What happens to your information when you use this website or contact us.
We take privacy seriously and explain what happens to your information in plain English. This notice covers information we collect when you visit our website, contact us or receive communications from us. It also explains what Tally, our AI Operations Platform, does with a Google or Microsoft account you connect to it. Where we process information on behalf of a client, that client will normally be the data controller and DDX Consulting Ltd will act as its data processor under the relevant client agreement and Data Processing Agreement.
DDX Consulting Ltd is responsible for the personal information covered by this notice.
Company number: 17389201
Registered in England and Wales
Registered office: 47 Stockers Lane, Woking, England, GU22 9DB
Contact: info@ddx-consulting.com
We use Vercel Web Analytics to understand basic information such as how many people visit our website and which pages are viewed. We do not use this information to build advertising profiles or track you across other websites.
Our website may also load resources from third-party providers, such as externally hosted fonts. When these load, the provider may receive technical information such as your IP address.
If you complete our contact form, email us or arrange a conversation with us, we may collect your name, email address, company and role, information you provide about your business or enquiry, and our correspondence with you.
We use this information to respond to you, discuss our services and manage our relationship with you. Our lawful basis will normally be our legitimate interests in responding to and developing business enquiries, or taking steps at your request before entering into a contract.
If you choose to subscribe to DDX emails, we use your email address to send them to you. Where we rely on your consent, you can withdraw it at any time using the unsubscribe link in an email or by contacting us. We do not sell your personal information.
When DDX builds or operates workflows for a client, we may process information belonging to that client. In these circumstances, the client will normally determine why that information is being processed and DDX will process it on their instructions.
The precise arrangements, security requirements, retention periods and responsibilities are set out in the relevant client agreement.
Some workflows we build may use artificial intelligence services. Where client information is processed using AI, we use approved business API services rather than consumer AI accounts.
We currently work with providers including OpenAI, Anthropic and Google but offer client flexibility when building solutions. We do not use client data to train our own general-purpose AI models and configure the AI services we use so that client data is not used to train their general-purpose models where the relevant service permits and contractually supports this.
We minimise the information sent to an AI service to what is required for the relevant task. More information is available in our Responsible AI statement.
When you connect a Google or Microsoft account directly to Tally, Tally asks only for the permissions listed here. Each connection is made separately, when you start the feature that needs it, and Tally shows you what it will be able to do before you are sent to Google or Microsoft.
Tally stores the tokens for these connections itself, encrypted. An app that connects through our integration provider instead shows its own permissions when you connect it.
The text and file copies imported from Google Drive, OneDrive or SharePoint stay in your Company knowledge until they are removed. When you remove the source, disconnect, or leave the workspace, the notes and file copies you imported are deleted at once, including any edits made to the notes in Tally.
When you or an agent ask a question, matching extracts of your Company knowledge, including imported text, may be sent to the AI provider configured for your workspace to produce the answer, as described under Artificial intelligence above. We do not sell this data, we do not use it for advertising, and we do not use it to develop, improve or train generalised AI or machine-learning models. No one at DDX reads it unless you have asked us to and agreed (for example for support), or where this is needed for security or required by law.
Tally’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements, and to the Google Workspace API User Data and Developer Policy.
A workspace owner or admin can disconnect Gmail, Google Drive or Outlook in Tally under Settings, Connected systems. You can disconnect your own Company knowledge connection, or remove one source, under Company knowledge, Sources. Disconnecting deletes Tally’s copy of the token. For Google, it also asks Google to remove Tally’s access. You can also remove Tally’s access at any time at myaccount.google.com/permissions (Google) or myapps.microsoft.com (Microsoft).
The full privacy policy for Tally is at app.ddx-consulting.com/legal/privacy.
We use trusted technology providers to operate our website and services. Depending on the service being provided, these may include providers of website and application hosting, databases and cloud infrastructure, workflow automation, business integrations, sign-in providers, calendar and email services for connected mailboxes, transactional email, monitoring and security, and artificial intelligence services.
Our current providers, what each one does and where it processes data:
We require providers processing personal information for us to handle it appropriately and only for the relevant purpose.
Some of our technology providers may process information outside the United Kingdom, including in the United States. Where UK data protection law requires safeguards for an international transfer, we use an applicable lawful transfer mechanism, such as an adequacy regulation or recognised contractual safeguards.
You can contact us at info@ddx-consulting.com for further information about safeguards applying to your personal information.
We keep personal information only for as long as we reasonably need it for the purpose for which it was collected, including to meet legal, accounting, security and contractual requirements.
Enquiry information is retained while we are discussing potential work and afterwards where reasonably necessary to maintain appropriate business records. Marketing information is retained until you unsubscribe or we otherwise determine that it is no longer appropriate to retain it. Specific retention arrangements for client data are governed by the relevant client agreement and Data Processing Agreement.
We use technical and organisational safeguards appropriate to the information we handle. For the services we operate, these include measures such as encryption in transit and at rest, access controls, authentication, logging and separation of client workspaces.
No system can be guaranteed to be completely secure, but we take measures to protect the information entrusted to us.
Depending on the circumstances, UK data protection law may give you rights to:
Where processing is based on consent, you can withdraw that consent at any time. You also have the right to object to processing based on our legitimate interests.
To exercise your rights, contact info@ddx-consulting.com.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator.
We may update this notice as our services or legal obligations change. The latest version will always be available on our website.