Privacy Policy

1. Who We Are

SAM AI Solutions Ltd (“SAM AI Solutions”, “we”, “us”, “our”) is a digital transformation and artificial intelligence consultancy registered in England and Wales. Our registered address is:

We are registered with the Information Commissioner's Office (ICO) under the Data Protection Act 2018. This policy applies to our website at samaisolutions.co.uk and all services we provide.

2. What Data We Collect

We collect the following categories of personal data:

• Contact information: name, email address, phone number, company name, provided when you complete our contact or consultation forms.
• Communication data: emails, messages, and call notes relating to our business relationship.
• Technical data: IP address (anonymised), browser type, operating system, referring URL, pages visited, time on site, collected via Google Analytics 4.
• Usage data: how you interact with our website, which services you view, and which calls-to-action you click.
• Marketing data: your preferences for receiving marketing communications and your responses to our campaigns.
• Cookie data: your cookie consent preferences, see Section 8 for full cookie details.

We do not collect special category data (e.g., health, racial origin, political opinions) through our website.

3. How We Use Your Data

We use your personal data to:

• Respond to enquiries and provide quotations for our services.
• Deliver services contracted with you or your organisation.
• Send marketing communications where you have given consent or where we have a legitimate interest (B2B).
• Analyse website performance to improve our content and user experience.
• Comply with legal obligations and protect our legitimate business interests.
• Prevent fraud and ensure the security of our systems.

4. Legal Basis for Processing

5. Data Retention

We retain personal data only as long as necessary for the purposes described above:

• Enquiry / lead data: 2 years from last contact, unless a contract is formed.
• Client / contract data: 7 years from contract end (Companies Act / HMRC requirements).
• Analytics data: 14 months (Google Analytics 4 default, anonymised).
• Cookie consent records: 1 year.
• Marketing opt-out records: indefinitely (to honour your preference).

6. Your Rights Under UK GDPR

Under Articles 13–22 of the UK GDPR, you have the following rights:

• Right to access, obtain a copy of the personal data we hold about you.
• Right to rectification, correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”), request deletion of your data where there is no legal basis to retain it.
• Right to restrict processing, limit how we use your data in certain circumstances.
• Right to data portability, receive your data in a structured, machine-readable format.
• Right to object, object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making, we do not use fully automated decision-making that produces legal effects.

To exercise any of these rights, contact us at sales@samaisolutions.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint.

7. Cookies

We use cookies and similar technologies in accordance with the Privacy and Electronic Communications Regulations (PECR). When you first visit our website, you will be presented with our cookie consent banner. You can update your preferences at any time via our Manage Cookie Preferences page. For a full list of cookies, including their names, providers, and durations, please visit that page.

8. Third-Party Services

We use the following third-party services that may process your data:

• Google Analytics 4 (Google LLC), website analytics. Data anonymised. Google Privacy Policy.
• Google Ads (Google LLC), advertising and conversion tracking.
• Meta Pixel (Meta Platforms Inc.), remarketing. Meta Privacy Policy.
• LinkedIn Insight Tag (LinkedIn Corp.), B2B remarketing and analytics.
• Tawk.to, live chat (when consent given). Tawk.to Privacy Policy.

We ensure all third-party processors have adequate data protection safeguards in place via Data Processing Agreements (DPAs) and/or Standard Contractual Clauses (SCCs).

9. International Data Transfers

Some of our third-party service providers operate outside the UK and the European Economic Area (EEA). Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including the ICO International Data Transfer Agreement (IDTA), UK-approved Standard Contractual Clauses, or adequacy decisions. The primary transfer is to the United States via Google LLC, which participates in the UK-US Data Bridge.

10. Contact Our Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:

We will respond to all requests within 30 calendar days. If we need more time (up to 90 days for complex requests), we will notify you within the initial 30-day period.