Privacy & Cookie Policy

What this policy covers

This policy explains how Tech Savvy Solutions Ltd collects, uses, shares and protects personal information when people use our website, contact us, receive or supply services, or communicate with us in a professional capacity. It also explains how we use limited business contact information for carefully targeted business-to-business marketing.

It applies where we act as the data controller. When we handle personal information solely on a client’s instructions while providing managed IT or related services, we may instead act as a processor and the client’s privacy information and our service agreement will apply.

Who we are

Tech Savvy Solutions Ltd is a managed IT, cyber security and business technology provider. We are the data controller for the activities described in this policy.

Legal name: Tech Savvy Solutions Ltd
Company number: 10487796
Registered and business address: 1 to 9 Kingsley Street, Bury, BL8 2RF
Telephone: 0161 635 5003
Privacy enquiries: dpc@tsavvy.co.uk
Website: https://techsavvysolutions.co.uk

The information we collect

Depending on how you deal with us, we may collect and use:

identity and professional information, such as your name, job title, employer and professional responsibilities;
business contact information, such as your work email address, business telephone number, business postal address and professional social-media profile;
enquiry and correspondence information, including messages, meeting notes, preferences and records of our communications;
customer, supplier and contract information, such as service requirements, authorised contacts, billing details and transaction records;
marketing preference information, including objections, opt-outs and suppression records;
website and technical information, such as IP address, browser, device information, security logs and cookie choices; and
analytics information about website use where you have consented to analytics cookies.

We do not seek special-category personal information or criminal-offence information for prospecting. Please do not send this information unless it is necessary for a specific service or legal requirement and we have agreed how it will be handled.

Where we obtain information

We obtain personal information:

directly from you when you contact us, request a quote, enter into a contract, use our services or communicate with us;
from your employer, colleagues, advisers, customers or suppliers where this is relevant to a genuine business matter;
from publicly accessible professional and business sources, including company websites, Companies House, professional networking pages, trade directories and public business profiles;
from referrals and professional introductions; and
automatically from our website and security systems, subject to your cookie choices.

For targeted B2B outreach, we record the source and date of the information where practicable. We use professional information only, do not use private contact details merely because they are available online, and do not use bought personal marketing lists for this activity.

How and why we use information

We use personal information only where we have a lawful basis under UK data protection law.

Purpose	What we do	Lawful basis
Enquiries and quotes	To respond to questions, assess requirements and provide requested information or quotations.	Legitimate interests in responding to genuine business enquiries; and steps taken at your request before a contract where applicable.
Providing services	To set up, manage and support customer services, communicate with authorised contacts, invoice and maintain service records.	Contract, legitimate interests in administering business relationships, and legal obligation where applicable.
Suppliers and partners	To manage suppliers, professional advisers and commercial relationships.	Contract and legitimate interests in operating our business.
Targeted B2B marketing	To identify and contact relevant people at corporate organisations about managed IT, cyber security and related business technology services that may be relevant to their professional role.	Legitimate interests, subject to our documented assessment, the UK GDPR and PECR.
Security and service integrity	To protect our website, systems, people and customers; prevent misuse; investigate incidents; and maintain audit records.	Legitimate interests in network and information security, and legal obligation where applicable.
Legal and financial administration	To keep accounting records, exercise or defend legal claims, meet regulatory duties and respond to lawful requests.	Legal obligation and legitimate interests.
Website analytics	To understand how visitors use our website and improve its performance.	Consent, given through our cookie controls.

Targeted business to business marketing

We may send a small number of relevant, individually reviewed marketing emails to people acting in a professional capacity at companies, limited liability partnerships and other corporate bodies. We do not treat publicly available details as consent. Instead, where PECR does not require consent, we rely on legitimate interests after completing a purpose, necessity and balancing assessment.

Our safeguards for this activity are:

we target only corporate subscribers and check the organisation’s legal status;
we do not send unsolicited electronic marketing to sole traders, ordinary partnerships or other individual subscribers unless valid consent or another PECR exception applies;
we select contacts whose professional responsibilities make the approach reasonably relevant and initially contact only one suitable person at an organisation;
we use limited professional information and verify it against current public business sources;
we check existing customers, active opportunities, prior correspondence and suppression records before contact;
we identify Tech Savvy Solutions clearly and use a valid reply address;
every marketing email provides a simple way to object or opt out;
we do not use tracking pixels in outbound prospecting emails;
we use small, quality-controlled batches and limit follow-up activity; and
we stop direct marketing promptly when anyone objects.

Your right to object to direct marketing

You have an absolute right to object at any time to our use of your personal information for direct marketing. Reply to any marketing email with your request or email dpc@tsavvy.co.uk. We will stop marketing and retain only the minimum suppression information needed to make sure we respect your choice in future.

When we give you this information

If we collect personal information directly from you, we make privacy information available when we collect it. If we obtain professional contact information from another source, including a public source, we provide access to this policy within a reasonable period and no later than one month. If we contact you first, we provide it at the time of that first communication.

Cookies and website technologies

Our website uses the following categories of technology:

Essential technologies. These are needed to deliver and protect the site. They include Cloudflare services and Cloudflare Turnstile for security and spam prevention. They do not require consent where they are strictly necessary.
Analytics cookies. We use Google Analytics 4 to understand website use only after you choose to accept analytics. Google Analytics does not load before that choice. We use available privacy controls, including IP-related protections.
Hosting and form delivery. Vercel hosts the website, Cloudflare provides DNS and security services, and Resend delivers contact-form messages. These providers may process technical or contact data only as needed to provide their services.

You can change your analytics choice at any time using the Cookie settings control on our website. You can also clear cookies through your browser. Withdrawing consent stops future analytics collection but does not affect processing that took place before withdrawal.

We may share personal information, only where necessary, with:

Microsoft, which provides our business email and Microsoft 365 services;
Google, for consent-based website analytics;
Cloudflare, Vercel and Resend for website delivery, hosting, security and contact-form delivery;
professional advisers, insurers, auditors and payment or accounting providers;
carefully selected service providers that process information on our instructions under appropriate contractual safeguards;
law-enforcement bodies, regulators, courts or other parties where disclosure is required or permitted by law; and
a purchaser, investor or adviser in connection with a genuine business sale, merger or restructuring, subject to confidentiality and data-protection safeguards.

We do not sell personal information.

International transfers

Some service providers may process personal information outside the United Kingdom. Where this happens, we use an applicable UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved contractual clauses. You may contact us for more information about the relevant safeguard.

How long we keep information

We keep personal information only for as long as it is reasonably needed for the purpose described, to meet legal duties, or to establish, exercise or defend legal claims. We review records and delete or anonymise information that is no longer required. Our standard approach is:

Record	Standard retention approach
Prospect research with no meaningful engagement	Review and normally delete or anonymise within 12 months of the last research or outreach activity.
Business enquiries and correspondence	Normally up to 24 months after the last meaningful interaction, unless a contract begins or a longer period is justified.
Customer, supplier, billing and contractual records	Normally six years after the relationship or relevant transaction ends, subject to legal, tax, contractual and claims requirements.
Marketing suppression records	Keep the minimum identifier and objection record for as long as needed to prevent unwanted future marketing. This may be indefinite while the risk of re-contact remains.
Website security logs	Normally up to 90 days, unless needed for an active investigation, security incident or legal claim.
Analytics data	Keep for the period configured in Google Analytics and review the setting at least annually; delete or aggregate data when it is no longer needed.

How we protect information

We use proportionate technical and organisational measures designed to protect personal information against loss, misuse, unauthorised access, alteration and disclosure. These include access controls, account security, staff procedures, security monitoring, backup and recovery arrangements, supplier due diligence and incident management. No system is completely secure, but we review our safeguards and act on identified risks.

Your data protection rights

Depending on the circumstances, you may have the right to:

ask for access to your personal information;
ask us to correct inaccurate or incomplete information;
ask us to erase information where there is no good reason for us to continue using it;
ask us to restrict how we use information;
object to processing based on legitimate interests;
object at any time to direct marketing;
receive certain information in a portable format; and
withdraw consent where we rely on consent, without affecting earlier lawful processing.

To exercise a right, email dpc@tsavvy.co.uk or write to us at the address above. We may need to confirm your identity. We normally respond within one month and do not charge a fee unless a request is manifestly unfounded or excessive.

Automated decision making

We do not make decisions about people based solely on automated processing that produce legal or similarly significant effects. We may use filters or tools to organise business information, but a person reviews prospect eligibility and outreach decisions.

Complaints

Please contact us first so we can try to resolve your concern. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority.

www.ico.org.uk | Telephone 0303 123 1113

Changes to this policy

We review this policy when our activities, suppliers or legal obligations change. We will publish the current version on our website and show its effective date. If a change materially affects how we use existing personal information, we will take reasonable steps to bring it to the attention of affected people before the new use begins.