Privacy Policy

First Essential UK

Version: 1.1

Last updated: 9 September 2026

1.About this policy

This policy explains how we collect, use, share and protect personal information, and what rights you have over that information. It applies to our website at firstessential.uk, our customer portal at dashboard.firstessential.uk, our shop and hardware shop, our AI Assistant and voice services, our telephone and messaging channels, and the services we supply to business customers.

First Essential UK is a trading name of First Essential Holdings Ltd, a company registered in England and Wales under company number 15619967, whose registered office is at 10 Montague Place, Worthing, West Sussex, BN11 3BG, United Kingdom. In this policy, "we", "us" and "our" mean First Essential Holdings Ltd.

First Essential Holdings Ltd, trading as First Essential UK, is registered with the Information Commissioner's Office (ICO) under registration reference ZC184440. The current registration runs from 29 June 2026 to 28 June 2027.

Please read this policy together with our Cookie Policy, our Terms of Service and our Acceptable Use Policy. This notice explains our information practices; it is not a waiver of your data protection rights. Buying a service or accepting contractual terms is not consent to optional marketing, tracking or a new use of personal information.

2.The two different roles we act in

The law distinguishes between an organisation that decides why and how personal information is used (a controller) and an organisation that only uses personal information on another organisation's instructions (a processor). We act in both roles, and which one applies changes what this policy covers.

Where we act as a processor, our business customer determines the permitted purpose, provides its privacy information and is responsible for the lawfulness of its data and instructions. Our Data Processing Agreement sets out our permitted processing and both parties' responsibilities. Those contractual responsibilities do not remove our own duties or your rights. Actual activities determine the roles; the contract label alone does not.

Kiosk functionality may be supplied through our kiosk services or First Essential One. The information collected and our role depend on the particular deployment. Supplying the kiosk or platform does not, by itself, make us the controller of the business customer's end-customer information.

Our standard services do not include using a business customer's recordings, transcripts or other personal data for our own marketing, product development, service improvement or model training. They do not include customer-specific model training or fine-tuning. Accepting our terms or Data Processing Agreement does not authorise those uses. Any proposed separate processing requires a prior assessment of lawfulness, actual roles, information given to individuals and necessary contractual arrangements.

3.How to contact us about privacy

4.Who this policy applies to

This policy applies to:

• visitors to our websites and users of our online forms;
• people who enquire about our products and services, request a quotation, or book a demonstration or statement review;
• contacts at our business customers, prospective customers, partners, ambassadors and suppliers;
• people who hold a user account on a platform we operate for our own business;
• people who contact our support, sales or accounts teams by any channel;
• people who interact with our own AI Assistant, chat, telephone or messaging channels;
• applicants for roles with us, and people who correspond with us for any other reason.

5.The information we collect

We collect the following categories of personal information. Not every category applies to every person.

Identity and contact information. Name, job title, business name, business address, email address, telephone and mobile numbers, and messaging identifiers such as a WhatsApp number.

Account and relationship information. Login credentials and authentication data, account and user permissions, service configuration, the products and modules you use, correspondence with us, support tickets, meeting and demonstration bookings, and notes made by our team.

Transaction and commercial information. Orders, quotations, invoices, delivery and installation records, contract and term details, payment references and transaction identifiers, refunds and disputes, credit control records, and hardware serial numbers.

Payment card information. We do not request full card numbers or card security codes through conversations, messages or our AI Assistant. Enter payment credentials only through the relevant provider-operated secure payment route. For merchant card services, we act as an introducer and you contract directly with the provider; its notice explains its payment processing. We remain responsible for any referral information or payment references that we handle ourselves. If payment details reach an unintended channel, we treat this as an incident, restrict access and arrange secure removal. Card security codes must not be retained after payment authorisation.

Conversation and interaction information. The content of chat, email, telephone and messaging conversations; where recording applies, call audio; transcripts and written summaries of conversations; and the actions taken as a result, such as a booking created or a callback scheduled. Section 8 explains this in detail.

Technical and usage information. IP address, approximate location derived from IP address, device and browser type, operating system, language settings, referring page, the pages and features you use, the dates and times of use, session and error logs, and security event records.

Marketing information. Your marketing preferences by channel, the source and date of any consent, whether you have unsubscribed or objected, suppression records, and how you have engaged with our marketing.

Service interests. Information about the products, services and follow-up you tell us you are interested in.

Special category information. Please do not provide health or other special category information through our standard services. If we receive it accidentally, this does not authorise continued use. We restrict further processing to protecting the information, assessing the incident and arranging lawful removal, return or other necessary action. Our AI Assistant must not ask about, assess or respond to symptoms, conditions or clinical matters.

Voice recordings are not automatically biometric data. We do not use voice recognition to identify individuals. If we ever introduce voiceprint identification we will tell you separately and put in place the additional legal condition required before doing so.

6.Where we get your information from

• Directly from you, when you complete a form, create an account, buy from us, contact us by any channel, speak to us, or interact with our AI Assistant.
• From your employer or the business you represent, when it gives us your details as a contact, user or authorised person.
• From our business customers, where they instruct us to process information on their behalf. In that case we act as their processor and section 2 applies.
• From our payment, telephony, hosting and communications providers, in the form of transaction references, delivery reports and technical logs.
• From partners, ambassadors and referrers, where someone refers you to us. We will tell you who referred you if you ask.
• From publicly accessible sources, such as company websites, Companies House, the FCA register and business directories, when we research a prospective business customer.

Information about other people. If you provide another person's details, share only what is relevant and make sure you are entitled to provide it for the stated purpose. Please tell us about material errors so we can correct our records. Do not send customer lists, identity documents or sensitive records through an ordinary sales enquiry or support message when they are not needed. Business-customer processing follows its agreed secure instructions and data schedule.

Where we obtain personal information about you from another source, we will provide the required privacy information within a reasonable period and no later than one month after obtaining it. If earlier, we will provide it when we first communicate with you or, where we intend to disclose it to another recipient, no later than the first disclosure. We will explain the source, including whether it was publicly accessible. These requirements are subject to exceptions permitted by law.

7.What we use your information for, and our lawful basis

This section concerns activities for which we are controller. It does not authorise us to reuse business-customer content processed under a Data Processing Agreement for our own improvement, training or marketing.

We must have a lawful basis for each purpose. The basis for each purpose is set out below.

The legitimate interests we rely on

Where we rely on legitimate interests, the interests we pursue are: running and growing our business; responding accurately and promptly to enquiries; keeping a reliable record of what was requested and agreed; protecting our systems, staff, property and customers from fraud, abuse and security incidents; recovering sums properly owed to us; improving the quality of our services; and promoting our services to businesses likely to have a genuine interest in them. In each case we have considered whether that interest is overridden by your interests, rights and freedoms. You can ask us for a summary of that assessment, and you have the right to object (see section 15).

Information you have to give us

Where you are entering into a contract with us, or asking us to supply, install or support a product, some information is necessary for us to do so, and we make clear on the relevant form which fields are required. If you do not provide it, we may not be able to supply the product or service, open an account, deliver hardware, or take payment. Where information is required by law, for example for invoicing and accounting, we say so. All other fields are optional and you may leave them blank without consequence.

8.Our AI Assistant, calls, chat and recordings

This section applies where you interact with First Essential UK's own AI Assistant, chat, telephone, kiosk or messaging channels. Where you are interacting with an AI Assistant that we operate for another business, that business normally provides the notice for its processing. Section 2 explains our role and our own responsibilities.

Current AI voice status. We are testing the AI voice service. It is not currently used to handle First Essential UK's own operational telephone calls. If personal information is processed during testing for our own purposes, this policy applies to that processing.

Optional summaries. A written summary is an optional feature selected by a business customer as part of its agreed service configuration. It is not a mandatory feature of every deployment. Whether audio or transcripts are created or retained is checked separately from the summary setting. The relevant notice and agreed settings must describe the features actually enabled.

You are dealing with an automated assistant. Where a conversation is handled by our AI Assistant rather than a member of staff, we tell you so at the start of the conversation. The assistant is operated by First Essential UK on behalf of First Essential Holdings Ltd.

What is recorded or stored.

What we use conversations for. To answer your enquiry; to take or amend a booking or order; to keep an accurate record of what was requested and agreed; to resolve disputes and complaints; to monitor and improve the quality of our service; and to train our own staff. Each of these is a separate purpose with its own lawful basis in the table at section 7.

Our services do not authorise using your conversations to train general-purpose AI models. Adjusting an AI Assistant's instructions or approved knowledge content to answer enquiries is separate from model training.

Who can access conversations. Internal access to UK customer information is limited to our two authorised UK team members where needed for their work. Relevant service providers may also process information as described in section 11, including communications, hosting, speech-processing and AI-processing providers. The internal access limit does not mean those providers cannot process the information needed to deliver the service.

Retention. Audio, transcripts, summaries and system logs are kept for different periods. See the table at section 13.

Your alternatives. You do not have to use the AI Assistant. You can reach a person by emailing info@firstessential.uk or calling 020 38 38 06 09 and asking to speak to a member of staff. Where we rely on legitimate interests you can object at any time (section 15). Where we ask for your consent to record, you can refuse and we will offer an alternative route.

Do not give card details in conversation. Never type or read out full card numbers, expiry dates or security codes through ordinary chat, messaging or our AI Assistant. Use the secure payment route we provide. Accidental capture must be treated as an incident, with access restricted and secure removal arranged; card security codes must not be retained after authorisation.

9.Automated decision-making

Our AI services do not independently approve or refuse customers, grant credit, set personalised prices, or make decisions about people that produce legal or similarly significant effects.

The AI Assistant mainly provides customer service and general information, captures enquiries and leads, and directs people to booking channels. We provide scripts and configure instructions for the services agreed with each business customer. Optional written summaries depend on the customer's selected configuration.

A customer's instructions do not extend the assistant's authority to make the significant decisions described above. Any proposed change to this scope must be assessed before it is enabled, with the relevant notices and safeguards updated where required.

Where we process information on a business customer's instructions, that business is responsible for explaining its use in its own privacy notice. Our standard AI services do not include using special category information for automated decision-making.

10.Marketing

We market our own products and services by email, telephone, post and, where you have agreed, messaging channels. Marketing is sent by First Essential UK, a trading name of First Essential Holdings Ltd.

Consent. Where the law requires your consent, we ask for it separately, using an unticked box, and we never make consent to marketing a condition of buying from us. You may consent for some channels and refuse others.

Soft opt-in. Where you have bought from us, or negotiated to buy from us, and we obtained your details in the course of that sale or negotiation, we may email or message you about our own similar products and services. We give you a way to opt out when we collect your details and in every message we send.

Business contacts. The rules for marketing emails and texts distinguish corporate subscribers, such as limited companies and limited liability partnerships, from individual subscribers, including sole traders and certain partnerships. For individual subscribers, we obtain consent unless a lawful exception applies. Corporate subscribers remain entitled to applicable sender-identification and opt-out protections. Personal information remains protected by data protection law in either case, and we honour objections to its use for direct marketing.

Automated calls. We only make automated marketing calls that play a recorded message, or that are conducted by an automated voice system, where we hold your specific prior consent to that type of call. Consent to ordinary marketing, or to live marketing calls, is not sufficient and we do not treat it as sufficient.

Live marketing calls. Before making live marketing calls we screen against the Telephone Preference Service, the Corporate Telephone Preference Service and our own suppression list. We identify ourselves, we provide a contact address or freephone number on request, and we do not withhold our number.

Stopping marketing. You can object to direct marketing at any time and we will stop. There is no exception to this right and you do not have to give a reason. Use the unsubscribe link in any email, reply "STOP" to a message, tell the person you are speaking to, or email info@firstessential.uk. We keep a minimal suppression record, consisting of your contact details and the fact that you objected, so that we do not contact you again. That minimal record is kept for as long as needed to honour your objection and is used for no other purpose.

Purchased lists and public sources. The fact that your details are publicly available, or appear on a list we have bought, does not by itself give us permission to market to you, and we do not treat it as though it does.

11.Who we share your information with

We share personal information with the following categories of recipient. We do not sell personal information.

Where a supplier processes personal information on our behalf, it must act under written processing terms that restrict its purposes, require confidentiality and appropriate security, and address return or deletion. A provider acting as a separate controller is responsible for its own processing, as explained in this policy.

Supplier information. The categories above describe who may receive information for each service. You can request supplier identities, processing locations and applicable safeguards at info@firstessential.uk. For processing on a business customer’s behalf, the named supplier schedule and authorisation procedure form part of its Data Processing Agreement. Relevant provider information is also supplied with cookie choices and any separate provider-operated service. Product branding does not restrict disclosures needed for informed authorisation or your rights.

12.Sending information outside the United Kingdom

We use suppliers that process information in the United Kingdom and internationally. Our customer relationship and communications platform uses United States infrastructure; other services may involve the European Economic Area and further locations in the relevant supplier chain. The location and safeguards depend on the service and its enabled features. We do not describe our services as UK-only or EU-only.

Restricted transfers require a valid UK transfer arrangement. Depending on the recipient and processing, that may be applicable UK adequacy regulations, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum. We must assess the actual transfer route, any required data protection test and additional safeguards before relying on them. Overseas support access must be considered as well as server location.

Business-customer processing follows the transfer arrangements identified in its Data Processing Agreement and supplier schedule. You can request the relevant locations, the safeguards relied on and a copy of those safeguards, subject to necessary redactions, by emailing info@firstessential.uk. AI voice is currently being tested; this policy does not describe a proposed voice-supplier contract as already signed.

13.How long we keep your information

We keep personal information only for as long as needed for the stated purpose or required by law. Retention is assessed separately for each type of record.

Our retention procedure requires a review when an enquiry, order or support issue closes. We use manual review and the relevant platform functions; we have not configured a company-wide automatic deletion process. If a complaint or specific legal claim justifies continued retention, we restrict the record to that purpose and review it again when the matter closes. Keeping necessary written contract evidence does not automatically justify keeping all related audio.

At the end of the applicable period, we must arrange deletion or irreversible anonymisation. Backup copies pending deletion must be protected and put beyond ordinary use, with controls against reintroducing expired data on restoration.

Deleting an agent or closing an account is not the same as erasing every related record. For our customer relationship platform, the supplier documents a 60-day restore window for deleted contacts, separate 60-day audit-log retention, and daily database backups with seven days of backup history. These are different processes: the backup history is not a universal seven-day erasure deadline, and separately deleted records or individual agents may not be recoverable.

Information processed on a business customer's behalf follows its agreed retention and exit instructions in the Data Processing Agreement and completed annexes.

14.How we protect your information

We are responsible for protecting personal information with technical and organisational measures appropriate to its sensitivity and the risks of processing. Business customers must also protect the accounts, equipment and instructions they control; this does not remove our responsibilities. No system can be guaranteed completely secure. Report a suspected security incident to office@firstessential.uk.

Where a personal data breach is not unlikely to risk people's rights and freedoms, we notify the ICO without undue delay and, where feasible, within 72 hours of awareness. If notification is later, reasons for delay must be provided. Where the risk is high, we also inform affected individuals without undue delay, subject to lawful exceptions. For data processed on a business customer's behalf, we notify that customer without undue delay after awareness and assist it with its obligations.

Don leads security and access administration, with David covering incidents when Don is unavailable. David and Don handle internal UK customer access. We use separate user accounts and multi-factor or additional verification on most accounts; this is not a claim that every account or service has identical controls.

15.Your rights

Subject to the conditions and exemptions in data protection law, you have the right to:

To exercise any right, email info@firstessential.uk or write to us at the address in section 3. We do not charge a fee unless a request is manifestly unfounded or excessive. We respond within one month, which we may extend by up to two further months for complex requests, in which case we will tell you within the first month and explain why. We may ask for proof of identity before we act, so that we do not disclose your information to someone else.

If your request concerns information we hold on behalf of a business customer, we will tell you promptly, pass the request to that customer without undue delay, and assist it in responding.

16.How to complain about how we have handled your information

We take data protection complaints seriously and we have a procedure for handling them. This section is our data protection complaints procedure.

How to complain. Email info@firstessential.uk with the subject line "Data protection complaint". If you cannot use email, telephone 020 38 38 06 09 and ask for the data protection contact, or write to Data Protection, First Essential Holdings Ltd, 10 Montague Place, Worthing, West Sussex, BN11 3BG. If you need to complain in another format, or need an adjustment because of a disability, tell us and we will accommodate it.

What helps us. Please tell us your name and contact details, what happened and when, which service or channel was involved, any reference numbers, what you would like us to do, and whether you have raised the matter with us before. You may complain without providing all of this, and we will ask for anything further we need.

Who deals with it. David, as First Essential's registered Data Protection Officer, handles data protection complaints, reachable at info@firstessential.uk. The telephone and postal routes above are also available. If you are unhappy with how your complaint was handled, you may raise it with Don at office@firstessential.uk; this does not restrict your right to contact the ICO.

What we do, and when.

1. We acknowledge your complaint within 30 days of receiving it, and normally much sooner.
2. We begin investigating without undue delay.
3. We keep you informed of progress where the investigation is not straightforward.
4. We tell you the outcome, what we found and what we are doing about it, without undue delay.

The 30 days is the deadline for acknowledging your complaint. It is not a deadline for completing the investigation, which may take more or less time depending on what is involved. Requests to exercise your rights under section 15 have their own separate statutory deadlines and are not delayed by this procedure.

If your complaint concerns a business customer's data. Where the information concerned is held by us on behalf of one of our business customers, that customer is the controller. We will tell you, route your complaint to that customer promptly, and assist it in responding.

If you are not satisfied. You may ask us to review the outcome by replying to our response. You also have the right to complain to the Information Commissioner's Office at any time, whether or not you have complained to us first:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone 0303 123 1113

ico.org.uk/make-a-complaint

We would appreciate the chance to address your concerns first.

17.Cookies and similar technologies

Our use of cookies, pixels, local storage and similar technologies is explained in our Cookie Policy. You can change your choices at any time using the Cookie settings link in our website footer.

18.Children

Our website and services are intended for businesses and for adults. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

19.Links to other websites

Independent payment-provider websites and social media services have their own privacy notices for their separate activities. This does not exclude our customer portal at dashboard.firstessential.uk from the scope described in sections 1 and 2, or remove our responsibility for information we disclose or technologies we embed on our pages. A link to an independent site does not authorise us to share additional personal information with it. Read that site's notice when you visit.

20.Changes to this policy

We keep this policy under review and update it when our processing changes. The version number and last-updated date appear at the top. Where we intend to use your personal information for a new purpose not already explained in this policy, we will update the relevant privacy information and tell you before starting that processing. Where the law requires consent, we will obtain it first.

First Essential UK is a trading name of First Essential Holdings Ltd, registered in England and Wales under company number 15619967. Registered office: 10 Montague Place, Worthing, West Sussex, BN11 3BG, United Kingdom.