Privacy Notice

This notice explains how COLE VALLEY GROUP LTD, trading as Cole Valley Consulting, uses personal data in connection with Call Quality Lens, its website at cqlens.colevalleyconsulting.co.uk and its customer portal at portal.cqlens.colevalleyconsulting.co.uk.

1. Controller Identity

COLE VALLEY GROUP LTD is a private limited company registered in England and Wales under company number 17117677. Its registered office is 128 City Road, London, United Kingdom, EC1V 2NX. It trades as Cole Valley Consulting ("Cole Valley", "we", "us").

For any question about this notice or your personal data, contact kelvin@colevalleyconsulting.co.uk. We have not appointed a data protection officer.

2. Our Two Roles

When our customers use Call Quality Lens, we process their data on their behalf. A customer organisation connects its Microsoft 365 tenant to Call Quality Lens so that the service can analyse the quality of Microsoft Teams calls. For that data, the customer is the controller and we are its processor. Section 7 summarises this processing; the customer is responsible for telling its people about it.

For everything else in this notice, we are the controller. That covers our website, enquiries, our customer relationships, billing and the security and operation of our service.

3. Personal Data Under Our Control

We do not sell personal data and we do not use it for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Where we rely on legitimate interests, you can ask us for details of the balance we have struck.

Sources and Required Information

We collect most of this data from you. We also receive it from others:

• your organisation, when it names you as a contract, billing or notice contact;
• Microsoft Entra ID, when you sign in to the customer portal, which provides your sign-in name and identifiers;
• our own service, which records portal requests, administrative actions and incidents.

You do not have to give us personal data to use our website. To enter into and manage a contract, we need the name and business contact details of the person signing and of the billing contact; without them we cannot contract with your organisation or invoice it. The customer portal cannot be used without signing in with a Microsoft Entra account.

4. Cookies and Browser Storage

Our website does not set cookies or use browser storage in its own code.

The customer portal uses browser storage that is strictly necessary to provide the service you request:

Because this storage is strictly necessary for authentication or for a feature you asked for, consent is not required under the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended.

5. Third-Party Services in Your Browser

Our website and portal load fonts and script libraries from the providers below. When your browser fetches a file, it connects directly to the provider, which receives the data shown. Each provider uses that data under its own privacy terms.

These providers may serve files from outside the United Kingdom. Google LLC and Cloudflare, Inc. are certified under the UK Extension to the EU-US Data Privacy Framework, which UK regulations recognise as adequate for transfers to certified US organisations; we confirmed both certifications on the Data Privacy Framework list on 26 September 2026. jsDelivr is a UK company subject to UK data protection law; it states that requests may be served by any of its delivery providers, which may be outside the United Kingdom. We rely on our legitimate interests in presenting the website and portal reliably.

6. Data Recipients

• Microsoft, which hosts our service on Microsoft Azure and provides our email and productivity services through Microsoft 365. Our service's database, application servers and logs are in the United Kingdom; our web pages are served from Microsoft's global network.
• Our professional advisers, such as accountants and solicitors, where needed.
• Payment provider. We have not yet started collecting payments online. When we do, we will use Stripe, and this notice will be updated before that happens.
• Authorities, where the law requires it.

7. Customer-Controller Processing

If your employer or another organisation uses Call Quality Lens, that organisation is the controller of your data and you should contact it first. In summary, depending on the permissions it grants, the service reads from its Microsoft 365 tenant:

• Teams call records, including participant identifiers and display names, call times, network details such as IP addresses and Wi-Fi information, device names and call quality measurements;
• directory details such as licences, department, job title and office location;
• presence, calendar event times and subjects for meetings;
• membership of groups the organisation designates for priority monitoring.

The service does not read call content, recordings, transcripts, chat messages or email.

The service uses Microsoft Azure OpenAI to produce summaries and answers. Chat requests are processed by default within Microsoft's EU Data Zone, which Microsoft states follows its EU Data Boundary, can include EFTA countries such as Norway and Switzerland and can have regions added without prior notice; it does not include the United Kingdom. Search requests are converted to embeddings by a deployment in the Azure region West Europe (Netherlands). Transfers to the European Economic Area and Switzerland rely on UK adequacy regulations. Our requests are sent with response storage switched off, which stops Microsoft keeping them as stored response history; it does not switch off Microsoft's abuse monitoring. Microsoft's standard abuse monitoring applies, and we have not applied to Microsoft for modified abuse monitoring, so prompts and outputs that Microsoft's systems flag may be stored and reviewed by authorised Microsoft staff. Microsoft's current documentation does not state how long that data is kept. The AI features do not read meeting subjects taken from calendars, but anything a user types into the assistant is sent to the model.

If you contact us about this data, we will pass your request to the organisation concerned.

8. International Transfers

Our service stores the data we control in the United Kingdom. Where data is processed outside the United Kingdom, as described in sections 5 and 7, we rely on UK adequacy regulations, including those for the European Economic Area and for certified organisations under the UK Extension to the EU-US Data Privacy Framework, or on Microsoft's data protection addendum, which includes the International Data Transfer Agreement for any other transfer from the United Kingdom. You can ask us for a copy or description of the safeguard that applies by emailing kelvin@colevalleyconsulting.co.uk.

9. Your Rights

You have the right to ask for access to your personal data, and to ask us to correct it, erase it, restrict its use or transfer it to you or another organisation, in each case where the law provides. You have the right to object to our use of your data where we rely on legitimate interests.

To exercise a right, email kelvin@colevalleyconsulting.co.uk. We will respond within one month, or tell you within that month if we need longer.

10. Complaints

You have the right to complain to us about our use of your personal data, by email to kelvin@colevalleyconsulting.co.uk or by post to our registered office. We will acknowledge your complaint within 30 days of receiving it, look into it, keep you informed of progress and tell you the outcome without undue delay. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ico.org.uk). From 30 September 2026 the regulator is the Information Commission, which continues to use the name ICO.

11. Notice Changes

We will update this notice when our processing changes, and we will show the date of the change at the top.