Our lawful bases for processing, purposes and data categories under UK GDPR
Effective date:
Last updated:
Lawful Basis, Purposes & Data Categories
This page sets out Handlet's lawful bases for processing your personal data under UK GDPR, the purposes we use it for, and the categories of data we process. It complements our Privacy Policy and our summary How we process personal data.
1. Lawful Bases for Processing
Handlet processes personal data under the following lawful bases defined in Article 6 of the UK GDPR.
Account creation, login and service delivery
Lawful basis: Contract (Article 6(1)(b))
Reason: Processing is necessary to provide the Handlet service to the user.
Inbox and message ingestion and display
Lawful basis: Contract (Article 6(1)(b)) for account users and platform delivery. For customer communication data processed on behalf of a business customer, Handlet acts as processor and the business customer is responsible for its own lawful basis.
Reason: Processing is required for the core inbox functionality and is performed under the customer's instructions for customer communication data.
AI-assisted features
Lawful basis: Contract (Article 6(1)(b)) for platform users and service delivery. For customer communication data processed on behalf of a business customer, Handlet acts as processor and the business customer is responsible for its own lawful basis.
AI Assistance: Handlet uses AI for intent recognition and, where enabled, drafts, summaries, quote support, social content and call assistance. AI output can be wrong and should be checked before use. Learn More
Reason: Processing is required for AI-assisted features such as intent and confidence classification and, where enabled, social post content, message drafts, quote text, complaint-response preparation, summaries, recommendations, or configured automation. Users retain control over content they use, publish, or send, except where they explicitly enable supported automation settings.
Workspace insights and opt-in benchmarking
Lawful basis: Contract (Article 6(1)(b)) where processing is needed to provide insights for the customer's own workspace. Cross-customer benchmarking and learning are off by default and only happen if the customer opts in through its workspace settings. If Handlet acts as controller for that benchmarking, it must identify and document its lawful basis before the processing begins, and it uses only combined, de-identified data.
Reason: Processing helps Handlet give recommendations for the customer's own workspace. If the customer opts in, combined results can be used to compare performance across workspaces. See section 3.6 of the Privacy Policy.
Call-agent and voice features
Lawful basis: Contract (Article 6(1)(b)) for platform users and service delivery. For caller or customer data processed on behalf of a business customer, Handlet acts as processor and the business customer is responsible for its own lawful basis, AI voice-assistant notices, and call-recording notices.
Reason: Processing is required to provide call routing, call assistance, transcripts, recordings, summaries, analytics, and follow-up workflows where the feature is enabled.
Storage of customer contact and message data (on behalf of the user)
Lawful basis: The business customer determines the Article 6 lawful basis for its own customers' data. Handlet processes that data as processor under the customer's instructions and our data processing terms.
Reason: Processing is necessary to deliver the assistant functionality and message management features requested by the business customer.
Reason: Required to maintain service quality, stability and performance.
Marketing emails (e.g. product updates)
Lawful basis: Legitimate Interests (Article 6(1)(f)) or Consent (Article 6(1)(a))
Reason: Non-essential marketing communications will normally rely on user consent.
Handlet GTM B2B prospecting (controller)
Lawful basis: Legitimate Interests (Article 6(1)(f)) for discovering and enriching limited B2B prospect data from public sources (for example Companies House officer records and published website business contacts). Where electronic marketing is sent, Handlet also applies PECR rules: corporate B2B recipients may be contacted only with required identification and opt-out, and sole traders or individual subscribers generally require consent or another PECR-permitted route.
Reason: Handlet processes limited prospect data as controller to identify and, where lawful, contact relevant UK businesses about Handlet's own products. Outreach is subject to do-not-contact suppressions and recipient checks. This does not describe processing Handlet performs as a processor on behalf of a customer workspace.
Connecting third-party communication channels (e.g. Gmail, WhatsApp, Messenger)
Lawful basis: Contract (Article 6(1)(b)) for providing the requested connection, with user authorisation/consent where required by the relevant provider or law.
Reason: Users explicitly authorise connections between Handlet and third-party services and can revoke those connections in account settings.
Durable Handlet copies of records from a connected business system (e.g. a CRM or job-management system)
Lawful basis: Contract (Article 6(1)(b)) between Handlet and the business customer for delivering the feature. For the underlying personal data about the business's own customers, the business customer determines the Article 6 lawful basis as controller; Handlet processes the copy as processor under that customer's instructions and our data processing terms.
Reason: The business customer authorises the connection and instructs Handlet to keep its own copy of records, for example job occurrences, their status, dates, service type, value, and notes, so that history, reporting, and assistant features remain available and consistent when the third-party system is slow, offline, disconnected, or has deleted the record under its own retention rules.
Note on retention: Once copied, the record is retained under Handlet's published retention rules and the customer's deletion controls, not the source system's retention rules. Deleting the record in the source system does not delete Handlet's copy. The business customer remains responsible for the notice it gives its own customers, and Handlet provides a notice template.
Vendor constraints: A durable copy does not create rights Handlet did not have. Copied records inherit the constraints of the source vendor's terms, including any prohibition on using that content to train models. Copied CRM content is used only within the originating workspace.
Owner-asserted job records created in Handlet
Lawful basis: Contract (Article 6(1)(b)) with the business customer for the feature; the business customer's own controller basis for the underlying data about its customer. Handlet acts as processor.
Reason: A user of the business confirms in Handlet that a job happened, so the business has a durable record of completed work, its value, and its outcome for reporting and follow-up. Records are labelled with their origin so a copied record is never presented as if the business had confirmed it.
Payments a business customer records against a job or quote
Lawful basis: The business customer determines the Article 6 lawful basis as controller; Handlet processes as processor under its instructions. Handlet's own Article 6(1)(b) covers delivering the feature.
Reason: The business records what its own customer paid, when, by what method, and against which job or quote, so it can reconcile revenue and follow up on unpaid work. These are the business's records of its own commercial relationship; Handlet is not a payment processor for these amounts and does not take or hold the money.
Acquisition and marketing-attribution measurement (advertising, search, and analytics)
Lawful basis: Contract (Article 6(1)(b)) between Handlet and the business customer for delivering the measurement feature. The business customer is the controller for measurement carried out on its own website and in its own platform accounts and determines the Article 6 basis for it. Where information is stored on or read from a visitor's device on the business's website, Consent under PECR (and Article 6(1)(a) where applicable) is required and is the business customer's responsibility to obtain and record.
Reason: Processing is necessary to show a business which marketing channel produced an enquiry and to measure the cost and return of its channels. Handlet records click identifiers, campaign labels, UTM parameters, landing and referrer hosts, the consent state it is given, and the attribution lookback window, and retrieves reporting data from platforms the business connects with its own account.
Additional platform requirements: Data obtained from Google APIs, and anything aggregated, anonymised, or derived from it, is subject to the Google API Services User Data Policy Limited Use requirements: it is used only to provide or improve user-facing Handlet features for the workspace that granted access, is not used for advertising or transferred to advertising platforms or data resellers, and is not used to train generalised AI or machine-learning models. Google's consent requirements for UK, EEA, and Swiss end users apply to the business customer's own use of Google advertising products.
Consent state is recorded, not assumed: Where the consent state supplied to Handlet is unknown, it is reported as unknown rather than treated as consent.
Compliance with legal obligations
Lawful basis: Legal Obligation (Article 6(1)(c))
Reason: Processing necessary to meet legal or regulatory requirements (e.g. tax, regulatory compliance).
Handling data deletion requests and data subject rights
Lawful basis: Legal Obligation (Article 6(1)(c))
Reason: Required to comply with data subject rights under UK GDPR.
2. Purposes of Processing (Plain Language)
Handlet processes personal data for the following purposes.
Purpose
Description
Providing the Handlet service
To allow users to manage messages in one inbox, generate AI-assisted replies and quotes, and manage customer communications.
Account authentication and management
To ensure that only authorised users can access their accounts and associated data.
Channel connections and synchronisation
To ingest and send messages through connected services such as email, messaging platforms and social media (with user consent).
Operating and improving the product
To maintain reliability, security and performance, including diagnosing and resolving technical issues.
Workspace insights and opt-in benchmarking
To analyse workspace data under the customer's instructions for recommendations in that workspace and, only if the customer opts in, to create combined, de-identified benchmarks across workspaces.
Keeping a durable record of jobs, payments, and customer history
To hold job occurrences, their outcomes and values, and payments recorded against them in the customer's workspace, including copies of records from a connected business system, so history and reporting survive independently of that system.
Measuring where enquiries come from
To record how an enquiry reached a business (advertising click identifiers, campaign labels, UTM parameters, landing and referrer hosts, consent state) and to retrieve reporting data from advertising, search, and analytics platforms the business connects, so it can see channel performance, cost, and return.
Communicating with users
To send service communications relating to account activity, security alerts and, where lawful, product updates.
Handlet GTM B2B prospecting
To discover and enrich limited public B2B prospect data for Handlet's own sales pipeline and, where PECR and UK GDPR allow, to send relevant B2B sales messages with opt-out.
Legal and regulatory compliance
To meet legal obligations such as responding to data subject requests and maintaining necessary records.
Handlet does not sell personal data.
Handlet does not use customer message content to train AI models for unrelated purposes.
Handlet never sells customer messages, contacts or CRM records. Cross-customer benchmarking only happens if the customer opts in.
3. Categories of Data Processed
3.1 Account and Identity Data
Examples: Name, email address, password (stored in hashed form).
Lawful basis: Contract
Retention: Retained while the account is active and thereafter only as required by legal obligations and retention policies.
3.2 Business and Profile Data
Examples: Business name, trade or service type, user configuration settings (such as tone preferences and working hours).
Lawful basis: Contract
Retention: Retained while the account remains active.
3.3 Customer and Communication Data (processed on behalf of the user)
Examples: Customer names, customer contact details, message content, message metadata (timestamps, channels, identifiers), call transcripts, call recordings, call summaries, call outcomes and call metadata where call-agent features are enabled.
Lawful basis: Determined by the business customer as controller. Handlet processes this data as processor under customer instructions.
Retention: Retained while the workspace uses the service or until deletion is requested and completed, subject to backup, audit, legal, security and provider retention limits. Call recordings default to 90 days unless the workspace configures another valid period, keeps a specific recording, or disables recording. Call transcripts, summaries, outcomes, and related call metadata default to 24 months (730 days) unless the workspace configures another valid period or keeps a specific transcript; after that period Handlet automatically redacts transcript text and related call insights from primary storage. Recording audio and transcript text follow separate retention windows.
3.4 Technical and Usage Data
Examples: IP address, device type, log data, feature usage information (non-content analytics).
Lawful basis: Legitimate Interests
Purpose: Security, diagnostics and service reliability.
Retention: Stored for limited operational and security periods. Security or incident records may be retained longer where needed to investigate abuse, fraud, reliability, or legal claims.
3.5 Data Subject Requests and Audit Data
Examples: Records of access or deletion requests you make, and logs we keep to meet legal and record-keeping obligations.
Lawful basis: Legal Obligation or Legitimate Interests
Retention: Kept only as long as required by law or to protect the security of the service.
Lawful basis: Contract, Legitimate Interests, Legal Obligation, or the customer's controller lawful basis depending on context.
Retention: Credential secrets are deleted immediately when revoked or disconnected. Import rows and external references are typically retained for 30 days after cleanup triggers. Matching metadata and participant indexes are typically retained for 90 days. Connection and mapping metadata is typically retained for up to 365 days. Audit and manual-resolution records are typically retained for up to 730 days.
Lawful basis: Contract, or the customer's own lawful basis as controller, for insights in the customer's own workspace. For opt-in cross-customer benchmarking, see section 1 (Workspace insights and opt-in benchmarking).
Purpose: Recommendations and quality checks for the customer's own workspace; if the customer opts in, combined benchmarks across workspaces.
Retention: Retained only while needed for the relevant service, benchmark, audit, legal or security purpose. Aggregated or anonymised outputs may be retained separately from the source data where they are no longer designed to identify a person, business, account, message or call.
Exclusion. Data obtained from Google APIs, and anything aggregated, anonymised, or derived from it, is excluded from cross-customer benchmarking and insight products regardless of authorisation, because the Google API Services User Data Policy Limited Use requirements apply to derived and anonymised data as well as raw data. Records copied from a connected CRM are likewise used only within the originating workspace.
3.8 Job and Service History Records (processed on behalf of the user)
Examples: job status; scheduled, occurred, completed, and cancelled dates; service or job type and its identifier in the source system; job value and currency; links to the customer record, property, and conversation; free-text job notes; typed commercial notes about the customer (general, service, billing, risk, or owner notes); and provenance details recording the source system, the record's identifier in that system, and whether the record was copied from a connected system or asserted by one of the business's own users.
Lawful basis: Determined by the business customer as controller. Handlet processes this data as processor under customer instructions.
Purpose: Durable job and service history, revenue and repeat-customer reporting, and follow-up workflows.
Special category risk: Free-text job notes and commercial notes are unbounded and may incidentally contain special category data. Handlet does not solicit it; the business customer remains responsible for any Article 9 condition. Before certain AI processing, personal data is minimised or redacted on Handlet's own infrastructure.
Retention: Retained for the life of the workspace, or until the workspace or the linked customer profile is deleted, or until the business customer requests deletion. Deleting the workspace or the linked customer profile removes the record. Not governed by the retention rules of the source system: deleting the record in a connected system does not delete Handlet's copy.
3.9 End-Customer Payment Records (processed on behalf of the user)
Examples: payment amount and currency, payment date, payment method, payment reference, free-text payment notes, and links to the related job, quote, customer, and conversation.
Lawful basis: Determined by the business customer as controller. Handlet processes this data as processor under customer instructions. These are payments the business's own customers made to the business, they are separate from Handlet's own subscription billing records.
Purpose: Revenue reconciliation, unpaid-work follow-up, and commercial reporting for the business customer.
Retention: Retained for the life of the workspace or until the business customer requests deletion, and where required for the business customer's tax, accounting, legal, and dispute purposes. Deleting a conversation removes the link to that conversation but preserves the financial record. Records are append-only for users of the workspace: corrections are recorded as refunds, credits, or reversals rather than by editing history.
3.10 Acquisition, Advertising, and Search Data (processed on behalf of the user)
Examples:
Click identifiers: gclid, gbraid, wbraid, fbclid.
Campaign structure: platform, platform account, campaign, ad group, ad, and creative identifiers.
Page context: landing page host and path, and referrer host. Full query strings are not stored.
Consent state: granted, denied, not required, or unknown.
Attribution lifecycle: attribution status, reason a touchpoint could not be attributed, lookback expiry, time zone, capture channel, and erasure timestamp.
Bindings: links to the quote-widget submission, conversation, customer record, and pricing decision the touchpoint resolved to.
Landing handoff: a hashed, short-lived, single-use handoff token; the raw token is never stored.
Platform reporting: Google Ads campaign, ad group, keyword, and creative metrics; Google Search Console top queries, top pages, clicks, impressions, click-through rate, and average position; Google Analytics 4 aggregated report rows.
Offline conversion uploads to the business's own Google Ads account, click identifier, conversion action, conversion timestamp, time zone, order reference, value, and currency. No hashed email, phone number, name, or address is sent.
Lawful basis: Determined by the business customer as controller for measurement on its own site and in its own platform accounts; Handlet processes as processor under its instructions. Where information is stored on or read from a visitor's device, Consent under PECR is required and is the business customer's responsibility.
Purpose: Lead-source attribution, marketing channel performance, and cost-and-return reporting for the business customer.
Personal data status: A click identifier does not name a person on its own. Once bound to an enquiry it can connect a person's advertising click to their later enquiry, so Handlet treats it as personal data. Search Console top queries are free text and may contain personal data despite Google withholding rare and sensitive queries at source.
Access controls: Click identifiers (gclid, gbraid, wbraid, fbclid), the free-text UTM values (utm_term, utm_content), and landing handoff tokens are restricted to Handlet's privileged service role. Ordinary authenticated workspace users have no read access to those fields at all, and see attribution outcomes and campaign labels instead.
Retention: Click identifiers, free-text UTM values (utm_term, utm_content), and the landing path are retained only until the enquiry's attribution lookback window expires, or until erasure is requested, whichever is first. On erasure the identifiers are removed and the touchpoint is marked erased. Non-identifying campaign, ad, creative, and UTM labels and platform performance metrics are retained while the platform connection exists and purged on disconnect or workspace deletion. The Search Console snapshot is a cache overwritten approximately hourly and capped at 10 queries and 10 pages. GA4 caches are bounded per connection and period and overwritten on refresh. Connection credentials are deleted immediately on revocation or removal.
Use restrictions: Subject to the Google API Services User Data Policy Limited Use requirements described above and in the Privacy Policy. Not used for serving, retargeting, or personalising advertising; not transferred to advertising platforms, data brokers, or information resellers; not used to train generalised AI or machine-learning models; not used in cross-customer benchmarks. Handlet does not build a cross-site identity profile and does not attempt to re-identify search queries Google has anonymised.
4. When We Rely on Legitimate Interests
Under UK GDPR we can process data where we have a "legitimate interest" that is not overridden by your rights. Where Handlet uses this basis, we apply the following.
Element
Description
Interest
Running a secure, reliable platform and protecting users, their businesses and the integrity of the service.
Necessity
Processing such as logging, monitoring and abuse detection is necessary to operate the service safely and effectively.
Balance
We keep data to a minimum, restrict who can access it, and do not use it for unrelated marketing or to train AI. Your rights and interests are protected through our privacy controls and the information we publish here.
We review this whenever we change how we process data or introduce new processing activities.
5. Special Category and Criminal Data
Handlet does not intentionally process special category personal data (such as health data, race or religion) or criminal offence data as part of its standard product functionality.
If such information appears within message content provided by users, it is processed only to the extent necessary to provide the service (for example displaying messages, classifying intent, or supporting enabled AI features) and in accordance with Handlet's Privacy Policy and applicable data protection law.
The same applies to other unbounded free-text fields that may incidentally contain it, in particular job notes and payment notes in a business customer's workspace (categories 3.8 and 3.9), and search queries retrieved from Google Search Console (category 3.10). Handlet does not solicit special category or criminal offence data in any of these fields, minimises or redacts personal data on its own infrastructure before certain AI processing, and excludes it from cross-customer benchmarking. Where Handlet acts as processor, the business customer as controller remains responsible for establishing an Article 9 or Article 10 condition for anything of this kind in its own records.