you, automatically when you use our services, and from your organisation when it invites you or shares records with us. We may also receive business contact details through introductions or public business sources, such as your organisation’s website or LinkedIn. If we contact you using details from another source, you can ask us where we obtained them.

Please do not include patient records, health information or other sensitive personal information in a demo booking or general enquiry. If sensitive information is needed for a customer engagement, the scope and handling must be agreed with the customer first.

How and why we use it

Answer enquiries and arrange meetings

We use contact details, booking information and correspondence to respond and discuss our service. Our lawful basis is our legitimate interest in answering business enquiries and developing customer relationships.

Provide the service and manage our relationship

We use account, contact, support and billing information to administer the service. Where you personally enter a contract with us, our basis is contract, including steps you ask us to take before a contract. For people acting for an organisation, our basis is our legitimate interest in delivering and administering that organisation’s service.

Keep services secure and resolve faults

We use technical records and activity logs to prevent misuse, investigate incidents and fix problems. Our basis is our legitimate interest in protecting our services and users.

Understand and improve the product

We use feedback and app usage information to understand what works and where people encounter problems. Our basis is our legitimate interest in improving the service. Where consent is required for analytics or device storage, consent is the basis for that processing.

Send relevant business communications

We may use business contact details to tell you about our services. Our basis is our legitimate interest in promoting relevant services to business contacts, or your consent where required. You can ask us to stop at any time.

Meet legal duties and deal with claims

We use relevant records to meet accounting, tax and other legal obligations. Our basis is legal obligation. For establishing or defending legal claims, our basis is our legitimate interest in protecting our legal rights.

You do not have to send us an enquiry or book a call. We need enough contact information to respond, and the account and billing information required to provide a contracted service. Without it, we may be unable to respond, create your account or provide that service.

Customer data and AI

To deliver the service, relevant customer content is processed by AI and document-processing providers. That content may contain staff names, work contact details, training records and other personal information. AI output is reviewed by people and approved by the customer. We do not use it to make decisions solely by automated means that have legal or similarly significant effects on individuals.

We process this information on the customer’s instructions under our agreement with them. Their privacy notice explains their purposes and lawful bases, including any additional condition needed for health or other special category information. This notice does not give us a separate permission to reuse their records.

We access connected systems with your organisation’s permission. Imported records follow the agreed retention arrangements.

If your information was supplied by a customer, contact that organisation first to exercise your rights. You can also contact us and we will help direct your request.

Who we share information with

People working for Highguard may access information to deliver and support the service. We also use providers for hosting, databases, authentication, email, scheduling, monitoring, analytics, AI and document processing.

Our website uses Cal.com to arrange meetings. The booking service receives the details you submit and technical information when the embedded calendar loads. Read the Cal.com privacy notice for its handling of information. Our app uses PostHog for product analytics where enabled.

We may share relevant information with professional advisers, regulators or authorities where needed for advice, a legal obligation or a legal claim. Customer evidence is shared with assessors or other recipients according to the customer’s instructions.

Processing outside the UK

Some providers process information outside the UK. For example, Cal.com states that it processes information in the United States. The locations used for customer content depend on the providers and services involved.

Where a restricted international transfer is made, the relevant protection must be in place. This may be UK adequacy regulations or contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for information about the locations and safeguards relevant to your data, including how to obtain a copy.

How long we keep information

Retention depends on the record and why it is needed. We use the following criteria to decide when information should be deleted or anonymised.

• Enquiries and bookings: whether the enquiry is still open, when we last had meaningful contact and whether a customer relationship has followed.
• Account and business records: whether the service is still active and whether records are needed to resolve outstanding support, payment or contractual matters.
• Accounting and legal records: the applicable legal retention requirements, claim periods and any ongoing dispute or investigation.
• Technical and analytics records: the period needed to investigate faults or incidents, understand usage and operate the relevant backup or deletion cycle.
• Customer content: the customer’s instructions and the return or deletion arrangements in our agreement, including backup handling.
• Marketing preferences: enough information to record and respect your request not to receive marketing.

Contact us if you need the retention arrangements for a particular record or engagement.

Cookies and analytics

Cookies and similar technologies can store information on your device or read it back. Their use differs between this website, the booking service and the signed-in app.

• This website: the booking calendar loads Cal.com content. That service receives connection information even if you do not complete a booking. You can email us to arrange a call instead.
• The app: authentication storage helps keep you signed in. Where PostHog is enabled, it receives account information and product usage, and may record how you move through the app. Anything you type is masked. Contact us to ask what is recorded for your account or to object.

You can use your browser settings to inspect, block or delete cookies and local storage. Blocking authentication storage may prevent sign-in. Browser controls do not stop all server-side logging. Contact us with questions about analytics or to object to our use of your information.

Your rights

Depending on the circumstances and our lawful basis, you can ask to access your personal information, correct it, delete it, restrict its use or receive a portable copy. If we rely on consent, you can withdraw it at any time by contacting us. Withdrawal does not affect processing that was lawful before you withdrew it.

To make a request, email hello@highguard.ai. We may need information to verify your identity. We normally respond within one month. If a lawful extension or exception applies, we will explain it.

If you have a complaint

Contact us and we will look into your concern. You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator. Visit ico.org.uk/make-a-complaint, call 0303 123 1113, or write to the ICO at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Changes to this notice

We will update this page when our handling of personal information changes and revise the date above. Where needed, we will bring significant changes to your attention before using information for a new purpose.