Privacy Policy

Crystal Smart & Security Ltd Last updated: 13 October 2026

1. Who we are

This policy explains how Crystal Smart & Security Ltd ("we", "us", "our") collects and uses personal information. We are an installer of smart home, security and related systems based in South Wales, and we also carry out larger projects across the UK.

We are the controller of the personal information described in this policy.

• Company name: Crystal Smart & Security Ltd
• Company number: 15496285
• Registered address: 5 Watermark, Ferry Road, Cardiff, Wales, CF11 0JU
• Phone: 029 2002 9200
• Website: www.crystalsmartsecurity.co.uk
• Privacy contact: hello@crystaltech.group

We have not appointed a Data Protection Officer. For any privacy question or request, email hello@crystaltech.group or write to us at our registered address.

2. What information we collect

We collect only what we need to deal with your enquiry and carry out work for you.

Website forms and chat. Your name, email address, phone number, address or postcode, details of the job you are interested in, and anything else you choose to tell us.

Phone calls handled by Amelia, our AI assistant. Calls to 029 2271 2624, and some calls we make to you, are handled by "Amelia", an AI voice assistant. She tells you at the start of the call that she is an AI. Calls are transcribed, not audio-recorded: no recording of your voice is kept. From the call we collect your name, contact details, address or postcode, the job you need, your preferred time for a callback or visit, your marketing choices, and the call transcript and summary. Call data is not used to train AI models, by us or by our AI provider. If you would rather not speak to an AI, email hello@crystaltech.group instead.

WhatsApp. If you message us on WhatsApp, we receive your WhatsApp name, phone number and the content of your messages.

Email. Your email address, name and the content of your messages and any attachments.

Customer jobs. If you become a customer: your name, contact details, installation address, survey notes, quotes, orders, invoices and payment records, details of the equipment installed, and service and warranty history. We do not ask for or record card details, bank details, alarm codes or passwords over the phone or by our AI assistant.

Website use. Technical information such as your IP address, browser type and pages visited may be collected by our website platform and through cookies (see section 10).

Please don't share sensitive information (for example health information) with us unless it is needed. If you mention it, we will delete it unless you ask us to note that someone in your home needs extra help.

3. How we use your information and our lawful bases

Purpose	Lawful basis (UK GDPR)
Responding to enquiries, calling you back, giving guide prices, arranging free surveys	Steps you have asked us to take before entering a contract; or our legitimate interest in responding to enquiries
Transcribing calls and emailing the details to our team	Our legitimate interest in recording your enquiry accurately and passing it to the right person
Carrying out surveys, installations, servicing and warranty work	Performance of our contract with you
Confirming appointments you have booked, including automated confirmation calls	Performance of a contract or steps before a contract
Invoicing, accounting and tax records	Legal obligation
Sending marketing (offers and service reminders)	Your consent (see section 4)
Keeping our systems secure, preventing fraud and handling disputes or complaints	Our legitimate interests, and legal obligations where they apply

Where we rely on legitimate interests, we have considered your rights and expectations. You can object at any time (see section 8).

4. Marketing and how to opt out

We only send marketing if you have agreed to it, and we ask separately for each channel:

• email
• text message (SMS)
• automated calls from our AI assistant

Saying no doesn't affect your enquiry or any work we do for you. We record what you agreed to, how and when.

We will not make automated marketing calls unless you have specifically agreed to calls from our AI assistant. We don't leave automated voicemails, and we won't call you again if you tell us not to.

You can withdraw consent at any time by:

• clicking "unsubscribe" in any marketing email,
• replying STOP to a marketing text,
• telling Amelia or any of our team during a call, or
• emailing hello@crystaltech.group.

We will still send messages you need about an enquiry or job you have with us, such as appointment confirmations.

5. Who we share your information with

We do not sell your personal information. We share it only with service providers who process it for us under written contracts (processors), and where the law requires it.

Provider	What they do	Location
xAI	AI voice assistant (Amelia): call handling and transcription. xAI deletes call data within 30 days and does not use it to train its models.	United States
Twilio	Phone network services that connect calls to and from our numbers, and call logs	United States
Microsoft 365	Email, including the team mailbox where call and enquiry details are delivered. The mailbox is hosted for us by our sister company Crystal Voice Data Ltd.	UK/EU, with possible US access
Crystal Voice Data Ltd	Group IT and email hosting, acting on our behalf	UK
Duda	Website hosting, and website forms	United States
WhatsApp (Meta)	Messaging, if you contact us on WhatsApp	Various, including the US

We may also share information with professional advisers (such as accountants and lawyers), with the police or regulators where the law requires it, or with a buyer if our business is sold. If our business is sold, the buyer will have to look after your information in line with this policy.

6. International transfers

Some of our providers, including xAI, Twilio and Duda, may process your information in the United States. Where information leaves the UK, we make sure it is protected by one of the following:

• the UK–US data bridge, where the provider is certified under the UK Extension to the EU–US Data Privacy Framework;
• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses;
• other safeguards allowed by UK data protection law, such as binding corporate rules.

Contact us for more information about these safeguards.

7. How long we keep your information

Information	How long
Enquiries that don't lead to work (leads)	24 months from our last contact
Customer records (jobs, quotes, invoices, warranty and service history)	6 years after the end of the job or our last contract with you
Call logs and call records	12 months
Call transcripts held by our AI provider	Up to 30 days
Marketing consent records	As long as you receive marketing, then 24 months after you opt out

We delete or anonymise information securely at the end of these periods, unless we need it longer for a legal claim or the law requires it.

8. Your rights

Under UK data protection law you have the right to:

• access a copy of your personal information;
• correct information that is wrong or incomplete;
• erase your information in some circumstances;
• restrict how we use your information in some circumstances;
• object to our use of your information based on legitimate interests, and to direct marketing at any time;
• data portability, to receive information you gave us in a reusable format, in some circumstances;
• withdraw consent at any time, where we rely on consent;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects. Amelia takes your details for our team, and she does not make decisions of this kind about you.

To use any of these rights, email hello@crystaltech.group or call 029 2002 9200. We may need to check your identity. We will reply within one month, and this can be extended in some cases, which we will tell you about. There is normally no charge.

9. Complaints

If you are unhappy with how we have handled your information, please contact us first at hello@crystaltech.group. We will acknowledge your complaint within 30 days and let you know the outcome without undue delay.

If you are still not satisfied, you can complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113

10. Cookies

Our website may use cookies and similar technologies. Which cookies are used, and the choices you have, are shown in the cookie banner when you first visit the site. Non-essential cookies are only used if you agree to them through the banner. You can change your choices through the banner or your browser settings.

11. Children

Our services are for adults. We don't knowingly collect information from anyone under 18, and our AI assistant will not take details from someone who says they are under 18. She will ask them to have a parent or guardian contact us. If you think a child has given us their information, email hello@crystaltech.group and we will delete it.

12. Keeping your information secure

We use appropriate technical and organisational measures to protect your information. These include restricting access to staff who need it, using reputable providers under written contracts, and not asking for payment details, alarm codes or passwords over the phone.

13. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated. If we make significant changes, we will tell you where appropriate.

Last updated: 13 October 2026