This policy explains how CallbackPilot handles personal information when you visit our website, enquire about or use our services, administer an account, or communicate through a service operated for one of our customers.
1. Who we are
CallbackPilot is a trading name of P&EWEALTH LTD, a company registered in Scotland under company number SC770238. Our registered office is Squirrel Barn, Coultra Steadings, Newport On Tay, DD6 8SE, United Kingdom.
Contact us at [email protected].
2. Our data-protection roles
CallbackPilot is the controller of personal information relating to our website visitors, prospects, customers and account users. This means we decide why and how that information is used.
For callers and SMS conversations processed through CallbackPilot on behalf of a customer business, that customer is normally the controller and CallbackPilot acts as its processor. The customer determines the purpose of that processing and is responsible for its own privacy notices and instructions to us.
3. Information we collect
Depending on how you interact with us, we may collect:
- Names, business details, email addresses and telephone numbers.
- Onboarding responses, account information and user-access details.
- Billing, payment-status and subscription records.
- Call metadata, missed-call events, SMS content and lead-pipeline activity.
- Technical, security and audit logs.
- Website usage information, device data and cookie choices.
4. Sources of information
We receive information directly from you, generate it through use of the service, receive it from client businesses that use CallbackPilot, and receive it from contracted service providers supporting telecommunications, payments, hosting, security and related functions.
5. How and why we use information
We use personal information only where we have a lawful basis. Our main purposes and bases are:
- Contract: supplying and administering the service, creating accounts, processing payments, completing onboarding, and providing missed-call, SMS, inbox, pipeline and notification functionality.
- Legal obligation: meeting accounting, tax, regulatory, telecommunications, identity-verification and other legal requirements.
- Legitimate interests: securing the service, preventing fraud and misuse, supporting customers, maintaining records, and improving service reliability and features where those interests are not overridden by individual rights.
- Consent: optional marketing and non-essential analytics or marketing cookies, where consent is required. Consent may be withdrawn at any time.
6. Sharing information
We may share information only as necessary with:
- HighLevel and LeadConnector, which provide core account, messaging, pipeline and workflow technology.
- Telecommunications providers, including Twilio where applicable.
- Stripe and other payment-processing services used for subscriptions and billing.
- Hosting, infrastructure, monitoring, fraud-prevention and security providers.
- Professional advisers such as accountants, insurers and legal advisers.
- Regulators, courts, law-enforcement bodies and public authorities where disclosure is legally required.
We do not sell personal information.
7. International transfers
Some service providers may process information outside the United Kingdom. Where required, we use appropriate UK safeguards, including UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to approved standard contractual clauses, together with supplementary security measures where appropriate.
8. Retention
We retain information only for as long as necessary for the purposes described in this policy, including legal, contractual, security and dispute-resolution needs. Contractual, billing and financial records may be retained for up to six years. Client caller and SMS data is retained according to the client's documented instructions, service settings and applicable law, and may be deleted or returned when the relevant service relationship ends.
9. Security
We use proportionate technical and organisational measures intended to protect personal information against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures include controlled account access, authentication, system monitoring, provider due diligence and appropriate transmission and storage safeguards. No internet service can guarantee absolute security.
10. Your rights
Subject to applicable UK data-protection law, you may have rights to request access, correction, erasure, restriction of processing, objection to processing and data portability. Where processing relies on consent, you may withdraw that consent at any time without affecting earlier lawful processing.
Contact [email protected] to exercise a right. We may need to verify your identity. If your request concerns data handled for a CallbackPilot customer, we may refer the request to that customer as controller.
11. Complaints
Please contact us first so we can try to resolve your concern. You may also complain to the UK Information Commissioner's Office. Guidance is available at ico.org.uk/make-a-complaint/.
12. Cookies
Necessary cookies may operate automatically because they are required for security, navigation, authentication or essential service functions. Optional analytics or marketing cookies require consent where applicable and will not be used unless that consent has been given. You can change or withdraw optional-cookie consent through the controls made available on the relevant site.
13. Children
CallbackPilot is a business service intended for use by businesses and authorised business users. It is not directed at children, and we do not knowingly seek to collect children's personal information.
14. Policy updates
We may update this policy to reflect changes to the service, providers, law or our data-handling practices. The revised version will show a new last-updated date. Where a change is material, we will provide an appropriate notice.