Privacy Policy

Last updated: 11 November 2026

1. Who we are

This privacy policy explains how Koufax Ltd, trading as Southpaw (“Southpaw”, “we”, “us”) collects, uses and protects personal information. We are the controller of the personal information described in this policy. Southpaw is part of Somato Group, together with Mike Ayres Design Limited.

2. What this policy covers

This policy covers personal information we collect when you visit www.southpaw.co.uk, contact us, ask for a quote or design visit, buy from us, have equipment installed or serviced, take part in meetings and calls with us, or receive our marketing. Our customers are mainly schools, clinics, the NHS and other organisations, so most of the information we hold is about the people we deal with at those organisations.

This policy is written under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

3. The information we collect

• Contact and identity details: name, job title, organisation, postal, delivery and invoice addresses, email address and phone number.
• Order and account details: quotes, orders, invoices, payments, delivery and installation details, and your website account login if you create one. Card payments are handled by our payment providers; we do not see or store your full card details.
• Project details: information about the room or space we are designing, installing or servicing, and the general needs of the people who will use it. We do not ask for the names or other personal details of pupils, patients or service users.
• Communications: emails, messages, call and meeting notes (see section 6), feedback and survey responses.
• Marketing preferences: whether you want to hear from us, and how.
• Technical and usage information: IP address, browser and device type, operating system, the site that referred you, and the pages you view on our website, collected through cookies and similar technologies (see section 13).

We collect most of this information directly from you, for example when you fill in a form on our website, email or phone us, place an order or meet us. Some comes from your organisation (for example a colleague who passes on your details for a project), and some is collected automatically when you use our website. If you apply for a credit account, we may also receive information from credit reference and fraud prevention agencies.

4. How we use your information and our lawful bases

We must have a lawful basis under the UK GDPR for each way we use personal information. The table below sets out what we do and why.

Where we rely on legitimate interests, we have weighed our interests against your rights and are satisfied that they do not override them. You can ask us for more detail.

If we need information to meet a contract or a legal requirement and you do not provide it, we may not be able to supply our products or services.

We will always keep your data safe and private. We will never sell your personal information, and we will never pass it to anyone else for their own marketing.

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.

5. Marketing

We will only send you marketing where the law allows. Every marketing email has an unsubscribe link, and you can also opt out at any time by emailing accounts@southpaw.co.uk. If you opt out, we will keep a note of your email address so that we do not contact you again.

6. AI note-taking in meetings and calls

We sometimes use AI note-taking tools to help us keep an accurate record of meetings and calls. This includes our internal meetings and our meetings and calls with customers, suppliers and other contacts. The tools we use are Google Gemini in Google Meet, Plaud, Granola and Claude. Koufax Ltd (trading as Southpaw), part of Somato Group, is responsible for these notes.

What the tool does

The tool processes the conversation and produces written notes of the key points, decisions and actions. We keep only these notes. We don't keep recordings or full transcripts of the conversation.

What information is involved

The notes may include the names, job titles and organisations of the people taking part, and what was said in a business context. When we talk about a sensory room or other space, we only ask about the general needs of the pupils or people it is for. We don't collect the names or other personal details of pupils, patients or service users, and if anything that could identify them comes up, we leave it out of the notes.

Why we do it and our lawful basis

We rely on our legitimate interests to use AI note-takers. Those interests are:

• keeping an accurate record of what you need, so we design and deliver the right environment for you
• recording decisions, quotes discussed and actions agreed, so we can follow up properly and avoid misunderstandings
• letting our team focus on the conversation rather than writing notes by hand
• keeping business and contract records for legal, tax and insurance purposes

We have carried out a legitimate interests assessment and are satisfied that these interests don't override your rights, as long as the safeguards below stay in place.

You'll always know, and you can say no

• We'll tell you at the start of the meeting, and in the meeting invitation, when an AI note-taker is being used.
• You can ask us to switch it off before or during the meeting, and we'll take notes by hand instead.
• You can object to this use of your information at any time by emailing accounts@southpaw.co.uk. We will stop unless we have compelling legitimate grounds to continue.

How we protect your information

• We never use AI note-takers secretly, and never in HR or safeguarding meetings, or in meetings about someone's private circumstances.
• The providers of these tools act as our data processors under data processing agreements, and they don't use our data to train their AI models.
• Notes are stored in our Google Workspace, with access limited to the people who need them.
• Our team checks AI notes before relying on them.

How long we keep the notes

We keep meeting notes for seven years and then delete them. We keep them for this long because:

• a claim for breach of contract can be brought up to six years after the breach (Limitation Act 1980), and the notes are key evidence of what was asked for and agreed
• HMRC and the Companies Act 2006 require company records to be kept for six years from the end of the accounting period, which can be nearly seven years from the date of a meeting
• seven years matches how long we keep our other business and contract records

If a project ends in a dispute or claim, we may keep the relevant notes until it has been resolved.

Want to know more?

If you have any questions, or would like a copy of our full legitimate interests assessment, please email accounts@southpaw.co.uk.

7. Who we share your information with

We share personal information only where we need to, and only with:

• Service providers who act on our behalf under contract and only on our instructions, including our website and online shop platform (Shopify), payment providers, cloud storage, email and office software (Google Workspace), the AI note-taking tools listed in section 6, IT support, and delivery and courier companies.
• Analytics and advertising providers (Google and LinkedIn), but only through cookies you have agreed to (see section 13).
• Other Somato Group companies – Mike Ayres Design Limited – so we can give you a joined-up service.
• Our professional advisers, such as accountants, auditors, insurers and lawyers.
• Banks, credit reference agencies and fraud prevention agencies, to process payments, verify identity, prevent fraud and money laundering, and assess applications for credit accounts.
• Police, regulators, courts and other authorities, where the law requires us to or to protect our rights.
• A buyer of our business, if we or substantially all of our assets are sold. Personal information would be one of the transferred assets and would stay protected by this policy.

8. International transfers

Some of our service providers (for example Shopify, Google, LinkedIn and our AI note-taking providers) store or process information outside the UK. When personal information is transferred outside the UK, we make sure it is protected by one of the safeguards the UK GDPR allows, such as:

• transfers to countries the UK has confirmed provide adequate protection (adequacy regulations), including the European Economic Area and organisations certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge)
• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses

Contact us at accounts@southpaw.co.uk for more information about the safeguards used.

9. How long we keep your information

We keep personal information only for as long as we need it. Our standard periods are:

The 7-year period reflects the six-year limit for contract claims under the Limitation Act 1980 and the requirement under the Companies Act 2006 and HMRC rules to keep company records for six years from the end of the accounting period. If there is a complaint, dispute or claim, we may keep the relevant information until it has been resolved.

10. How we keep your information safe

We use suitable technical and organisational measures to protect personal information, including access controls so that only people who need it can see it. Our online shop and checkout use encrypted (HTTPS) connections. If you have a password for our website, please keep it confidential and do not share it.

No transmission over the internet is completely secure, so we cannot guarantee the security of information you send to us online, but once we receive it we use strict procedures to protect it.

11. Your rights

Under the UK GDPR you have the right to:

• be informed about how we use your personal information (this policy)
• access your personal information and get a copy of it (a “subject access request”)
• rectification: have inaccurate or incomplete information corrected
• erasure: ask us to delete your information where there is no good reason for us to keep it
• restrict how we use your information, for example while a complaint is looked into
• data portability: receive information you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another organisation, where we use it on the basis of consent or a contract and by automated means
• object to our use of your information where we rely on legitimate interests, and object at any time to direct marketing
• withdraw consent at any time where we rely on consent (for example for marketing or non-essential cookies). This does not affect anything we did before you withdrew it
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make decisions of this kind.

To use any of these rights, email accounts@southpaw.co.uk or write to us at our registered office. There is normally no charge. We may need to confirm your identity first. We will reply within one month, or within three months if your request is complex or you have made several requests, in which case we will tell you within the first month. Some rights have exceptions; if one applies, we will explain why.

12. Complaints

If you are unhappy with how we have used your personal information, please contact us first at accounts@southpaw.co.uk so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: online at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

13. Cookies

Cookies are small text files placed on your device when you visit a website. Our website runs on Shopify. When you first visit, a cookie banner asks for your consent. Essential cookies are always on because the website and checkout cannot work without them. We only set analytics and marketing cookies, including third-party cookies, if you accept them. You can change your choice at any time using the cookie settings link at the bottom of our website, or by clearing cookies in your browser settings.

Essential cookies (always on)

Analytics and marketing cookies (only if you accept)

We manage our Google tags through Google Tag Manager. Our contact forms use hCaptcha or Google reCAPTCHA to stop spam, which may set cookies needed for that check. Express checkout options such as Shop Pay may set their own cookies when you use them. For more information see Shopify’s cookie policy (www.shopify.com/legal/cookies) and Google’s privacy policy (policies.google.com/privacy); for LinkedIn, see www.linkedin.com/legal/cookie-policy.

14. Links to other websites

Our website may link to other websites. We are not responsible for how they handle personal information, so please read their privacy policies.

15. Changes to this policy

We may update this policy from time to time, for example if the law or our business changes. The latest version will always be on this page, with the date it was last updated at the top.

16. Contact us

For any questions about this policy or your personal information, email accounts@southpaw.co.uk or write to Koufax Ltd, trading as Southpaw, Bramley House, Office 18, Bramley Road, Long Eaton, Nottingham, NG10 3SX.