General privacy notice

Who we are

Correla understands the importance of protecting personal information and is committed to complying with the UK GDPR, UK Data Protection Act (DPA 2018) and any other data protection legislation applicable to the processing of personal data.

This notice applies to personal data processed in relation to the aireo.app website (“our site”). Our site is operated by Correla Limited. We are registered in England and Wales under company number 13062055 and have our registered office at Lansdowne Gate, 65 New Road, Solihull, England, B91 3DL. Correla Limited is the controller and responsible for your personal data (collectively referred to as "Correla", "we", "us" or "our" in this privacy notice).

This website is not intended for children, and we do not knowingly collect data relating to children.

The personal information we collect and use

In order to provide our services to you, we collect, use and are responsible for processing personal data to deliver those services. We collect that either directly from you or from third parties. Regardless of the source of data, Correla are committed to protecting your personal data and to ensuring that your personal information is used properly, lawfully and transparently. For more information on lawful basis, find guidance here.

How you interact with our services will determine the personal data we process about you. The table below details the purposes we may process your personal data for, the types of data collected and processed, and the lawful basis we rely on to do so.

Purpose / Use	Type of Data	Lawful Basis
To manage your subscription, billing and payments if you create an aireo.app account.	Your name, email address, telephone number, profile photo, company name, job title, team membership roles and invitations, payment data including Stripe customer and subscription IDs and status (card details are processed by Stripe).	Performance of a contract.
We record calls for training, quality, and analysis purposes to improve our products and services.	Your name, telephone number, email address (used to verify your identity), and any information discussed during the call.	Legitimate Interests - we process your data because we have a legitimate interest in doing so.
To respond to your queries and book demos via your requested contact method (email, telephone, SMS, Whatsapp).	Your name, email address, telephone number, and details you share with us regarding your query or request.	Legitimate Interests - we process your data because we have a legitimate interest in doing so.
To contact you about our products and services for marketing purposes, by email, SMS, telephone or Whatsapp (depending on your preferences).	Your name, company name, email address, telephone number, job title Your marketing preferences	Consent, or Legitimate interests (where permitted to do so by law). You can opt out at any time - see also the 'Marketing' section below.
To administer our website and improve user experience and the service we offer to our customers, we analyse user behavior on our website. This includes troubleshooting issues, monitoring for fraud or security threats and data analysis.	Technical and usage data about how you use our website IP address Name and email address	Legitimate interests – we process your data because we have a legitimate interest in doing so. Unless the law requires your consent to deploy cookies or tracking technology (see also our Cookie Policy).
We may use publicly available data sources to validate the accuracy of the business contact details we hold and obtain new contact details for service/ marketing purposes (where permitted to do so by law).	Your name, company name, company information, job title, email address, telephone number.	Legitimate interests - we process your data because we have a legitimate interest in doing so.
To comply with legal or regulatory obligations, and to establish or defend legal claims (including enforcing our terms).	Your name, email address, telephone number Other information relevant to the specific obligation or claim (e.g., details of your request, communications, or use of our service)	Legal obligation (where processing is required by law); Legitimate interests (e.g., to enforce terms or defend claims).
To deliver and improve the Aireo service and help you maximise the value you receive from the platform, we may contact you with service communications for customer service or relationship management purposes, by email, telephone, SMS or Whatsapp. For example: Onboarding and training Customer support and troubleshooting Customer success activities Product updates, feature enhancements and functionality available to you within your subscription	Your name, email address, telephone number.	Legitimate interests - we process your data because we have a legitimate interest in doing so.
We may contact you with service communications for administrative purposes that are necessary to meet contractual obligations, for example service outage notifications or changes to terms and conditions, by email, in-app or SMS.	Your name, email address, telephone number.	Performance of a contract.
To carry out market research and gather user experience feedback, to help us improve our products and services and include anonymous testimonials within our promotional materials. We may contact you by email, SMS, WhatsApp, telephone, or in-app for this purpose.	Depending on the type of survey, we may collect your: name, email address, telephone number, responses to the questions, IP address.	Legitimate interests - we process your data because we have a legitimate interest in doing so.
To use your identifiable testimonials within our promotional materials.	Your name, company name, job title and testimonial.	Consent - we'll only publish details that identify you, if you provide us with your consent to do so (you can withdraw your consent at any time).
If you're an Aireo customer and join our WhatsApp Community Group: To provide a forum for you to ask questions about our products and services and share your experiences with other product users To tell you about new products features and updates, share tips and tutorials To keep you updated with industry news and community events To provide promotional updates such as shoutouts and rewards	Your name, telephone number, profile picture (if you have one). This information and anything you post within the group may be visible to other community group members (depending on your personal phone/ WhatsApp privacy settings).	Consent - to become a member of a Correla WhatsApp Community Group. (You can choose which sub-groups you join and leave the community group at any time).

Sharing your data

Circumstance and provision of service sometimes require the sharing of your data with law enforcement, other data processors such as suppliers of technology, or other data controllers to provide you with a service you've requested. We only do this under strict protocols and where we have the correct and sufficient mechanisms and controls in place.

We may share your data with:

Cookie control provider - we use an industry leading supplier to provide you with a compliant cookie control which enables you to manage your cookie preferences
When you purchase a subscription, we use a third-party payment provider Stripe to facilitate card payments on our behalf. We may receive billing information such as your Stripe customer and subscription IDs but all card details are handled by Stripe
IT support and infrastructure providers - who support us with the technology to run our business
CRM and communication platform providers - providing technology to support us manage customer relationships
Survey agencies - in the provision and aggregation of survey results
Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy

Marketing

Depending on your preferences you may receive marketing communications by email, SMS, telephone and WhatsApp about Correla's products and services, if you have provided your consent, or have not opted out of receiving marketing communications from us (where permitted to do so by law).

Opting out of Marketing

You can ask us to stop sending you marketing communications at any time by following the unsubscribe links or instructions within any marketing communication sent to you or by contacting us at box.correla.privacy@correla.com or via the preference centre. If you opt out of receiving marketing communications, you will still receive service-related communications for administrative or customer service purposes.

If you join our Whatsapp Community, you may receive marketing communications via the WhatsApp announcement group, or any sub-groups you join. You can choose which sub-groups to be part of, mute notifications (within the WhatsApp app) or leave the WhatsApp Community Group at any time.

How long do we keep your information?

We will keep your personal information only as long as is necessary to achieve the processing purposes, or to meet legislative requirements. Personal information will be securely destroyed or put beyond use when it is no longer required, in accordance with our data retention and information management policy.

International Data Transfers

Providers of certain technologies or services may operate from different countries. We operate a UK/Adequate country first policy when undertaking or considering the transfer of your personal data outside of the UK.

Where we transfer data outside the UK we rely on the following:

UK GDPR Adequacy decisions: Under the regulation, a number of countries have been deemed adequate in their data protection laws and mechanisms, meaning they have an equivalent level of protection as the UK. For example, the EU has adequate protection
International Data Transfer Agreements (IDTAs). Where data is to be shared beyond an adequate country, Correla ensures that an IDTA is in place with that supplier, meaning an adequate contractual measure is in place to protect your data

Your Rights

The UK GDPR facilitates a number of rights for you to access, rectify and delete your data. Your rights are:

Right to be Informed: You have the right to ask us how and why we are processing your personal data. If we have provided this to you in the form of this privacy notice, we will inform you. Where processing has not been identified in this notice, we will provide you with details of what data we are processing, why we are processing it, where we are processing it, and how it is being processed.
Right to Access: You have a right to access and have a copy of your information provided to you.
Right to Rectification: You have the right to have your data updated where inaccuracies have occurred and for that data to be completed, where it remains incomplete.
Right to erasure (Also known as the Right to be Forgotten): You have a right for your data to be deleted, but only if you meet a particular element of the following criteria:
1. We don't need the data anymore to provide the service or product
2. You have withdrawn your consent for us to process that data
3. If you have objected to the use of your data and we can no longer justify the reason for processing your data
4. You have objected to direct marketing we undertake
5. There is a legal obligation which requires us to erase the data
6. It is found that we have processed the data unlawfully
7. You wish us to erase the data based on it being processed
Right to restrict processing: You have the right to restrict us from processing your data if:
1. You don't believe the data we are processing about you is accurate
2. The data we are processing has been obtained without a lawful basis, and you wish to restrict the processing rather than delete it
3. You wish us to retain the data when it is no longer needed by us to provide the service, in support of a legal claim
4. Where you have objected to the processing of your data and we are in the process of considering the legitimate interest we have in processing it
Right to data portability: Where you have provided data to us and Correla is the Data Controller, you have the right to be provided with your data in a format that enables you to transfer that data to another provider.
Right to object to processing: You have the right to object to our processing of your personal data where:
1. We are directly marketing to you - this is an absolute right
2. Where we are processing under legitimate interest. This is not an absolute right, and we may continue to process your data if our legitimate interest is compelling for the continuation of processing
3. We are processing the data under the lawful basis of 'Public Task'
Rights relating to automated decision making and profiling: Where we undertake automated decision making as part of our services or products (in which your personal data is or can be processed) you can request:
1. Information on those automated decisions and profiling outputs
2. Human intervention where you are challenging a decision presented by the automated process
3. Information on the regularity of the checks we carry out to ensure the systems generating those decisions are working as intended

Exercise Your Rights

To exercise any of the rights above, please email the Correla privacy team stating:

The right(s) you wish to exercise
Any specifics relating to the data that may help us identify and implement your request.

The email for the Correla Privacy team is: box.correla.privacy@correla.com

We reserve the right to request identification from you to verify your request and to ensure accuracy and security of any data provided under the exercising of your rights.

You can also exercise any of the rights above by writing to us. Please mark your letter: 'FAO Correla Data Protection Officer.'

Our address is: Correla Ltd, Lansdowne Gate, 65 New Road, Solihull, B91 3DL

Personal Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including measures to protect the confidentiality, integrity and availability of the personal data you entrust to us. These measures include a comprehensive framework of internal controls and policies, as well as regular training to ensure that our staff understand and comply with their data protection obligations.

Access to personal data is restricted to those who have a legitimate business need to know. Persons authorised to process personal data are required to do so only in accordance with our instructions and are subject to a duty of confidentiality.

We have also established procedures to address any suspected personal data breach. Where required by law, we will notify you and the relevant supervisory authority of a personal data breach.

Making a complaint

If you are dissatisfied with the way we've handled your personal information, you should raise it with us before contacting the Information Commissioner's Office (ICO).

We aim to handle all complaints promptly and fairly. Where issues are identified, we will take appropriate steps to resolve them and improve our processes.

We'll acknowledge receipt of any complaint within 30 days, beginning from the date that the complaint is received. We'll investigate your concerns and inform you of the outcome of your complaint without undue delay.

You can contact us with the details of your complaint by:

Email at box.correla.privacy@correla.com or
Post at Correla Ltd, Lansdowne Gate, 65 New Road, Solihull, B91 3DL and mark the envelope 'FAO Correla Data Protection Officer'

If we do not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information Commissioners Office (ICO).

To contact the ICO, visit their website https://ico.org.uk/concerns/ or you can contact them directly on the ICO helpline: 0303 123 1113.

Changes to this Privacy Notice

You may request a copy of this privacy notice from us using the contact details set out above. We may modify or update this privacy notice from time to time.

Third-party links

This website may include links to third-party websites, plug-ins and applications.

Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Version Control

Version	Effective date	Change
1.0	01/04/2021	Initial Privacy Notice
2.0	04/03/2024	Format updates. Lawful Basis and contact details updated. Interactions defined for further clarity on data being processed.
3.0	19/06/2026	Format updates. Anonymous/identifiable testimonials, Whatsapp community groups, marketing communications, service communications and market research, use of publicly available data sources for contact data, information about our data protection complaints process, and the organisations we may share your data with.
3.1	23/06/2026	Format update.