Privacy Policy

2. Data Controller Details

Under the UK GDPR, Frontier Systems acts as the Data Controller for personal data collected directly through our public website, marketing inquiries, and client account administration.

Note: When we build bespoke systems, host client databases, or implement workflows where the client provides their own end-user data, Frontier Systems typically acts as a Data Processor under a separate, binding Data Processing Agreement (DPA) executed with the client.

3. Personal Data We Collect

We only collect data that is strictly necessary for fulfilling our contractual commitments, answering inquiries, and maintaining cyber defence standards:

4. AI & Automation Data Processing

• No Public Model Training: We do not submit client confidential data, proprietary code, business logic, or customer records to public machine learning models for training or reinforcement.
• Zero-Retention Enterprise APIs: Where third-party AI APIs (e.g., Anthropic Claude, OpenAI Enterprise, AWS Bedrock) are incorporated into client architectures, they are configured under enterprise agreements featuring explicit zero-data-retention and non-training clauses.
• Human-in-the-Loop Safeguards: Autonomous agents and automation pipelines designed by Frontier Systems enforce deterministic fallback logic, audit logging, and administrative oversight to prevent unmonitored decision-making.

5. Lawful Bases for Processing (UK GDPR Art. 6)

We process your personal information only when there is a valid lawful basis under UK law:

6. How We Use Your Data

We use the data collected strictly for legitimate operational purposes:

• To negotiate, execute, and deliver client software development contracts;
• To provide ongoing support, bug remediation, and infrastructure maintenance;
• To invoice for professional services rendered and maintain corporate accounts;
• To detect, prevent, and mitigate cyber security threats and malicious traffic;
• To comply with statutory legal and regulatory obligations in the United Kingdom.

7. Sharing & Third-Party Processors

We never sell, rent, or trade your personal data. We only share data with vetted sub-processors that maintain ISO 27001, SOC 2, or UK GDPR-compliant data processing agreements:

• Hosting & CDN Providers: Vercel Inc., Amazon Web Services (AWS), and Cloudflare for edge routing, security headers, and website availability.
• Communication & Productivity: Google Workspace / Microsoft 365 for secure corporate communications under UK/EU data residency guarantees.
• Statutory Authorities: UK law enforcement or regulatory bodies (such as HMRC) where required by a binding legal court order.

8. International Data Transfers

As a UK company, our primary processing occurs within the United Kingdom and the European Economic Area (EEA). Where technical infrastructure requires transfer to jurisdictions outside the UK, we ensure appropriate safeguards are implemented in compliance with Chapter V of the UK GDPR, such as:

• UK International Data Transfer Agreements (IDTA);
• The UK Addendum to EU Standard Contractual Clauses (SCCs); or
• Countries covered by UK adequacy regulations.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• General Inquiries: Retained for 12 months following last contact unless a commercial project contract ensues.
• Client Contract & Project Deliverables: Retained for 6 years following project completion in accordance with the UK Limitation Act 1980.
• Statutory Financial Records: Retained for 6 years plus the current financial year to satisfy UK HMRC corporate tax requirements.

10. Your UK GDPR Rights

Under UK data protection law, you possess significant rights regarding your personal information:

To exercise any of these rights, email us at hello@frontiersystems.co. We respond to verified requests within one calendar month, free of charge.

11. Technical & Organisational Security

We implement industry-grade technical safeguards to prevent accidental loss, unauthorised access, alteration, or disclosure of data:

• End-to-end encryption in transit via modern TLS 1.3 protocols;
• Encryption at rest using AES-256 for all databases and project repositories;
• Strict role-based access control (RBAC) and mandatory multi-factor authentication (MFA);
• Continuous dependency auditing and automated vulnerability monitoring.

12. Contact Us & ICO Complaints

If you have questions, concerns, or requests regarding this Privacy Policy, please reach out directly to our privacy officer: