Privacy policy
What personal data TeshTech collects, why we are allowed to hold it, who else sees it, and how to get it back or removed.
Version 2026-08-18
1. Who is responsible for your data
TeshTech is the data controller for information about our own visitors, enquirers, clients and staff — that is what this policy covers. Where we host and run a website for a client, we are that client's data processor for their visitors' data, and their own privacy policy applies to it, not this one.
- Who we are
- TeshTech Ltd
- VAT number
- GB517507885
- Contact
- hello@teshtech.co.uk
Not yet recorded: company number, registered address. These are required on this page and will be published as soon as they are registered.
Our ICO registration number will be published here before launch. Tracked as the pre-launch checklist in 21 §8.
2. What we collect, and why
| If you are | We hold | Because |
|---|---|---|
| A visitor to this site | Pages you viewed and how you arrived, plus the cookies listed in our cookie policy | To keep the site working and, with your consent, to understand what is useful |
| Building a quote | The answers you give the configurator, and your name, email and phone if you ask us to send the quote | To price the work and send you the quote you asked for |
| Placing an order | Billing name, company, address, email, phone; the terms version you accepted with the time and IP address; what you bought and what you paid | To deliver and invoice the work, and to keep the records HMRC requires |
| A client | Everything above, plus project files, messages, support tickets and portal sign-in records | To deliver the project and support it afterwards |
| Paying us | The last four digits and card type only. Your full card number never reaches our servers | Payment is taken on Stripe's own page, so we never see the card |
We do not buy contact lists, and we do not sell or rent your data to anyone.
3. Our lawful basis for each use
| What we do | Basis |
|---|---|
| Deliver a project you bought | Contract |
| Invoice you and keep the financial record | Legal obligation (HMRC) |
| Reply to an enquiry or a quote request | Contract, or steps taken at your request before a contract |
| Marketing email to a prospect | Consent, which you give by opting in |
| Marketing to an existing customer about similar services | Legitimate interest, with an unsubscribe link in every message |
| Website analytics | Consent, given through the cookie banner |
| Security logging and audit records | Legitimate interest in keeping the platform secure |
We score incoming enquiries to decide which to follow up first. That score never produces a legal or similarly significant effect, and a person always reviews it.
5. Sending data outside the UK
Your data is held in the UK or the European Economic Area by default. Where a supplier is outside it — Stripe and Resend both process some data in the United States — the transfer relies on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and we record a transfer risk assessment for each one.
6. How long we keep it
- Enquiries and quotes that do not become orders: 24 months, then deleted.
- Invoices, orders and financial records: 6 years after the end of the financial year they fall in, because HMRC requires it.
- Project files and correspondence: for the life of the engagement and 6 years after it ends.
- Security and audit logs: 12 months.
- Your cookie choice: 12 months, then we ask again.
7. Your rights
| Right | What it means | How long we take |
|---|---|---|
| Access | A copy of everything we hold about you | Within one month |
| Rectification | Correct anything that is wrong | Within one month |
| Erasure | Delete what we hold, other than records we are legally required to keep | Within one month |
| Restriction | Stop us using it while something is disputed | Within one month |
| Portability | A machine-readable copy of what you gave us | Within one month |
| Objection | Stop marketing, or object to processing based on legitimate interest | Marketing stops within 24 hours |
Erasure is not deletion of everything. We must keep invoices, contracts and audit records under legal obligation, so we remove your name and contact details from them and replace you with a reference number instead. We tell you exactly what was kept and why.
To exercise any of these, email us and say what you want. We may ask you to confirm who you are first. It is free, unless a request is manifestly excessive.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would rather you told us first so we can put it right.
8. How we protect it
- Everything travels over an encrypted connection and is encrypted at rest.
- The most sensitive fields are separately encrypted with keys held in a secret manager.
- Each client's data is isolated at the database level, not merely filtered in code.
- Every change to a record is logged with who made it and what changed.
- Access is limited to the staff who need it for their role.
If a breach happens and it puts your rights at risk, we report it to the Information Commissioner's Office within 72 hours, and tell you without undue delay if the risk to you is high.
9. Changes to this policy
This page carries a version date. If we change anything material we will update that date, and tell existing clients directly rather than relying on you to notice.