GDPR Policy

1. Our commitment

Tiri.Tese Ltd is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) as retained in UK law by the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018. This policy sets out our approach to data protection as both a data controller (for our website and direct client relationships) and, where applicable, a data processor (when processing data on behalf of our clients through our products).

2. Data protection principles

We process personal data in accordance with the six lawfulness principles under UK GDPR Article 5:

• Lawfulness, fairness, and transparency — we process data lawfully with a valid legal basis, and we are transparent about how data is used
• Purpose limitation — data is collected for specified, explicit, and legitimate purposes and not processed further in ways incompatible with those purposes
• Data minimisation — we collect only data that is adequate, relevant, and limited to what is necessary
• Accuracy — we take reasonable steps to ensure data is accurate and kept up to date
• Storage limitation — data is kept in identifiable form only for as long as necessary
• Integrity and confidentiality — we process data with appropriate technical and organisational security measures

3. Legal bases we rely on

• Article 6(1)(a) — Consent: where you have given clear consent for a specific purpose (e.g. marketing emails, non-essential cookies)
• Article 6(1)(b) — Contract: where processing is necessary to perform a contract with you or to take steps before entering into a contract
• Article 6(1)(c) — Legal obligation: where we must process data to comply with UK law, including tax, accounting, and regulatory requirements
• Article 6(1)(f) — Legitimate interests: where processing is necessary for our legitimate interests, such as security monitoring, fraud prevention, and improving our services, provided these are not overridden by your rights and interests

4. Data subject rights

Under UK GDPR, individuals whose data we process have the following rights, which we will action within one calendar month of receiving a valid request:

• Right of access (Article 15): obtain a copy of your personal data and information about how it is processed
• Right to rectification (Article 16): have inaccurate data corrected without undue delay
• Right to erasure (Article 17): have data deleted where there is no compelling reason to continue processing
• Right to restriction (Article 18): have processing restricted in certain circumstances
• Right to data portability (Article 20): receive data in a structured, commonly used, machine-readable format
• Right to object (Article 21): object to processing based on legitimate interests or for direct marketing
• Rights in relation to automated decision-making (Article 22): not be subject to solely automated decisions that produce significant effects

To exercise any right, contact us at info@tese.uk. We may need to verify your identity before acting on a request. We will not charge a fee for reasonable requests. If we are unable to act on a request, we will explain why.

5. Data processing agreements

Where we act as a data processor on behalf of clients (for example, where client data is processed through our products such as BAZ, GavaFlow, HaulGuard, or DocCrab), we enter into a Data Processing Agreement (DPA) as required under UK GDPR Article 28. This agreement sets out the nature, purpose, duration, and subject matter of processing, along with the obligations of both parties.

Clients who require a DPA should contact us at info@tese.uk.

6. Data breach response

We have an internal data breach response procedure in place. In the event of a personal data breach that poses a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required under UK GDPR Article 33. Where a breach is likely to result in high risk to individuals, we will notify those individuals without undue delay.

7. International data transfers

Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place. For transfers to countries not covered by UK adequacy regulations, we rely on UK-approved Standard Contractual Clauses or other appropriate transfer mechanisms.

8. Third-party processors

We work with a number of sub-processors to deliver our services, including cloud hosting providers, analytics platforms, and email service providers. All sub-processors are required to process data only in accordance with our instructions and are bound by appropriate data protection agreements. A list of current sub-processors is available on request.

9. Retention schedule

• Website contact form data: 2 years from last contact
• Client account data: duration of contract plus 7 years
• Financial records: 7 years (Companies Act 2006 requirement)
• Employee records: duration of employment plus 6 years
• Marketing opt-in records: until consent is withdrawn

10. Complaints

If you believe we have not handled your personal data correctly, you have the right to complain to the Information Commissioner's Office (ICO). The ICO can be contacted at ico.org.uk/make-a-complaint or by telephone at 0303 123 1113. We would encourage you to contact us first so we can attempt to resolve your concern directly.