Privacy Policy

1. Who we are

Byron O'Connor Information Technology ("we", "us", "our") is a technology consultancy registered in the United Arab Emirates, operating from Abu Dhabi and serving clients worldwide through this website, techwithbyron.dev.

For personal data processed through this website and our services, we act as the data controller. Where we operate AI messaging services on behalf of a business client (for example, an AI assistant answering messages for a salon), the client business is the data controller and we act as the data processor, processing personal data only on that client's documented instructions.

Contact: Byronoc123@gmail.com.

2. Scope of this policy

This policy covers:

• this website and its contact form;
• our consultancy engagements;
• AI messaging and automation services we build and operate for business clients, including conversations handled on WhatsApp, Facebook Messenger and Instagram on behalf of those clients.

3. Data we collect through this website

• Contact form. Name, email address, and the content of your message. Used solely to respond to your enquiry.
• Email. If you email us, we keep your address and the correspondence so we can reply and keep a record.
• Technical data. Like most websites, our hosting provider may log IP address, browser type and pages visited for security and troubleshooting. We do not run advertising trackers on this site.

Form submissions are delivered to us through the third-party form service FormSubmit, which forwards the message to our email and does not use the content for its own purposes.

4. Messaging services (WhatsApp, Messenger, Instagram)

Where we provide AI assistant services for a business client, messages sent to that business's WhatsApp number, Facebook Page or Instagram account may be processed by our systems to generate replies, manage bookings, and send service notifications (for example, appointment reminders).

• What we process: the phone number or account identifier you message from, your display name, the content of your messages, and records of appointments or transactions you discuss with the business.
• Why: to answer your enquiry, book and manage appointments, send you service messages you would reasonably expect (confirmations, reminders, follow-ups), and to help the business improve its service.
• Who is responsible: the business you are messaging is the data controller of that conversation. We process it on their behalf. If you have a privacy concern about a business conversation, you can contact either that business or us and we will route your request appropriately.
• Opt-out: you can reply "STOP" (or ask the business) at any time to stop automated marketing or reminder messages. Messaging platform providers (Meta, WhatsApp) also process message data under their own privacy policies, which apply in addition to this one.
• AI disclosure: where an AI assistant is used, the business discloses this in line with applicable rules; you can always ask to speak with a human.

5. AI processing

Our AI services generate replies using large language model (LLM) providers. When a message is processed:

• message content necessary to generate a reply is sent to the LLM provider as part of a prompt;
• we instruct providers not to use this data to train their models, consistent with their terms for API usage;
• AI answers for client businesses are grounded strictly in that business's own service information — we do not feed client data into models serving other clients;
• every AI message is logged for audit and quality purposes, with access restricted to the relevant business and to us.

6. Client & consultancy data

For consultancy clients, we process business contact details (name, email, phone), project materials and credentials strictly to deliver the contracted work. We sign data processing agreements where required, follow client security requirements, and return or delete project data at engagement end on request.

7. Legal bases (UK GDPR / EU GDPR)

Where UK/EU data protection law applies, we rely on:

• Consent — when you contact us or opt in to receive messages;
• Contract — to deliver services you or a client business have requested;
• Legitimate interests — site security, service improvement, and responding to business enquiries, balanced against your rights;
• Legal obligation — where retention or disclosure is required by law.

8. Sharing & sub-processors

We never sell personal data. We share it only with providers necessary to operate, each bound by data protection terms:

We may also disclose data where required by law, regulation or valid legal process.

9. Retention

• Website enquiries: kept up to 24 months, then deleted unless they become client records.
• Messaging conversations: retained for the duration of the client business's subscription and up to 12 months after, then deleted or anonymised, unless the business or law requires longer.
• Consultancy project data: per the engagement agreement, typically deleted or returned within 90 days of project end on request.

10. Your rights

Subject to applicable law, you have the right to: access your personal data; correct inaccurate data; request deletion; object to or restrict processing; receive your data in a portable format; and withdraw consent at any time. You may also complain to your local supervisory authority (for example, the UK ICO, or in the UAE, the UAE Data Office).

To exercise any right, email Byronoc123@gmail.com. We respond within 30 days. If your enquiry relates to a business's AI assistant, we will coordinate with that business to action your request.

11. International transfers

We are based in the UAE and serve clients globally, so personal data may be processed outside your country. For UK/EU personal data, transfers are protected by UK IDTA or EU Standard Contractual Clauses with our sub-processors, and application data is hosted in the EU (Frankfurt/London regions). We apply equivalent safeguards for other regions.

12. Security

We apply industry-standard measures: encryption in transit (TLS) and at rest, strict access controls (least privilege, secret management), audit logging of automated message sends, and prompt deletion of data we no longer need. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the relevant regulator as required by law.

13. Children

Our services are directed at businesses. We do not knowingly collect data from children under 13 (or under 13–16 where local law sets a higher age). If you believe a child has provided us personal data, contact us and we will delete it.

14. Changes to this policy

We will post any changes on this page and update the "last updated" date. For material changes affecting client businesses' customers, we will notify the business in advance.