Privacy Policy

The Trustee for The Shataz Trust ("custum.ai", "we", "us", or "our") is the data controller responsible for your personal data. We provide AI-powered business solutions including AI Caller, AI Receptionist, and AI Webchat services.

If you have any questions about this Privacy Policy or how we handle your personal data, you can contact our privacy team at info@custum.ai.

We collect and process the following categories of personal data:

Information you provide directly • Contact and enquiry data: name, email address, phone number, company name, and any information included in messages you send via our contact forms or email • Account data: login credentials and preferences if you have a client account • Communication records: records of correspondence between you and our team

Information collected automatically • Usage data: pages visited, time on site, referring URLs, browser type, device type, and IP address • Cookie data: session identifiers and analytics identifiers (see Section 7 on Cookies)

Data provided by our clients (end-user data) If you are a business client, you may provide us with data about your own customers (e.g., call recordings, chat transcripts, CRM records) for the purpose of training and operating AI agents. We act as a data processor for this data, and you remain the data controller. Processing of this data is governed by a separate Data Processing Agreement.

We use your personal data for the following purposes and on the following legal bases:

Purpose | Legal Basis To respond to your enquiries and provide our services | Performance of a contract / Pre-contractual steps To manage your client account | Performance of a contract To send service-related communications (invoices, updates, alerts) | Performance of a contract To improve our website and services through analytics | Legitimate interests To comply with legal obligations (tax, regulatory reporting) | Legal obligation To send marketing communications about our services | Consent (you may withdraw at any time)

We will never sell your personal data to third parties, and we do not use client business data or end-user conversation data to train general-purpose or third-party AI models.

We may share your personal data with the following categories of recipients only where necessary to provide our services:

• Service providers: cloud hosting providers, CRM platforms, payment processors, and IT support partners — all operating under data processing agreements with equivalent data protection obligations • AI infrastructure providers: large language model API providers used to power our AI agents (data is processed in accordance with their enterprise data protection terms) • CRM integrations: systems such as HubSpot, Salesforce, and Zoho CRM, where you have authorised the integration as part of your service configuration • Professional advisers: lawyers, accountants, and auditors bound by confidentiality obligations • Law enforcement or regulators: where required by applicable law or to protect our legal rights

We do not share your data with any other third parties without your explicit consent.

Some of our service providers are located outside the United Kingdom and the European Economic Area. Where we transfer personal data to countries that do not offer an equivalent level of data protection, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office or the European Commission • Adequacy decisions where applicable • Binding corporate rules where applicable

You may request further information about the specific safeguards in place for any international transfer by contacting us at info@custum.ai.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements.

• Enquiry and contact data: 2 years from last contact, or for the duration of the client relationship if a contract is established • Client account and contract data: 7 years from end of contract (to comply with financial record-keeping requirements) • Website analytics data: 26 months in anonymised or aggregated form • Call recordings and chat transcripts (client end-user data): as specified in your Data Processing Agreement, typically 90 days unless extended by client instruction

When data is no longer required, it is securely deleted or anonymised.

Our website uses cookies and similar tracking technologies. We use:

Essential cookies — required for the website to function (session management, security). These cannot be disabled.

Analytics cookies — help us understand how visitors use our site (page views, traffic sources). We use anonymised analytics and do not track individual users across third-party sites.

We do not use advertising or retargeting cookies.

You can control cookie preferences through your browser settings. Disabling analytics cookies will not affect your ability to use the site.

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• End-to-end encryption for all data in transit (TLS 1.2+) and at rest (AES-256) • Role-based access controls and principle of least privilege • Regular security assessments and penetration testing • Staff training on data protection and information security • Incident response procedures with notification obligations

In the event of a data breach likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay as required by applicable law.

Our services are not directed at children under the age of 16 and we do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will delete it promptly. If you believe we may have collected data from a child, please contact us at info@custum.ai.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will update the effective date at the top of this page when we make changes.

For material changes, we will provide more prominent notice — for example, by email to active clients or a notice on our website. We encourage you to review this page periodically.

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:

Email: info@custum.ai Post: The Trustee for The Shataz Trust (ABN 68 629 156 933), Data Protection, Suite 3, 16 Brodie-Hall Drive, Bentley, WA, 6102

We aim to respond to all privacy-related enquiries within 5 business days.