Last updated: 26 September 2026
This policy explains what personal data Centra collects, why, and what you can do about it.
Centra is operated by The Anderson Halford Group Limited, registered in England and Wales, company number 15921653, registered office 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. We are the data controller for personal data about our own customers, and a data processor for personal data our customers store in Centra about their contacts.
That distinction matters and runs through everything below.
If you are a Centra customer — you have an account with us and pay us a subscription — we are the controller of your personal data and this policy describes how we handle it.
If you are a contact in someone's Centra account — a customer of a business that uses Centra — that business is the controller of your data. We process it on their instructions. If you want your data corrected or removed, contact them directly. We will assist them in responding to you, but we cannot act on your data without their instruction.
Data protection law requires us to have a lawful basis for each purpose, and to tell you what it is.
| What we do | Our lawful basis | Why |
|---|---|---|
| Run your account and provide the service | Performance of a contract | We cannot deliver a subscription you have bought without processing the account it belongs to. |
| Take payment and manage your subscription | Performance of a contract | The same. Card details are held by Stripe and never reach us. |
| Keep accounting and tax records after your account closes | Legal obligation | The Companies Act 2006 and HMRC's record-keeping rules require six years. This is why the retention below is six years and not shorter. |
| Keep logs, investigate faults, and protect the service from abuse | Legitimate interests | Keeping a service working and secure is a legitimate interest, and it cannot be done without some record of what happened. We keep the minimum that answers "what went wrong". |
| Send you messages about your account — receipts, security notices, service notifications | Performance of a contract | These are part of running the service, not marketing. |
| Answer your support requests | Performance of a contract | Support is part of what the subscription provides. |
| Keep you signed in and secure forms against forgery | Performance of a contract | These are the only cookies we set. See Cookies below. |
| Send you marketing about Centra — new features, things we think you would use | Soft opt-in under PECR where you are already a customer, and consent otherwise | Explained below. |
Where we rely on legitimate interests, we have weighed our interest against your rights and are satisfied it does not override them. You can object to that processing at any time — see Your rights.
On marketing. If you are already a Centra customer, we may email you about our own similar products and services under the soft opt-in in the Privacy and Electronic Communications Regulations — you were given the chance to refuse when we took your details, and you get that chance in every message afterwards. If you are not a customer, we only email you if you have agreed to it. Every marketing message carries an unsubscribe link, and one click is enough — you never have to reply, sign in, or ask us. Unsubscribing stops the marketing and nothing else: you will still receive the messages needed to run your account, because those are part of the service rather than promotion.
For the personal data our customers store about their own contacts, we determine no lawful basis, because it is not our decision to make. We are the processor: we act on our customer's instructions, and the customer — as controller — is responsible for having a basis and for telling the people concerned. That division is set out in Who this policy is for.
Centra is a CRM, so a customer's account may contain personal data about their own contacts:
Customers may connect Centra to other services. Each connection is optional and can be disconnected at any time.
Microsoft (calendar) — we read your calendar's busy times so your booking page does not offer slots when you are unavailable. We read whether a period is busy, not what the appointment is. Nothing is written to your calendar.
Zoom — where enabled, we create a Zoom meeting when a customer books an appointment, and we retrieve the transcript when a meeting is recorded. We check the meeting's participants against the contacts in your Centra account. If no participant matches one of your contacts, the transcript is discarded without being stored — Centra retrieves the file, checks the participants against your contacts, and where there is no match it is never written to our database. Where there is a match, the transcript is encrypted and filed against that contact. We do not store Zoom recordings, and we never download them. Deleting a contact deletes their transcripts.
Xero and QuickBooks — where connected, we create records in your accounting system for invoices raised in Centra, and read back their payment status.
Companies House — when you look up a company by number, we retrieve its public register entry. This is public data and no personal data of yours is sent.
Stripe — handles subscription payments. Card details go to Stripe and never reach us.
Twilio — sends SMS and handles voice calls where those features are used.
Resend — sends email.
Anthropic (United States) — provides Centra's AI features. The content of each AI request is sent to Anthropic's API, processed in the United States, and the result returned. Anthropic does not train on it. It processes, only when that feature is used:
AI meeting notes are the one AI feature that reads a client conversation, and they are off unless you turn them on. With the setting switched on — in Settings → Organisation, by an owner or admin — the text of each filed Zoom transcript, with the meeting's topic and date, is sent to Anthropic, which returns a summary, the decisions made and suggested action points. Nothing else about your account is sent: no contact details, no other records. With the setting off, which is how every account starts, no transcript is sent anywhere.
Centra's database is hosted in the United States with Neon, in their US East (Ohio) region. The application runs on Vercel. Files are stored with Vercel Blob. Our public website and these policy pages are served by Cloudflare, which sees the IP address of anyone visiting them. Anthropic processes AI requests in the United States. Our sub-processors are listed above.
Transfers outside the UK are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent lawful transfer mechanism.
Customer account data — for as long as you have an account, and for six years after it closes, to meet our legal and accounting obligations.
Data you store in Centra — for as long as you keep it there. Deleting a record deletes it. Closing your account deletes your data, subject to backups.
Backups — our database keeps 30 days of point-in-time history, so data deleted from the live system remains recoverable from that history for up to 30 days before it expires.
Documents — where a customer uses Centra to store documents, those are retained according to that customer's own retention policy.
Under UK data protection law you have the right to:
If you are a contact in someone else's Centra account, direct your request to the business that holds your data. We will support them in answering it.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first.
Centra uses cookies that are necessary for the service to work — keeping you signed in, remembering which organisation you are viewing, and securing forms against cross-site request forgery. We do not use advertising or tracking cookies.
We will update this page when our processing changes, and change the date at the top. Material changes will be notified to customers by email.
The Anderson Halford Group Limited
167-169 Great Portland Street, 5th Floor
London
W1W 5PF