1. Introduction
1.1. This Privacy Policy explains how Deus XAI sp. z o.o. ("Deus XAI", "we", "us", "our") collects, uses, shares and protects personal data in connection with the CDM Creator platform and website at https://cdmcreator.co.uk (the "Service").
1.2. Deus XAI sp. z o.o. is a company incorporated in Poland, registered office at Rybaki 22/14, 61-884 Poznań, Poland; KRS 0001204126; NIP PL7822961628; REGON 543194481.
1.3. We provide the Service to businesses in the United Kingdom and elsewhere. Depending on the circumstances, our processing is subject to the EU General Data Protection Regulation (EU GDPR), the Polish Personal Data Protection Act, and — in respect of the offering of the Service to individuals in the UK — the UK GDPR and the Data Protection Act 2018.
2. Controller and processor roles
2.1. When we are the controller. For personal data relating to your account, your use of the Service, billing, referrals, support and website analytics, Deus XAI is the controller. This Privacy Policy governs that processing.
2.2. When we are a processor. When you (our business customer) use the Service to enter and process personal data of third parties (e.g. your contacts, site personnel, and — where the feature is available — document signatories), you are the controller and we act as your processor. That processing is governed by our Data Processing Agreement (DPA) and by your own privacy notices, not by this Privacy Policy. You are responsible for having a lawful basis and for informing those individuals.
3. Personal data we collect (as controller)
3.1. Account and profile data: first and last name, email address, telephone number, password (stored in hashed form), your role, and the language you use.
3.2. Business/company data associated with your account: company name, company registration number (verified via the UK Companies House lookup), VAT number, business address (street, city, postcode), and your company logo (used in the documents you generate).
3.3. Billing and transaction data: subscription plan, payment history, refunds and invoicing details. Card payments are processed by our payment provider (e.g. Stripe); we do not store full card numbers.
3.4. Referral data: information relating to referral links and referral-based discounts.
3.5. Support and communications data: the content of messages you send us (e.g. via the contact form or support), and related metadata.
3.6. Technical and usage data: IP address, device and browser information, log data, and usage information collected via cookies and similar technologies (see our Cookie Policy).
3.7. We do not intentionally collect special categories of personal data about you as a customer. Please do not submit such data except where strictly necessary and lawful.
4. How we use personal data and our legal bases (as controller)
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and administering your account; providing the Service | Performance of a contract (Art. 6(1)(b)) |
| Processing payments, invoicing, managing subscriptions | Performance of a contract; legal obligation (Art. 6(1)(b), (c)) |
| Verifying business/company details | Legitimate interests — preventing misuse, ensuring B2B eligibility (Art. 6(1)(f)) |
| Providing customer support | Performance of a contract; legitimate interests (Art. 6(1)(b), (f)) |
| Operating the referral programme | Performance of a contract; legitimate interests (Art. 6(1)(b), (f)) |
| Securing, maintaining and improving the Service | Legitimate interests (Art. 6(1)(f)) |
| Sending service/administrative messages | Performance of a contract; legitimate interests (Art. 6(1)(b), (f)) |
| Sending marketing communications (where applicable) | Consent, or legitimate interests where permitted for existing business customers (Art. 6(1)(a)/(f)) |
| Complying with legal, tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
Where you opt in to our partner services and lead-sharing (section 6.4), our legal basis for that sharing is your consent (Art. 6(1)(a)), which you can withdraw at any time.
4.1. Where we rely on legitimate interests, we have balanced those interests against your rights. You may object to such processing (see section 9).
5. Automated processing and artificial intelligence
5.1. The Service uses automated processing and artificial intelligence (including AI provided by Anthropic) to generate draft documents based on the inputs provided. This document generation operates on the inputs you and your users provide and does not produce legal effects concerning you as our customer, nor does it involve solely automated decision-making about you within the meaning of Article 22 GDPR.
5.2. Where inputs contain personal data of third parties (entered by our business customers), that processing is carried out on the customer's behalf under the DPA, and AI providers act as our sub-processors under appropriate safeguards.
6. Who we share personal data with
6.1. We share personal data with:
- (a) Service providers / processors acting on our instructions, including: cloud hosting/infrastructure; the AI provider (Anthropic); the payment provider (e.g. Stripe); email/communications providers; analytics providers; and providers of address lookup and company-register verification. Where the Service generates COSHH content, providers of safety-data-sheet (SDS) data may also be involved.
- (b) Professional advisers (lawyers, accountants, auditors) under duties of confidentiality.
- (c) Authorities, courts or regulators where required by law or to protect our rights.
- (d) Successors in the event of a merger, acquisition or reorganisation.
6.2. We do not sell the personal data of the third parties whose information you enter into the Service (such as your workers, subcontractors, site personnel or clients). We share your own account and project data with partner service providers and insurers only where you have opted in — see section 6.4.
6.3. A current list of our key sub-processors is available on request by contacting us at info@cdmcreator.co.uk.
6.4. Partner services, referrals and leads (only with your consent). If you opt in, we act as a controller and share your own information — your name and contact details, and your project details such as project type, site location, indicative start date and project risk information — with vetted third-party service providers (for example asbestos, demolition or face-fit testing providers) and with insurers, so that they can contact you with relevant services or quotes. Our legal basis is your consent (Article 6(1)(a)). Taking part is optional, does not affect your use of the Service, and you can withdraw your consent at any time via your Account or at info@cdmcreator.co.uk (without affecting sharing already carried out). We share only data relating to you and your project; we do not share for these purposes the personal data of other individuals you have entered, and where a site is a residential property we limit the location information we share where appropriate.
6.5. Anonymised and aggregated data. We may create and share anonymised and aggregated data and insights that do not identify you or any individual (for example market trends and benchmarks) for analytics and commercial purposes. This is not personal data and is not subject to this Privacy Policy.
7. International data transfers
7.1. We are established in Poland (EEA). Some of our providers may process personal data outside the EEA and the UK (for example the AI provider). Where we transfer personal data internationally, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Agreement or Addendum, and/or adequacy/data-bridge decisions where available.
7.2. Transfers of personal data from the UK to the EEA (including to Deus XAI in Poland) are permitted on the basis that the EEA is recognised as providing adequate protection under UK law.
7.3. You may request more information about the safeguards we use by contacting us (section 13).
8. How long we keep personal data
8.1. We keep personal data only as long as necessary for the purposes described, including:
- (a) account and profile data — for the duration of your account and a reasonable period afterwards;
- (b) billing, tax and accounting records — for the periods required by applicable law;
- (c) support communications — for as long as needed to handle and evidence the matter;
- (d) data needed for legal claims — until the relevant limitation periods expire.
8.2. When personal data is no longer required, we delete or anonymise it. Retention of Customer Data processed on your behalf is governed by the DPA.
9. Your rights
9.1. Subject to applicable law, you have the right to: access your personal data; request rectification; request erasure; restrict processing; object to processing (including to processing based on legitimate interests and to direct marketing); data portability; and, where processing is based on consent, to withdraw consent at any time (without affecting prior processing).
9.2. To exercise your rights, contact us at info@cdmcreator.co.uk. We will respond within the timeframes required by law.
9.3. Requests relating to Customer Data. If you are an individual whose data was entered into the Service by one of our business customers (e.g. as a contact or site personnel), that customer is the controller. Please contact them directly; we will refer your request to the relevant customer.
10. Complaints
10.1. If you have concerns, please contact us first. You also have the right to lodge a complaint with a supervisory authority:
- (a) in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa (https://uodo.gov.pl);
- (b) in the UK, the Information Commissioner's Office (ICO) (https://ico.org.uk), and/or a supervisory authority in your EU country of residence or work.
11. Security
11.1. We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration, taking into account the state of the art and the risks involved. No system is completely secure; you are responsible for keeping your login credentials confidential and choosing a strong password.
12. Cookies
12.1. We use cookies and similar technologies as described in our Cookie Policy.
13. Contact
Deus XAI sp. z o.o., Rybaki 22/14, 61-884 Poznań, Poland. Email: info@cdmcreator.co.uk
14. Changes to this Privacy Policy
14.1. We may update this Privacy Policy from time to time. We will post the updated version with a revised "Last updated" date and, for material changes, provide additional notice where appropriate.
15. Precedence of mandatory law and severability
15.1. If any provision of this Privacy Policy conflicts with a mandatory provision of applicable data protection or other law, the mandatory provision of law shall apply in place of the conflicting provision to the extent of the conflict, and all remaining provisions of this Privacy Policy shall continue in full force and effect.
15.2. If any provision of this Privacy Policy is held invalid or unenforceable, the remaining provisions shall remain in full force and effect, and the invalid provision shall be applied with the minimum modification necessary to make it valid while giving effect to its original intent.