Privacy policy

Who we are

FiveForward is a UK AI agent consultancy that designs and builds AI agents inside Microsoft 365 and trains client teams to build their own. We are the data controller for the personal information described in this policy, which means we decide how and why it is used.

• FiveForward Ltd, registered in England and Wales, company number 17377585.
• Registered office: Wellington House, 90-92 Butt Road, Colchester.
• Based in Colchester, Essex.
• Registered with the Information Commissioner's Office, registration reference ZC229212.
• Email: info@fiveforward.co.uk
• Phone: 01206 688452

This policy covers fiveforward.co.uk, the forms and chat agent on it, and the personal information we handle while delivering consultancy work. Where we work inside a client's own Microsoft 365 tenant, that client remains the controller of the data in their tenant and we act on their instructions. Where we act as a processor we do so under a written data processing agreement that sets out what we may do with the data.

What we collect

Information you give us

• Contact form. Your name, email address, firm, your role, the topic of your enquiry and whatever you write in the message field.
• Consultation request. Your name, work email address, firm, firm size, sector and what you are hoping to get out of the call.
• Booking a call. If you book directly into the diary, the booking is handled by Microsoft Bookings and collects your name, email address and any notes you add.
• Concierge chat. Anything you type into the chat agent, along with the conversation transcript. See the Concierge chat agent below.
• Email, phone and meetings. Correspondence and notes from calls, workshops and engagements.

Information collected automatically

• Technical and security data. Our hosting provider processes IP addresses and request information to serve pages and protect the site from abuse.
• Analytics data, only if you allow it. Pages viewed, approximate location derived from IP address, device and browser type, referring site and how you move around the page. Nothing analytics related runs until you choose to allow cookies.

We do not use automated decision making or profiling that produces legal or similarly significant effects.

If we contacted you first

We run outbound business-to-business contact with firms we think we can help. If a message from us was the first you heard of us, this section explains where your details came from and what we do with them.

• Where the details come from. Publicly available sources such as company websites and LinkedIn, and Hunter.io, a business email lookup service.
• What we collect. Work contact details only: name, work email address, job title, firm name and firm website.
• Our lawful basis. Legitimate interests, being the promotion of our services to businesses that plausibly need them. We have balanced that interest against the interests of the person we are contacting.

We do not send bulk marketing to personal email addresses, and every message comes from a person and can be replied to. Anyone can ask to be removed by replying or emailing info@fiveforward.co.uk. We will stop contacting you and keep a suppression record so we do not contact you again. Contact details for prospects who do not reply are deleted within 12 months.

Why we use it, and our legal basis

Under UK GDPR we need a lawful basis for each use of your personal information. Ours are set out below.

• Replying to your enquiry and arranging a consultation. Legitimate interests, and where you are considering engaging us, taking steps at your request before entering a contract.
• Outbound business contact with firms we think we can help. Legitimate interests, as set out in if we contacted you first.
• Delivering consultancy, training and build work. Performance of our contract with you or your organisation.
• Keeping records of our work, invoices and accounts. Legal obligation for tax and accounting records, and legitimate interests in running the business and defending claims.
• Analytics cookies and behaviour tools. Your consent, which you can withdraw at any time.
• Site security, spam prevention and keeping the site working. Legitimate interests in protecting our systems and the people who use them.

This site does not sign you up to a mailing list, and filling in a form on it does not put you on one. The outbound business email we send is a separate thing, covered in if we contacted you first. If we ever start a marketing mailing list, we will ask for your consent first and every message will carry an unsubscribe link.

Cookies and analytics

Analytics is off by default. When you first arrive you will see a banner asking whether to allow cookies, and nothing beyond the strictly necessary runs until you choose. Your choice is stored in your browser under fiveforward.analyticsConsent, so we can remember it without setting a cookie of our own.

If you allow cookies, we use Google Analytics 4 (property G-PNTM50LNZT) to understand which pages are useful, and Microsoft Clarity to see where pages confuse people. Between them they set cookies named _ga, _ga_<property>, _gid, _clck and _clsk. Google Advertising features and ad personalisation stay switched off whatever you choose.

If you decline, or later change your mind, we switch analytics off, tell Google and Microsoft that consent is withdrawn, remove the Clarity script and clear those cookies. You can change your choice at any time using the Cookie settings button in the corner of any page, and you can clear cookies and site data through your browser settings.

Two other things are stored in your browser rather than on our servers: fiveforward.conciergeSession keeps your chat conversation going if you move between pages, and fiveforward.conciergeNudge remembers that you dismissed the chat prompt so it does not keep reappearing. Our hosting provider may also set strictly necessary cookies to protect the site from automated abuse. Strictly necessary storage does not require consent.

Web fonts on this site are served by Google Fonts, which means your IP address is visible to Google when a page loads. That happens before any cookie choice, because it is part of rendering the page.

The Concierge chat agent

Concierge is an AI agent built with Microsoft Copilot Studio. It answers questions about our services, pricing and approach. It loads only when you open it, and it connects anonymously, so we do not know who you are unless you tell it.

Anything you type is sent to Microsoft to generate a reply, and conversation transcripts are stored in Copilot Studio, where we may review them to improve the agent and to follow up if you have asked us to. Please do not put confidential information, client details or special category data into the chat. If you need to share something sensitive, use the contact form or email us instead.

Who we share information with

We do not sell your personal information and we do not share it for anyone else's marketing. We do rely on a small number of service providers who process information on our behalf:

• Microsoft. Microsoft 365 for email, files and meetings, Microsoft Bookings for scheduling, Copilot Studio for the Concierge agent, Microsoft Dataverse and the Power Platform for the CRM that holds our client and prospect contact records, and Microsoft Clarity for behaviour analytics if you allow it.
• Formspree. Delivers the contact and consultation form submissions to our inbox.
• Hunter.io. Sources business contact details and delivers our outbound email.
• Google. Google Analytics if you allow it, and Google Fonts for typefaces.
• Cloudflare. Hosting, content delivery and protection against automated abuse.

We may also share information with our professional advisers where they need it, and with law enforcement or regulators where the law requires it.

Where your information is held

Some of the providers above are based outside the UK or operate global infrastructure, so your information may be processed outside the UK, including in the United States. Where that happens, transfers are covered by UK adequacy regulations or by the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the provider's own safeguards. We can tell you which safeguard applies to a given provider if you ask.

How long we keep it

• Enquiries that do not lead to work. Up to two years from your last contact with us, so we have context if you come back.
• Outbound contact records. Deleted within 12 months where there is no reply. The suppression record we keep so we can honour an opt-out is held indefinitely, because that is the only way to be sure we do not contact someone again.
• Client records, contracts and correspondence. Six years after the end of the engagement, in line with the limitation period for contract claims.
• Invoices and accounting records. Six years after the end of the relevant accounting period, as UK tax law requires.
• Analytics and chat transcripts. Held by Google, Microsoft and Cloudflare under their own retention settings. We do not keep separate copies.

How we protect it

Our working environment is Microsoft 365 with multi-factor authentication, device encryption and access limited to people who need it. The site is served over HTTPS. No system is perfectly secure, but we take reasonable technical and organisational measures, and if a breach were likely to put your rights at risk we would tell you and the Information Commissioner's Office as the law requires.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• have inaccurate information corrected;
• ask us to delete information where we no longer need it;
• ask us to restrict how we use it, or object to us using it on the basis of legitimate interests;
• ask for the information you gave us in a portable format;
• withdraw consent at any time, including your cookie choice, without affecting anything done before you withdrew it.

Email info@fiveforward.co.uk and we will respond within one month. There is no charge, and we may ask for enough information to confirm who you are before we act.

Complaints

If you are unhappy with how we have handled your personal information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

We update this policy when the way we work changes, for example if we add a new tool to the site. The date at the top shows when it last changed. Our terms of use cover the rules for using this site.