1. Introduction

Genifea, brand owned by Soham Technologies Limited, (“we”, “us”, “our”) operates an AI-powered platform for estate agencies. This policy explains what personal data we handle, why, on what legal basis, how long we keep it, and the rights you have. We comply with the UK GDPR and the Data Protection Act 2018 (and, where applicable, the EU GDPR).

2. Our Role: Processor and Independent Controller

We act in two distinct capacities depending on the specific processing:

• As a data processor — we handle the personal data of an agency’s end users (callers, tenants, buyers, sellers) to deliver the service on that agency’s instructions. For this data the estate agency is the controller; we process it only as needed to provide the service and under our agreement with them. The agency’s own privacy notice also applies to you, and you can exercise your rights with the agency or with us (see Your Rights).
• As an independent controller — we determine the purposes and means ourselves for: visitors to our website; our estate-agency customers and their staff (account and billing data); the de-identified, redacted, or anonymised datasets we create from interactions to improve, develop, and (in future) train our products; and security, fraud-prevention, and product analytics. Where we re-use data we originally handled for an agency to create these datasets, we do so as authorised by that agency, and thereafter act as a separate, independent controller (not a joint controller) for that derived data, under our own legal basis (see Legal Basis). For data we control in this capacity, you exercise your rights directly with us (see Your Rights).

3. Whose Data We Process

• Website visitors — people who visit genifea.com.
• Customers — estate agencies and their staff who use Genifea.
• End users — callers, tenants, buyers, sellers, and other users who interact with our AI on an agency’s behalf (by phone, WhatsApp, email, messaging, or any other channel).

4. Categories of Personal Data

• Identity & contact data — name, phone number, email address.
• Communication data — call recordings, transcripts, messages (including WhatsApp), and emails.
• Business & property data — enquiry details, property interest, appointment data.
• Interaction data — conversation history and behavioural signals about how an enquiry was handled.
• Technical & usage data — device, log, and usage information.

5. How and why we use personal data

5.1 Delivering the service

We use personal data to operate the AI assistant for the agency — answering enquiries, qualifying leads, booking and managing appointments, taking messages, and routing to staff.

5.2 Quality assurance and service improvement — what we do today

Authorised Genifea personnel review a limited selection of interactions — including call recordings and transcripts, particularly those where the AI did not perform as intended — to diagnose problems, fix errors, and improve the product. This review focuses on how the enquiry was handled, not on identifying the people involved. Access is limited to authorised personnel, we minimise the personal data used, and we retain review material only as long as necessary for this purpose.

5.3 Building and training our AI — what we may do

We do not currently use interaction data to train machine-learning models. We reserve the right to do so in the future, and if we do, we will use only de-identified or anonymised data:

• We may create redacted copies of interactions — transcripts with identifying details removed, and call recordings with personal details (such as names, phone numbers, and email addresses) masked (“beeped”) out — and use them to train and improve our AI models.
• We use such data to learn how enquiries are handled, not to identify individuals.
• We do not use identifiable voice recordings or other identifiable personal data to train models without a separate lawful basis (such as your explicit consent).

Where we can fully anonymise data so that no individual can be identified, it is no longer personal data and may be retained and used indefinitely (see Retention).

5.3.1 Google user data

The use and transfer of raw or derived user data received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to provide the scheduling features you see in the product. We do not use Google user data — including Google Calendar data or any data derived from it — to train or improve any AI or machine-learning model.

5.4 Security, fraud prevention, and legal compliance

We use personal data to keep the service secure, detect and prevent abuse, and meet our legal obligations — including handling requests from public authorities under our Government & Law-Enforcement Data Request Policy (see Requests from public authorities).

5.5 Aggregated insights

We may produce aggregated and anonymised statistics and industry insights. These do not identify any individual.

6. Legal Basis

7. Automated Decision Making

Our AI makes some decisions autonomously, without a person reviewing each one beforehand — most importantly, qualifying enquiries (assessing, against the estate agency’s criteria, whether and how an enquiry proceeds, for example to a viewing or appointment). These decisions are surfaced to the agency for audit, but they are made automatically.

Where a decision about you is based solely on automated processing and produces legal or similarly significant effects, you have specific protections under UK GDPR Article 22. For such decisions:

• The automated qualification is carried out on behalf of the estate agency, which sets the criteria and is the controller of that decision; we act as the agency’s processor.
• The decision is made to take steps at your request to enter into, or carry out, a transaction with the agency (e.g., arranging a viewing), and/or on the basis of your explicit consent, as the agency relies upon.
• You have the right to obtain human review of the decision, to express your point of view, and to contest it. To do so, contact the agency, and a person able to change the outcome will review it.
• Meaningful information about the logic: enquiries are assessed against the agency’s stated qualification criteria; the main consequence is whether and how your enquiry proceeds (for example, whether a viewing is offered).

We do not use special-category data to make these decisions.

8. Requests From Public Authorities

When a government, law-enforcement, regulatory, or judicial body requests personal data, we follow our Government & Law-Enforcement Data Request Policy: we verify the legality of each request, challenge requests we believe are unlawful or overbroad, disclose only the minimum necessary, and document each request and our response. Where legally permitted, we will notify affected individuals.

9. Sharing and Processors

We do not sell identifiable personal data. We share personal data with:

• Service providers (processors) that help us run the platform, including: cloud hosting and infrastructure; database hosting; AI processing of conversation content to generate responses; and telephony/messaging. All are bound by data-processing agreements.
• Professional advisers (e.g., legal, accounting), under confidentiality.
• Public authorities, where required by law and handled per Requests from public authorities.

In a merger, acquisition, restructuring, or sale of assets, personal data may transfer to the successor entity, subject to this policy.

10. Retention

Operational data processed for an agency — kept as needed to provide the service and per the agency’s instructions and our agreement.

• Quality-assurance / improvement material and PII-redacted (beeped) data — these remain personal data; we keep them only as long as necessary for the purpose and honour erasure requests (see Your Rights).
• Fully anonymised data — no longer personal data; may be retained indefinitely.
• We keep records required for legal, tax, or security purposes for the periods the law requires.

11. International Transfers

Some processing may take place outside the UK/EEA. Where it does, we rely on appropriate safeguards such as the UK International Data Transfer Addendum / EU Standard Contractual Clauses.

12. Your Rights

Subject to law, you have the right to: access your data; correct it; erase it; restrict or object to processing; data portability; and to withdraw consent where we rely on it.

How to exercise your rights:

• Contact contact@genifea.com. We will verify your identity before acting.
• For data we process on behalf of an estate agency (operational data), the agency is the controller; you can raise your request with the agency or with us, and we will coordinate accordingly.
• For data we control — in particular the de-identified / PII-redacted material we hold to improve and train our products — you (the individual the data is about) can request erasure directly with us. We act on requests from the data subject; we do not action third-party requests to erase another person’s data from this material.
• Fully anonymised data cannot be linked back to you and therefore cannot be retrieved or erased on an individual basis.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, or your local supervisory authority.

13. Security

Data security: Your data is encrypted in transit and at rest. Access is protected by database-level access controls, and access to customer data is restricted to authorised personnel on a need-to-know basis.

Data Breaches: If a personal-data breach is likely to result in a risk to your rights, we will notify the ICO within 72 hours where required, and affected individuals where the risk is high.

Children: Our service is not directed at children, and we do not knowingly process children’s personal data. If you believe a child’s data has been provided, contact us and we will delete it.

14. Changes

We may update this policy. We will post the updated version here with a new effective date and, where changes are material, take reasonable steps to notify you.

15. Governing Law

This policy is governed by the laws of England and Wales.

16. Contact

Questions or requests: contact@genifea.com.