What we do with data, in plain English.
This covers two different things people often confuse: the data we collect about you when you visit this site or enquire, and the data we process on behalf of our clients when we build an automation for them. Last updated 4 September 2026.
The data controller
W2 Systems is a trading name of The W2 Collective. We are the data controller for personal data collected through this website and through enquiries made to us.
- Email enquiries@thew2collective.co.uk
- WhatsApp and phone +44 7367 422209
- Where we operate Madeira, Portugal and London, United Kingdom
If you want to reach us specifically about data protection, use the email above and put "data protection" in the subject line. We aim to answer within five working days and are required to answer formal requests within one month.
What we collect when you visit or enquire
- The enquiry formName, business name, business type, the contact details you give us, your preferred call time and what you tell us about your business.We use this only to reply to you and to prepare for the call you asked for. The lawful basis is legitimate interest, specifically responding to a business enquiry you initiated. Form submissions are handled by Netlify, our hosting provider, and reach us by email. We keep enquiries for two years from your last contact with us, then delete them. We do not add you to a mailing list and we do not run a follow-up sequence.
- WhatsApp and emailWhatever you choose to send us, plus your phone number or email address.WhatsApp messages sit in WhatsApp and are subject to Meta's own privacy terms. Email sits in our mailbox. We keep business correspondence for as long as we have a relationship with you and for six years afterwards where it relates to a contract, which is the ordinary period for business records.
- The interactive demo on our pagesWhat you type into the demo is sent to Anthropic's API to generate a reply, and is not stored by us.The demo exists so you can see how a workflow answers. Please do not type real customer data into it. Messages are sent to Anthropic for processing under their commercial API terms, which do not permit training on that content, and we keep no record of them. A short-lived rate-limit counter holds your IP address in memory for ten minutes to stop abuse, and is not written to disk.
- Analytics and cookiesThis site sets no tracking cookies and runs no third-party analytics or advertising scripts.We load two things from outside our own server: fonts from Google Fonts, and an animation library from a content delivery network. Your browser's request to those services will include your IP address, as it does for any web request. There is no cookie banner because there is nothing to consent to. If we ever add analytics, this page will change first.
Where we are a processor, not a controller
When we build an automation for a business, that business remains the controller of its customers' data. We act as a processor, under a written agreement, and only on their instructions.
- Everything runs on the client's own accounts. Their messages stay in their inbox, their calls in their phone system, their bookings in their diary. We do not build a second copy of their customer database.
- We hold access tokens, not passwords. Connections are authorised on each provider's own login screen and can be revoked by the client at any time from their account settings.
- We can see workflow logs while a client is on our Run plan, so we can diagnose faults. Those logs record what a workflow decided and why, and are retained for 90 days.
- Sub-processors. Depending on the build, these may include Anthropic, ElevenLabs, Twilio, n8n, Google, Microsoft and Meta. Every client gets a written list of exactly which services touch their data before anything goes live.
- No training. We use commercial API access that does not permit the provider to train on customer content, and we never use client data to train or improve anything of our own.
And how to use them
Under UK GDPR and the EU GDPR you can ask us to give you a copy of your personal data, correct it, delete it, restrict what we do with it, or object to our processing. You can also ask for it in a portable format.
Ask by email and we will not charge you or make it difficult. If we cannot do what you have asked, we will tell you why.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office in the UK, at ico.org.uk, or to the Comissão Nacional de Proteção de Dados in Portugal, at cnpd.pt. We would rather you came to us first, but you do not have to.
- International transfersSome of our sub-processors are based outside the UK and EU.Where data is transferred outside the UK or European Economic Area, it is done under the safeguards those providers maintain, typically standard contractual clauses and, for US providers, the relevant adequacy framework. Client agreements name which providers apply to that build.
- Automated decision-makingOur workflows draft and send replies, but they do not make decisions with legal or similarly significant effects about anyone.A workflow can book an appointment or answer a question from a client's own data. Anything involving money beyond a published price list, any complaint, and anything the system is not confident about is passed to a person. Callers are told they are speaking to an AI assistant when they ask, and are transferred to a person on request.
- Changes to this policyWe will change the date at the top and, for anything material, tell existing clients directly.We will not quietly widen what we do with data. If we start using analytics, add a sub-processor that affects existing builds, or change retention periods, this page changes first and clients are told.
This policy describes our actual practice in plain language. It is not legal advice, and a business relying on us as a processor should read the data processing agreement that comes with its build rather than this page.
Next stepTwenty minutes on the phone. Then a straight answer.
Tell us what you keep doing by hand. We'll tell you which workflow pays back first, what it costs, and whether it's worth doing at all. If it isn't, we say so.