Privacy Policy

ClientTurn is a trading name of Blackwellen Limited (company number 16482166), registered office 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom. We are the organisation responsible for this website and for the ClientTurn service.

ClientTurn connects a business’s Meta (Facebook and Instagram) lead ads to automated follow-up, deterministic qualification and booking. That means personal data reaches us in two very different ways, and our legal role is different in each:

• Our customers. The business owners and team members who hold a ClientTurn account. For their account, billing, security and support data we are the controller, and sections 3 to 5 and 9 to 14 tell you what we do with it.
• Our customers’ leads. The members of the public who submit a lead form to, or exchange messages with, one of our customers. For that data our customer is the controller and we are their processor, acting only on their documented instructions. Sections 6 to 8 and 15 explain that arrangement.

If you enquired with a business and want your data removed, contact that business first — they decide, not us. If you cannot identify or reach them, write to legal@clientturn.com with the phone number or email address you used and we will identify the controller, pass the request on within 3 Working Days, and tell you who they are. We can also suppress your number across the platform so you are not contacted again, and we will do that on request.

We have not appointed a Data Protection Officer, because we are not required to under Article 37 UK GDPR. Responsibility for data protection sits with the directors, reachable at legal@clientturn.com.

We are registered with the Information Commissioner’s Office under registration number ZC160806.

This policy applies to:

• the clientturn.com marketing site;
• the ClientTurn application and its APIs and background jobs;
• email, SMS and WhatsApp messages sent or received through the service;
• our support and billing correspondence.

It does not cover the websites, adverts or systems of our customers, or the third-party platforms you connect. Those are governed by their own privacy notices.

• Identity and contact. Name, work email address, business name and address, phone number, and the role assigned to you in your workspace.
• Authentication and security. Hashed credentials, session records, IP address and user agent for sign-in events, multi-factor enrolment status, and security events such as failed sign-ins and password changes.
• Billing. Plan, subscription status, invoices, payment references, VAT status and billing address. Card numbers are entered into fields hosted by Stripe and never reach our servers; we hold only a token and the last four digits.
• Configuration. Your message templates, qualification questions, sending schedules, quiet hours, suppression lists and integration settings.
• Integration credentials. Access and refresh tokens for the platforms you connect. These are held server-side only, encrypted, and are never returned to a browser.
• Usage and diagnostics. Audit log entries for actions taken in the product, feature usage counts, and error diagnostics.
• Correspondence. Anything you send us by email, and our replies.

Where we rely on legitimate interests we have balanced our interest against your rights. In each case the processing is what a person would reasonably expect from a business software provider, the data is limited to what the purpose needs, it is never used to build a profile of you, it is never sold, and you can object at any time under section 13.

You can ask for a copy of the balancing test for any of these purposes by writing to legal@clientturn.com.

When a customer connects Meta, we receive the fields that customer’s lead form collects — typically a name, phone number, email address and the answers to the form’s own questions — together with the campaign, ad set, ad and form the lead came from. A customer may also import contacts by CSV or add them manually.

We then process, strictly on that customer’s instruction:

• the messages sent and received, including their content, delivery status and timing;
• the answers given to the customer’s qualification questions, and the outcome those answers produced under the customer’s own rules;
• opt-out and do-not-contact records, kept specifically so that a person is not messaged again;
• booking records, where the customer has connected a calendar or booking provider;
• attribution data linking a lead back to the advert that produced it.

What we never do with it. We do not sell it. We do not use it to advertise to the people it describes. We do not use one customer’s lead data to benefit another customer. We do not use it to train any machine learning model, and our AI provider is contractually barred from doing so. We do not enrich it from external data brokers.

Special category data. The service is not designed for it and customers are contractually prohibited from putting it in. Where a lead volunteers such information in a free-text reply, we hold it only as part of the message and apply the same security and retention rules.

This section, together with the Terms of Service, is the written contract required by Article 28(3) UK GDPR between a customer as controller and us as processor. The same terms, with security and sub-processor annexes, are published as our Data Processing Agreement; a countersigned copy is available on request from legal@clientturn.com.

• Subject matter and duration. Provision of the ClientTurn service for the duration of the customer’s subscription, plus the exit period in the Terms.
• Nature and purpose. Receiving, storing, organising, transmitting, analysing and erasing lead and message data in order to deliver automated follow-up, qualification, booking and reporting.
• Types of personal data. Name, phone number, email address, postcode or service area, lead form answers, message content, qualification answers, booking details, and campaign attribution identifiers.
• Categories of data subject. The customer’s prospective and existing clients, and the customer’s own staff users.
• Documented instructions. We process only on the customer’s documented instructions, which are given through the configuration in the product and these terms, unless required otherwise by law — in which case we tell the customer first unless the law prohibits it.
• Confidentiality. Everyone we authorise to process the data is bound by a duty of confidence.
• Security. We implement the measures in section 11, appropriate under Article 32.
• Sub-processing. Governed by section 8. General written authorisation is given by the customer on acceptance of the Terms, subject to the notice and objection right in that section.
• Data subject rights. We assist the customer by appropriate technical and organisational measures — search, export and deletion tools in the product — and by responding to reasonable requests for help.
• Articles 32 to 36. We assist the customer with security, breach notification and data protection impact assessments, taking into account the nature of the processing and the information available to us.
• Deletion or return. On termination we delete or return the data as set out in section 10 and in the Terms.
• Audit. We make available the information needed to demonstrate compliance and allow for audits, including inspections, by the customer or an auditor it mandates, on reasonable notice, no more than once in any 12 months except after a personal data breach, and subject to confidentiality and to not compromising other customers.
• Breach notification. We notify the customer without undue delay, and in any event within 24 hours, of becoming aware of a personal data breach affecting their data, with the information available at that point and updates as we get them.

We use a small, deliberately short list of providers to run the service. Each is engaged under a written contract imposing terms no less protective than these, each may act only on our instructions, and we remain fully liable to our customers for what they do.

Core sub-processors — engaged for every workspace:

Customer-enabled providers — these receive data only if the customer connects the integration or turns the feature on. When a customer connects one, that is an instruction from the customer as controller to disclose data to it:

The register above is also published on its own at clientturn.com/sub-processors, with a change log. We give customers at least 30 days’ notice by email before a new sub-processor begins processing their data. A customer may object on reasonable data-protection grounds; if we cannot resolve the objection, the customer may terminate the affected part of the service and receive a pro-rata refund.

Separately from sub-processing, we may disclose personal data to our professional advisers, insurers, auditors, a law enforcement body or regulator where legally required, and to a purchaser in connection with a sale of the business — in which case the purchaser is bound by this policy until it lawfully changes it with notice.

Our primary database, in which all account, lead, message and qualification data is held at rest, is hosted in London, United Kingdom.

Some providers we rely on process data outside the UK, as set out in section 8. Where a restricted transfer takes place we rely on:

• UK adequacy regulations for transfers to the European Economic Area;
• the International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement, for transfers elsewhere;
• in each case supported by a transfer risk assessment and by supplementary measures — encryption in transit and at rest, access control, and data minimisation.

You can request a copy of the relevant transfer mechanism, with commercial terms redacted, from legal@clientturn.com.

We keep personal data no longer than necessary. Where a customer deletes a record, it is removed from the live system immediately and from encrypted backups as those backups expire.

• Encryption. Data is encrypted in transit with TLS and at rest by the storage platform.
• Tenant isolation. Every tenant table carries a workspace identifier and is protected by database row-level security, so one workspace physically cannot read another’s records, even if application code is wrong.
• Secret handling. Service-role keys, provider tokens and webhook secrets are server-side only. They are never placed in a client bundle, never exposed through a public environment variable, and never returned in a response body.
• Webhook integrity. Every inbound webhook signature is verified before the payload is trusted, and events are deduplicated so a replayed event cannot cause a second action.
• Access control. Role-based access within a workspace; administrative access to the platform is restricted to named individuals, requires step-up authentication, and is written to an audit log.
• Least privilege and review. Access is granted on a need-to-know basis and reviewed when someone changes role or leaves.
• Backups. Encrypted daily database backups, held in the United Kingdom by our database provider.
• Change control. Changes are reviewed before release, and dependencies are monitored for known vulnerabilities.

No system is perfectly secure. If a personal data breach occurs we will notify the Information Commissioner’s Office within 72 hours where the breach is likely to result in a risk to individuals, notify affected customers without undue delay and within 24 hours of becoming aware where their data is involved, and notify affected individuals directly where the risk to them is high.

If you use ClientTurn to contact people, you are the controller for that contact and the sender of every message. You are responsible for:

• having a lawful basis under the UK GDPR and satisfying PECR regulation 22 for every message, including any reactivation of older leads — the age of a lead does not by itself make contacting them lawful;
• the wording of your messages, including identifying yourself and including a clear, working, free opt-out in every direct-marketing message;
• giving the people who contact you the privacy information Articles 13 and 14 require, at the point you collect their data;
• responding to requests those people make about their own data, within one month;
• keeping your own record of consent where you rely on it, and screening against the Telephone Preference Service where relevant;
• not putting special category data, criminal offence data, payment card data or children’s data into the service.

The product enforces opt-outs, quiet hours and attempt limits, and re-checks them immediately before every send. Those controls are a safeguard, not a legal opinion. They do not decide whether your campaign is lawful. That judgement is yours.

Under the UK GDPR you have the right to:

• be informed — which is what this policy is for;
• access a copy of your personal data;
• rectification of data that is inaccurate or incomplete;
• erasure, where the data is no longer needed, consent is withdrawn, or you object and there is no overriding ground;
• restriction of processing while a dispute about accuracy or legitimate interests is resolved;
• data portability for data you gave us that we process by automated means on the basis of contract or consent;
• object to processing based on legitimate interests, and an absolute right to object to direct marketing;
• withdraw consent at any time where processing relies on it, without affecting processing before withdrawal;
• not be subject to a decision based solely on automated processing producing legal or similarly significant effects. We do not make such decisions.

To exercise a right against us as controller, email legal@clientturn.com. We respond within one month, extendable by two further months for complex requests, and we will tell you if we extend. We will ask for enough information to be satisfied of your identity, and we do not charge a fee unless a request is manifestly unfounded or excessive.

If your data is held in a customer’s workspace, we will pass your request to that customer as controller and assist them, as described in section 1.

You may complain to us first, and you may complain at any time to the Information Commissioner’s Office — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113.

Our use of cookies, localStorage and similar technologies is described in the Cookie Policy. Nothing beyond what is strictly necessary to deliver the service you requested is stored or read on your device until you have given consent, as PECR regulation 6 requires.

ClientTurn is a business tool and is not directed at children. We do not knowingly collect data about anyone under 18, and customers are contractually prohibited from processing children’s data through the service. If you believe a child’s data has reached us, tell us at legal@clientturn.com and we will act promptly.

We will update this policy when the service or the law changes. The version date is shown at the top of this page.

Material changes — a new purpose, a new lawful basis, or a change that reduces your rights — are notified to account holders by email or in the product at least 30 days before they take effect. We keep previous versions and will provide one on request.

Data protection, privacy requests and formal notices: legal@clientturn.com.

Everything else, including account and technical support: support@clientturn.com.

By post: Blackwellen Limited, 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom.