Trust, security and UK GDPR at Setterly

About Setterly

• Business name: Setterly (operated by AIM Noremac Ltd trading as Setterly)
• Company number: 13229948 (registered in England and Wales)
• ICO registration: ZC197083
• Registered address: Cambridge House, 47 Clarendon Road, Watford, England, WD17 1HP
• Contact email: hello@setterly.co

Our role - controller vs processor

When you use Setterly products to contact your leads, you control why and how lead data is used. In most cases:

• You are the data controller.
• Setterly is the data processor, acting on your instructions.

When someone contacts Setterly directly (for example via a website form), Setterly acts as a data controller for that enquiry.

What data we process for clients

We typically process lead contact and enquiry information such as:

• First name and mobile number
• Lead source and timestamps (as recorded in your CRM)
• Conversation responses needed for qualification (for example vehicle requirement, buying timeframe, monthly budget)
• Message delivery and opt-out status

How we protect data

We use practical controls to protect personal data and reduce risk:

• Access control - limited access by role and business need
• Secure authentication for internal tools
• Encryption in transit where supported by vendors
• Operational logging and monitoring
• Incident response process, including breach notification where required
• Secure handling of integrations and API credentials

Sub-processors and Suppliers

We use trusted suppliers to run our service (for example hosting, messaging, analytics, and CRM connectivity). We:

• Put written terms in place with suppliers where required
• Limit supplier access to what is necessary

Our main sub-processors and suppliers are:

• GoHighLevel - CRM, SMS and calendar
• Twilio or the SMS carrier connected through GoHighLevel - SMS delivery
• OpenAI - AI conversation generation
• Supabase - website forms and email
• Vercel - website hosting
• Google Analytics - website analytics, with consent
• Meta - ads measurement, with consent

More sub-processors may be used for specific client integrations; we list them in the data processing agreement.

International Transfers

Some suppliers may process data outside the UK. Where this happens, we use appropriate safeguards recognised by UK data protection law (for example contractual protections).

Retention and Deletion

We keep personal data only as long as needed for the purpose it was collected. For website enquiries, we retain data for up to 24 months unless you ask us to delete it sooner. For client processing, retention and deletion follow your instructions and our DPA.

Your Choices and Rights

If you contact Setterly directly, you can ask us to: access, correct, delete, restrict, or object to our use of your data. You can also withdraw consent for marketing at any time.

Cookies and Analytics

Our website uses Google Analytics to understand site usage and the Meta Pixel to measure our ads. Both are non-essential, so they only load cookies after you click Accept on our cookie banner. Until then, Google Analytics runs in a cookieless, consent-denied mode and the Meta Pixel does not set cookies.

Your choice is stored in your browser. You can change it at any time with the button below, or by clearing this site's data in your browser.

Contracts and Documentation

To request documents, email hello@setterly.co. We can provide:

• Our Data Processing Agreement (DPA) template
• A full sub-processor list for your integration