OpenERP Solutions | Privacy-first technology, AI and CCTV services
Version: 1.0
Last updated: 29 October 2026
Your information is for your interaction, not an unrelated purpose. We collect and use personal information to answer your enquiry, provide the services you request, secure those services and meet applicable legal duties. We do not sell your personal information or use your identifiable messages, recordings or footage to train our own general-purpose AI models. Where a third-party service is proposed, we explain what it will do and offer more private arrangements where feasible.
1. Who we are
OpenERP Solutions is the name used for this website and the services described here.
Contact for privacy requests or complaints: [email protected].
For enquiries made directly to us, our website operations and our own business administration, we generally determine why and how personal data is processed and therefore act as a controller. Where a client instructs us to process its customer, employee, caller or CCTV data as part of a contracted service, we generally act as its processor. In those cases, that client is usually the controller and should publish its own privacy information; we support it in meeting its obligations. Specific roles are documented in the service agreement.
2. Information we may receive
Depending on how you interact with us, information may include:
- Enquiries and accounts: name, business name, contact details, correspondence and project requirements.
- Website and technical information: IP address, browser/device information, necessary security and diagnostic logs and preferences relevant to the service.
- Service information: content submitted to an AI assistant or chatbot, support requests, documents, transcription text, calls, recordings, images or footage where a specific service has been configured to collect them.
- AI-assisted outputs: summaries, suggested responses, object detections and event alerts related to an agreed interaction.
- Commercial records: quotations, contracts, invoices and payment-status records; payment card details, if any, should be handled by an appropriately contracted payment provider rather than stored unnecessarily by us.
We do not seek sensitive personal information unless it is necessary for a properly assessed and authorised service. Please avoid submitting unnecessary personal or sensitive information in open enquiry forms.
3. Why we use information and our lawful bases
We use information only for defined purposes, with a lawful basis assessed for each relevant activity:
| Purpose | Typical lawful basis (where we act as controller) |
|---|---|
| Respond to enquiries and discuss a proposed service | Legitimate interests in answering relevant business enquiries, or steps requested before a contract where applicable |
| Deliver an agreed service to an individual customer | Performance of a contract, where necessary |
| Business administration, security, troubleshooting and fraud prevention | Legitimate interests, subject to appropriate balancing and safeguards; or legal obligation where applicable |
| Accounting, tax and statutory compliance | Legal obligation |
| Optional marketing | Consent where required by electronic marketing law, or another lawful basis only where permitted and explained |
Where we act solely as a processor, the customer's documented instructions and its chosen lawful basis govern the underlying service data. The existence of a contract with a business client is not, by itself, a lawful basis for monitoring every person filmed or recorded by that business. Consent is requested separately when required; accepting terms or submitting an enquiry does not automatically mean agreement to marketing or optional tracking.
4. What happens when AI services are used
Before a production service processes identifiable information through an external AI or communications provider, we will make the relevant customer aware of the provider, what it does, the information transmitted, its processing location and available controls, including any material retention or training settings.
For example, ElevenLabs may be proposed for a voice-enabled assistant. In that case, audio, text or related service content may be processed by that provider in accordance with the agreed business configuration and contractual documents. It is an example of a possible supplier, not a statement that every service uses ElevenLabs. We review the terms applicable to the particular service; a general supplier website privacy policy is not a substitute for an appropriate data processing agreement.
Where feasible, customers may select local-device, on-premises or private-cloud options designed to reduce external processing. We will identify any unavoidable third-party dependencies, hosting connections or remote support arrangements rather than describing a solution as fully offline when it is not.
6. CCTV, recordings and monitoring
For client-operated CCTV AI, the client normally decides where cameras are installed, why footage is collected, which alerts are enabled, who may see recordings and how long information is retained. The client must provide appropriate signs and privacy information and assess the lawfulness and proportionality of monitoring, particularly for staff, public areas or children.
Our systems may help recognise objects or conditions and generate prompts for a human to review. An AI alert is not proof that misconduct occurred. Any consequential decisions require appropriate independent assessment. Audio capture, biometric identification and similarly intrusive features should not be assumed to be enabled and need separate assessment, authorisation and clear notices where applicable.
7. Retention and deletion
We keep information only as long as necessary for the stated purposes or applicable legal requirements. Enquiry records, system logs and financial records may have different justified retention schedules. For client footage, call recordings, transcripts and AI event logs, retention is configured in the agreed service schedule or DPA, including backup and deletion arrangements.
8. Where information is processed
Depending on the selected service, data may stay on the customer's own hardware, be hosted in a specified private environment or be processed by external suppliers. We will tell customers about material locations and restricted international transfers. Where UK data protection law requires a transfer mechanism and risk assessment, we will use an applicable legal mechanism and appropriate safeguards. We do not represent every possible provider or configuration as UK-only.
9. Security
We apply proportionate controls intended to preserve confidentiality, integrity and availability, including least-privilege access, appropriately secured connections, suitable encryption, logging where needed and procedures for responding to incidents. Access to identifiable information is restricted to those with an authorised service or support need. No system can be promised to be entirely risk-free.
10. Your data protection rights
Depending on the circumstances and legal exceptions, you may have rights to be informed, access your personal information, correct it, request erasure or restriction, object to processing, receive certain data in a portable format and challenge qualifying solely automated decisions. Where consent is our lawful basis, you can withdraw it without affecting earlier lawful processing.
Contact [email protected] to exercise your rights or raise a privacy concern. We may need to verify identity. If your request concerns footage or a call controlled by one of our clients, we may direct it to that organisation and assist as their processor.
11. Complaints
You can complain to us using the contact above. We will operate a process for data-protection complaints, acknowledge complaints within the period required by law, investigate appropriately and explain the outcome. You also have the right to complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/.
13. Children and sensitive settings
Services intended for, or likely to capture, children or other vulnerable individuals require additional safeguarding and data-protection assessment. We will discuss appropriate controls, minimisation, human oversight and any enhanced contractual requirements before deployment. General website enquiries are intended primarily for adults acting for themselves or organisations.
14. Changes to this notice
We may update this notice to reflect genuine changes in our processing, technology or the law. The current version and date will be displayed here; material changes will be communicated where required. This notice should be read alongside the Terms and Conditions and any service-specific privacy information provided by the relevant customer/controller.