How Cerrax handles personal data, in plain terms.
Cerrax Ltd ("Cerrax", "we") provides a pricing engine for the removals industry. This policy explains what personal data we handle, why, and your rights. Questions: hello@cerrax.io.
Our role under UK data protection law depends on whose data it is:
From firms using Cerrax: account and contact details (name, company, email, phone), and the job inputs you enter to produce a price. Within job data: addresses/postcodes and job details, which may be personal data of your customers — processed only to produce and explain a price and record the outcome you tell us. From website visitors: what you submit in a demo or contact form. We do not record your browsing sessions or track behaviour for advertising.
We use only the cookies needed to make the site and service work (for example, keeping you signed in). We don't use advertising or cross-site tracking cookies, so no cookie consent banner is needed. If we ever add analytics or other non-essential cookies, we'll add a consent banner first, as PECR requires.
Cerrax produces a price automatically from the inputs and settings provided. This is a tool for the firm: the firm decides what to charge its customer (see our Terms). The automated price is not a decision Cerrax makes about a customer that produces a legal or similarly significant effect on them within the meaning of UK GDPR Article 22.
Cerrax gets more accurate as it sees real outcomes. To do that we retain de-identified pricing and outcome data — the shape of a job and what it cost, stripped of the people involved. We erase the person and keep the anonymised job. Aggregated, anonymised insight may inform regional benchmarks; we never expose an individual firm's prices or any customer's identity. We only treat data as de-identified once it can no longer be linked to a person, and we hold it to that standard before it enters the corpus.
We don't sell personal data. We use a small set of service providers (sub-processors) under contract, currently including: cloud hosting and database (Google Cloud, UK/EU region) and geocoding (Google Maps, for distance from postcodes). Where the optional spreadsheet-import feature is used, those inputs are processed by an AI provider (Anthropic). We keep this sub-processor list current and reflect only services actually in use.
Your data is held in the region your account belongs to, and we don't move personal data out of it without a valid transfer mechanism in place — the UK International Data Transfer Agreement, Standard Contractual Clauses, or the equivalent for the region concerned. Some providers may process data elsewhere (for example, AI processing in the United States); the same safeguards apply there.
As things stand today: every Cerrax account is in the United Kingdom, and the data behind it is held in the UK/EU. That is a statement of fact on the date below rather than a promise about the future — if you need it in writing for a particular account, or want to know where a specific service processes data, ask us at hello@cerrax.io and we will tell you.
Account and customer personal data: for as long as your account is active and for up to six years after it closes, to meet our legal, accounting, and tax obligations — unless the law requires us to keep it longer. De-identified outcome data: retained for the learning corpus. You can ask us to erase personal data (§12); committed pricing records are never silently altered, but personal identifiers within them can be redacted.
We'll send you service messages needed to run your account. If you ask for a demo or sign up, we may contact you about Cerrax; you can opt out of marketing at any time via the unsubscribe link or by emailing us. We follow PECR for any electronic marketing.
Under UK GDPR you can request access, correction, erasure, restriction, portability, and object to certain processing. For your customers' data (where we are processor), direct requests to the firm as controller; we assist them. To exercise a right, contact hello@cerrax.io.
Cerrax is a tool for businesses and is not directed at children. We don't knowingly collect data from children.
If you're unhappy with how we handle your data, tell us at hello@cerrax.io — we will acknowledge your complaint within 30 days and work to resolve it. You can also complain to the Information Commissioner's Office (ico.org.uk).
We protect data with access controls, encryption in transit and at rest via our cloud provider, and audited administrative actions. No system is perfectly secure, but we take reasonable measures appropriate to the data.
If a personal data breach occurs, we act promptly: where we are the controller we notify the ICO, and affected individuals where required; where we are a processor we notify the affected firm without undue delay so they can meet their own obligations.
We may update this policy; we'll post the new version here with a revised effective date.
Cerrax Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. hello@cerrax.io.