Graxio is a trading name of Velryn Ltd, a company registered in England and Wales. We are registered with the Information Commissioner's Office (ICO) under number ZC131569. This policy explains how Graxio collects, uses, and protects personal data in connection with our website and services.
We provide AI-powered customer experience and voice agent services to business clients. In doing so, we may process personal data relating to our clients' customers as a data processor on their behalf, and personal data relating to business contacts and prospective clients as a data controller in our own right. This policy applies to graxio.co.uk, graxiocx.com, and any related communications.
Graxio operates in two distinct data protection roles depending on context:
This distinction is important. Graxio does not determine the purposes for which a client's customer data is used — that responsibility rests with the client organisation.
When you contact us via our website or by email, we collect your name, job title, company name, email address, and telephone number. We use this to respond to your enquiry and assess whether our services are appropriate for your organisation.
We may hold professional contact details for individuals at organisations we believe may benefit from our services. This is limited to name, job title, company, and business email address sourced from professional networks, public directories, or referrals.
We collect contact and billing information for client organisations necessary to manage the service relationship, including names of authorised contacts, email addresses, and invoicing details.
Call recordings and transcripts may be retained temporarily for quality assurance and dispute resolution purposes, as specified in the client's Data Processing Agreement. Retention periods are agreed with each client and may not exceed the periods set out in the DPA.
We use Cloudflare to host and secure our website. Cloudflare may process basic technical data including IP addresses as part of its standard security and performance functions. We do not use advertising trackers or third-party analytics platforms.
| Purpose | Legal Basis | Detail |
|---|---|---|
| Responding to enquiries | Legitimate interests | We have a legitimate interest in responding to inbound business enquiries. |
| B2B outreach to prospects | Legitimate interests | We have a legitimate interest in contacting relevant businesses about our services. Recipients can opt out at any time. |
| Managing client accounts | Contract performance | Processing is necessary to fulfil our contractual obligations. |
| Operating voice agents on behalf of clients | Processor — client's legal basis applies | Graxio acts on the client's instructions under a Data Processing Agreement. The client is responsible for their legal basis. |
| Legal and compliance obligations | Legal obligation | Where we are required to retain records by law or regulation. |
| Category | Retention Period |
|---|---|
| Enquiry and prospect contact data | Up to 24 months from last contact. Removed immediately on request. |
| Client account and contact data | Duration of engagement plus 6 years, in line with standard contract limitation periods. |
| Call recordings and transcripts (processor role) | As specified in the relevant client Data Processing Agreement. |
| Financial and invoicing records | 7 years, as required by HMRC. |
| Email correspondence | Up to 3 years from last contact unless forming part of a client record. |
Graxio does not sell personal data. We do not share personal data with third parties for marketing purposes. We may share data with the following categories of processor where necessary to operate our services:
All processors are required to handle data in accordance with UK GDPR. We do not transfer personal data to countries outside the UK or EEA without appropriate safeguards in place. Where transfers occur, they are covered by adequacy decisions or standard contractual clauses.
Under UK GDPR, you have the following rights in relation to your personal data:
To exercise any of these rights, contact us at hello@graxio.co.uk. We will respond within one calendar month.
If your enquiry relates to data processed by Graxio on behalf of a client organisation (for example, a call you received from a business using our voice agent service), you should contact that organisation directly as the data controller. We will assist the client in responding to your request as required.
If you have received a business development communication from Graxio and do not wish to receive further contact, reply with the word 'unsubscribe' or email hello@graxio.co.uk. We will remove your details immediately and record your preference.
This website uses only essential cookies necessary for security and performance, set by Cloudflare as part of its hosting and security functions. We do not use advertising cookies, tracking cookies, or analytics platforms. Essential cookies do not require your consent under UK PECR. You may adjust your browser settings to refuse cookies, though this may affect website functionality.
If you have a concern about how we handle your personal data, please contact us in the first instance at hello@graxio.co.uk. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office:
Graxio reviews this policy periodically. Material changes will be noted on our website with an updated effective date. This policy was last reviewed in May 2026.
Graxio is a trading name of Velryn Ltd, registered in England and Wales. ICO Registration ZC131569.