Data protection
Practical safeguards, human escalation and responsibilities for website enquiries and managed client workflows.
Responsibilities
CFLH LTD controls website enquiry information. For client workflows, roles, purposes, suppliers and documented processing instructions are agreed before launch. A written data-processing agreement is required where we act as processor.
Access and transmission
Private enquiry endpoints require authenticated operator access. Secrets stay server-side. The website uses HTTPS in production, signed HttpOnly session cookies, input validation, CSRF checks and short-term database-backed abuse controls. Public pages do not expose submissions, caller details or transcripts. Contact our privacy contact for details of relevant supplier arrangements; we do not claim a particular storage location, encryption-at-rest certification or backup arrangement.
Minimisation and human escalation
We ask only for the administrative details needed for the agreed purpose. Clinical advice, suitability, negotiation, pricing approval and commitments stay with the business’s qualified team. Appointment requests are not described as confirmed bookings without a successful calendar response. Failed notifications do not delete accepted enquiries.
Retention and deletion
Age-based website cleanup runs on new submissions; authorised operators can run it separately and delete individual records. The thresholds are 12 months for unconverted enquiries, 24 hours for abuse-control records and 30 days for local Alice records. No verified daily schedule is claimed. Google Calendar events and statutory records are handled separately, as explained in the privacy notice.
Suppliers, incidents and sensitive workflows
Our privacy contact handles security concerns and rights requests. Relevant suppliers include Replit, configured email delivery, Twilio, Retell and Google Calendar, with Google Analytics and Meta only as described in Cookie settings. We assess whether a data protection impact assessment is required before sensitive-data or high-risk workflows. Public forms and Alice must not collect health histories. We do not claim GDPR certification or guaranteed legal compliance.
Questions and complaints
Email MarginMultiplier’s privacy contact at hello@marginmultiplier.io to raise a security concern, exercise your rights or complain about data use. We acknowledge data-protection complaints within 30 days and respond without undue delay. The privacy notice explains the ICO complaint route.
Questions
For questions about this information or a privacy request, contact hello@marginmultiplier.io.