1. Who we are
Trails is operated by Ramzi Hajaj, trading as Trails. We help businesses understand relevant market activity and possible routes to new work through their professional relationships.
Ramzi Hajaj, trading as Trails40 Byne Road, London, SE26 5JE, United Kingdom
ramzi@trytrails.co.uk
We act as a controller for our own business administration, invitation requests and independently collected public research. For private information processed on a business customer’s instructions, we act as a processor. Our standard processing terms are set out in the Data Processing Agreement. The actual purpose and use of the information determine our role.
2. Information we use
- Requests, accounts and support
- Your name, email, firm name, firm type, website, account permissions, preferences, correspondence, subscription details and payment status. An invitation request saves your firm’s details; account setup follows approval.
- Private relationship information
- Contacts, firms you know, shared projects, work histories, CRM records, notes, work communications and metadata that you or your organisation provide or authorise us to access.
- Public professional and planning information
- Names, professional roles, firms, business contact details, projects and evidence of collaboration from planning records, company websites, published project credits, tender awards, press coverage, public posts and appropriately licensed sources. Planning records and supporting documents can also contain applicant and agent names, property addresses and other project-related personal information, including information about people who are not Trails users.
- Recommendations and outcomes
- Suggested opportunities, relationship paths, drafts, your feedback and actions or outcomes recorded for your account.
- Technical and usage information
- Security and operational logs, device and browser information, and optional website analytics when you choose to allow it. See Cookies and analytics.
Information about a named professional or sole trader can be personal data even if it is publicly available. We do not intend to collect sensitive personal information or information about children. Please keep private imports relevant to your professional relationships.
Providing your details is voluntary. Without the required firm and contact information, we cannot process an invitation request or administer your account. Optional marketing and analytics choices do not affect access to the service.
3. Why we use it
- Respond to requests and run the service. Our legitimate interests are handling business enquiries, administering accounts and supporting customers. Where you personally enter a contract, we also process what is necessary for that contract or steps you request before it.
- Research public market activity. Our legitimate interest is providing relevant professional intelligence and identifying credible connections to new work. This requires consideration of the people affected, their reasonable expectations and their rights; public availability is not an exemption from data protection law.
- Produce your private recommendations. We process customer-controlled private data on the customer’s documented instructions. The customer determines the lawful basis for that processing; our processor duties still apply.
- Protect and improve the service. We use necessary operational information for our legitimate interests in preventing misuse, investigating faults and improving reliability. Optional website analytics relies on your consent.
- Meet legal obligations. This includes required tax records and responding to lawful requests.
- Send optional news. Where the form asks for marketing consent, we use your choice. Request confirmations, access invitations and necessary service messages are separate from optional marketing. You can unsubscribe from marketing at any time.
4. Private relationships and public information
Your private contact lists, communications and relationship evidence stay restricted to your account and its applicable permissions, together with the private paths and recommendations derived from them. Authorised Trails personnel and suppliers may process them to deliver the service.
Another customer does not gain access to your private information because both accounts know the same firm. Cross-customer sharing of private relationship graphs is not an active feature.
We can use a firm’s name as a starting point for research and independently find public facts about its projects or collaborators. Those separately evidenced public facts may be included in our shared market graph where lawful. Your private list, the reason a firm was researched and a route inferred from your private relationships are not made public through that process.
Restricted integration data, including Google API data and its derivatives, must remain within the provider’s permitted uses. It is not a shortcut for building the shared public graph.
5. Imports and connected services
You can provide information manually or through an export. Giving Trails a file from an email account, calendar, CRM or AI assistant does not by itself give us continuing access to that service.
Some accounts also have direct integrations, including Google Workspace email or calendar, SmartSuite CRM and Discord workspaces. Availability and permissions depend on the account and the feature. Access must be authorised by you or an administrator entitled to act for your organisation. Depending on the enabled feature, it can include business contacts, calendar entries, message metadata or work communications. Where you authorise delivery to a connected workspace, that workspace’s permissions also govern access to the delivered copies.
Disconnecting stops future access through that connection; it does not automatically delete information already imported. Imported records, private inferences and any separately authorised account copies follow their own permissions and deletion process. Contact us if you want both disconnection and deletion.
Provider restrictions apply to both imported information and derived information. Access to Google user data must follow applicable Google API Services User Data Policy requirements, including Limited Use where applicable.
6. AI and recommendations
Trails uses AI services to research, match firms and projects, analyse relationships, summarise evidence and draft suggested approaches. Inputs and outputs can contain business contact details and private customer context. Recommendations may be incomplete or wrong, so check important facts before acting.
Trails does not itself train a general-purpose model on your private account data. Our AI suppliers process inputs and outputs under their own applicable terms and account settings. Turning model training off does not necessarily prevent storage for service delivery or safety checks.
The service supports your decisions. It is not designed to make solely automated decisions with legal or similarly significant effects on individuals. You control whether and how to approach someone.
7. Suppliers and international transfers
Public professional facts and research may be made available to Trails customers as part of our commercial intelligence service. That does not include your private contact list, communications or private relationship paths.
Information may be processed by authorised providers of hosting, databases, AI, email delivery, workflow tools, analytics and support. It may also be shared with your authorised account users, professional advisers, or authorities where required by law. We do not sell your private contact list.
Our supplier summary explains the services involved. A customer’s own connected provider is not automatically a sub-processor appointed by Trails.
Suppliers may process information outside the UK. Restricted transfers require an applicable safeguard, such as UK adequacy regulations or approved contractual safeguards with any necessary assessment. Contact us for information about the arrangements for your data and copies of applicable safeguards, with confidential information redacted where needed.
8. Security and retention
Access to private information is restricted to authorised users and services. The security schedule explains these controls and how to request an export or deletion. No system can promise absolute security.
Disconnecting a service or closing an account does not automatically delete all stored information. Contact us to request deletion, including private insights and retained copies.
Retention depends on the purpose of the record, the agreed service and legal requirements. We review whether information is still needed and delete or anonymise it when it is not. Contact us to discuss a particular record or request earlier deletion.
- Invitation requests
- Retained while your request is being considered and there is an ongoing reason to contact you about access. We consider the age of the request and our last meaningful interaction. Approval links the request to your account; you can ask to leave the list at any time.
- Private account information
- Used for the agreed service, including your relationship records and private recommendations. At the end of the service, return or deletion follows the customer’s instructions and any legal requirement to keep particular records. Arrange an export before deletion if you need one.
- Backups and retained copies
- Backup copies can remain after active records are deleted. Their deletion depends on the relevant storage cycle. We will identify retained copies and their expected removal when handling your request; copies awaiting deletion must remain outside ordinary use.
- Technical logs and research records
- Retention is assessed against the need to operate the service, investigate faults, secure accounts and substantiate research. Relevant personal data in logs and research records is included when assessing a deletion request.
- Website analytics
- Events are held by PostHog to understand website use and how visitors request access. We assess retention against the need to compare usage over time and investigate problems. Withdrawing consent stops new optional collection; it does not erase earlier events. Contact us about deletion of data already collected.
- Public professional records
- Retention depends on continuing relevance, accuracy and a lawful research purpose. Corrections and objections trigger a review. Public availability alone does not justify keeping personal data indefinitely.
- Billing and legal records
- Retained for applicable tax and record-keeping requirements, and where necessary to establish, exercise or defend legal claims. Any continued retention is limited to the records needed for that purpose.
- Marketing preferences
- Optional marketing stops when you unsubscribe. A minimal suppression record may be kept to respect that choice, rather than to send more marketing.
9. Your rights
Depending on the circumstances, you can ask to access, correct or erase your personal data, restrict its processing, receive portable data, or object to processing based on legitimate interests. You have an absolute right to object to direct marketing. You may withdraw consent without affecting the lawfulness of earlier processing.
Your right to object
You can object to our use of your personal data for direct marketing at any time, and to processing based on legitimate interests on grounds relating to your situation. Email ramzi@trytrails.co.uk; we will consider the request under the applicable rules.
Email ramzi@trytrails.co.uk. We may need proportionate information to verify your identity. We normally respond within one month; where the law permits an extension, we will explain it. Rights are subject to applicable legal conditions and exemptions.
If your information appears in our public research, you can ask about its source, correct a record or object to its use. If we process it only on a customer’s instructions, we will refer the request to that customer and assist them.
You can also complain to the Information Commissioner’s Office, the UK data protection regulator. You do not have to contact us first.
11. Changes and contact
Trails is for business use and is not directed at children. We will update this notice when our practices change and communicate material changes as appropriate.
For privacy questions, source enquiries or requests about your data, contact ramzi@trytrails.co.uk or write to the address above.