AI and Data Use Notice
How artificial intelligence is used in RedRite’s business and client services
Controller: Shari Sant, trading as RedRite Website: www.redrite.co.uk
Last updated: 10 Sept 2026
1. Purpose of this addendum
This addendum explains how I use artificial intelligence and AI-assisted services when personal information may be involved. It supplements my main Privacy Notice and should be read alongside it.
Main Privacy Notice: https://www.redrite.co.uk/privacy-policy/
If this addendum and the main Privacy Notice appear inconsistent, please contact me. The main Privacy Notice contains the fuller explanation of your rights, complaints, security, retention and international transfers.
2. The role of AI in my work
I use AI as a support tool, not as a substitute for professional judgement. It may help me draft, organise, analyse, research, plan, generate ideas and configure automated workflows. I remain responsible for deciding what information is used, reviewing outputs and delivering the final work.
AI may be used in business administration and in services agreed with a client. It is not automatically used with every piece of client information, and I avoid entering personal information when the task can be completed without it.
3. AI and AI-assisted services currently used
Anthropic, including Claude Drafting, analysis, document work, research support, and building or testing automated workflows for client tech operations.
Google, including Gemini Research support and source discovery, which may sometimes relate to client work.
Fathom Recording client calls (where held via Google Meet or similar), producing transcripts, summaries, notes and action points.
The tools I use may change. I review this addendum when I introduce a new AI service that materially changes how personal information is processed. Services used only for infrastructure, email marketing, bookings, accounting or ordinary record-keeping (such as MailerLite, WordPress or Canva) are described in the main Privacy Notice rather than listed here as AI tools.
4. Personal information that may be processed
Depending on the agreed task, AI-assisted processing may involve:
- names, job titles, business contact details and organisation information;
- the content of emails, enquiries, meeting discussions, recordings, transcripts and notes;
- client briefs, business systems information, workflow documentation and project details;
- information about a client’s own customers, audiences or team members, where the client is authorised to provide it;
- technical and usage information generated when an AI service is accessed.
I do not normally need full payment-card information, passwords, government identification numbers or similarly high-risk credentials for AI-assisted work. Please do not include them in material supplied for AI processing.
5. Why I process information and the lawful bases
Contract and steps before a contract. I may use AI-assisted processing where it is reasonably necessary to understand requirements, prepare agreed work or deliver a service.
Legitimate interests. I may use AI to operate my business efficiently, create accurate notes, improve service delivery, support research and maintain consistent quality, where those interests are not overridden by a person’s rights and freedoms.
Consent. I use consent where a genuine choice is required, including where I ask permission for a particular recording or use of sensitive material. Consent is not claimed as the lawful basis for every use of AI.
Legal obligation and legal claims. Information may be processed where necessary to comply with law or establish, exercise or defend legal claims.
6. Special category information
Special category information includes information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric identification data, sex life and sexual orientation.
My services do not normally require this information, but it may be disclosed incidentally in a call, transcript, email or client document. Please avoid sharing it unless it is genuinely relevant. If it is not needed, I will, where practicable, minimise, redact or delete it. If it must be retained or deliberately used, I will identify an appropriate Article 9 condition, which may include explicit consent or necessity for legal claims.
7. Recordings and transcription
Fathom is normally present in client calls held via Google Meet. Participants receive or are given notice that the call is being recorded or transcribed and can raise a concern or ask for an alternative. Fathom may receive attendee details, calendar information, audio, video, transcripts, notes and meeting content.
Full Fathom recordings and transcripts are normally deleted within12 months of the call or the end of the related client engagement, whichever is later. This is managed through a regular manual review and deletion process. Relevant notes or agreed outputs may be kept in the client file for the period stated in the main Privacy Notice.
8. Data minimisation and client responsibilities
Before using personal information with an AI service, I consider whether the information is needed, whether it can be anonymised or reduced, the sensitivity of the material, the service and account being used, available privacy controls, retention and international-transfer arrangements.
Clients must not provide personal information about another person unless they are authorised to do so and have an appropriate lawful basis. A client should tell me before supplying material containing special category information, confidential information belonging to another person, children’s information or other unusually sensitive material.
9. Provider settings, retention and model improvement
AI providers offer different products, account types and privacy controls. Their role may also differ. A provider may act as my processor for some customer content and as an independent controller for account security, legal compliance, service administration or other purposes described in its own privacy information.
I do not make a blanket claim that every AI provider has zero retention or that no information can ever be used to improve a service. Where a provider offers relevant model-improvement, history, privacy mode, or deletion controls, I select and use settings appropriate to the information and task. Provider policies and technical settings can change, so they are reviewed periodically.
I also delete or reduce AI conversation and project content when it is no longer needed for the relevant business purpose, subject to legal, contractual and record-keeping requirements.
10. Human review and automated decision-making
AI-generated information can be incomplete, inaccurate or reflect bias in source material. I review outputs before using them in client deliverables or business decisions and do not treat an AI answer as automatically correct.
I do not use solely automated processing to make decisions about you that produce legal or similarly significant effects. If that changes, I will complete the necessary assessment, provide the required information and safeguards, and update this notice before the processing begins.
11. Sharing and international transfers
AI and transcription providers may process information in the United States or other countries outside the United Kingdom. Where the UK GDPR restricted-transfer rules apply, I use an available lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum.
Where appropriate safeguards are used, I assess the transfer as required and consider whether additional measures are needed. More detail is provided in the International Transfers section of the main Privacy Notice.
12. Security and confidentiality
I use reasonable technical and organisational measures, including secured accounts and devices, access controls, appropriate service settings, and data minimisation. Access is limited to people who have a genuine business need and are subject to appropriate confidentiality obligations.
No online or AI service can be guaranteed completely secure. Suspected personal data breaches are assessed and handled under my data-breach process.
RedRite holds Professional Indemnity, Public Liability and Cyber insurance cover, and is registered with the ICO.
13. Your choices and rights
You may ask whether your personal information has been used with an AI-assisted service, subject to legal limitations and the information reasonably available to me. You may also exercise the data-protection rights explained in the main Privacy Notice, including access, correction, erasure, restriction, objection and withdrawal of consent where applicable.
To make a request or discuss a concern, email hello@redrite.co.uk.
14. Complaints
You can also complain to the Information Commissioner’s Office. You do not have to contact me before contacting the ICO, although I welcome the opportunity to address a concern.
15. Provider privacy information
16. Changes and contact
I review this addendum at least annually and when a material change is made to the AI services, purposes or safeguards described here. The date at the top and foot shows when it was last updated.
Questions about this addendum can be sent to hello@redrite.co.uk.