Privacy policy.

Who we are.

Tautiss (“we”, “us”, “our”) is a technology integration company based in the United Kingdom, providing smart home automation, home cinema and AV, networking, IT support, CCTV and security, electrical work and marine systems to residential, commercial and marine clients.

We are committed to protecting your personal data and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What data we collect.

When you use our website or contact us, we may collect the following personal data:

• Contact form submissions: your name, email address, phone number, service interest, and message content
• Technical data: your IP address, browser type, and operating system (collected automatically by our web server)
• Cookie data: a session cookie used to prevent spam on our contact form (see section 6)

Through this website we do not collect any special category data (such as health, ethnicity, or biometric data). We do not use analytics tracking, advertising cookies, or any third-party tracking tools.

How we use your data.

• To respond to your enquiry: when you submit our contact form, we use your name, email, and message to reply to you about your project or question
• To provide our services: if you become a client, we use your contact details to deliver and manage the services you have requested
• To prevent spam: we use a session cookie and honeypot field to protect our contact form from automated spam submissions
• Server security: our web server automatically logs IP addresses for security and troubleshooting purposes

Clients and the systems we look after.

Most of this policy is about our website. This section is about what happens when you become a client.

• Our two roles: for our own business records — your contact details, quotations, invoices and project notes — we are the controller. When we administer systems or accounts on your behalf, such as Microsoft 365 tenants, computers under a support agreement, networks or servers, we act as your processor on your instructions. In that case you are the controller, and the processing terms in your contract apply — Schedule A of the IT Support Agreement for managed IT, or Schedule 3 of our Terms of Business for project work.
• What we hold about clients: names, business and billing addresses, email addresses and telephone numbers; quotations, contracts, invoices and payment records; site surveys, drawings, asset registers and as-built documentation; support tickets and correspondence; and credentials for systems we manage, held in an encrypted vault.
• What our support software collects: where you have a support agreement, we install a monitoring agent on the computers listed in that agreement. It collects hardware and software inventory, serial numbers, update and antivirus status, disk, memory and processor health, system error logs, the account name logged in, and when the machine last checked in. It also allows our named engineers to reach the machine, with administrator access, in order to support it. What we can and cannot do with that access is set out in full in Section 9 and clause 10.8 of your IT Support Agreement, and in the notice we provide for anyone who uses the computers.
• Staff and other users: where anyone else uses computers we support — a client's staff or family — the client is responsible for telling them about the software, and for staff the client is the controller of their information. We provide a plain-English notice for that purpose.
• CCTV and door entry: where we install surveillance systems, the operator — normally you — is the controller of the footage, with your own obligations including signage and, where applicable, your own ICO registration. We do not routinely hold or view client footage. Where a support agreement requires us to reach a recorder to maintain it, we do so as your processor and only for that purpose.
• Special category data: we do not seek it out. We recognise that while supporting mailboxes, files and systems such information may incidentally be visible to us. We do not extract, use or retain it, and our engineers are bound by confidentiality.
• Who else is involved: for managed support, two suppliers help us — the platform we use for monitoring and remote support, which may process data in the UK, the EU, the United States and, for some services, other countries, always under UK-approved safeguards, and an encrypted vault in which we hold credentials for the systems we manage, hosted in the EU. Both are named in the IT Support Agreement, and we give clients 30 days' notice before adding another. Where you buy Microsoft 365 in your own name, Microsoft is your own provider under your own agreement with them, not ours. The suppliers involved in project work are named in our Terms of Business.
• How long we keep it: support and monitoring records for 24 months. Client contracts, invoices and project documentation for 6 years after the relationship ends, as required for tax and legal purposes. Credentials are deleted at handover when an agreement ends.

Legal basis for processing.

Under the UK GDPR, we process your personal data on the following lawful bases:

• Legitimate interest (Article 6(1)(f)): when you submit our contact form, we process your details in order to respond to the enquiry you have sent us. You can object at any time by emailing us.
• Legitimate interest (Article 6(1)(f)): we have a legitimate interest in maintaining the security of our website and preventing spam.
• Contract (Article 6(1)(b)): if you become a client, we process your data as necessary to fulfil our contract with you.

How we store and protect your data.

Your contact form data is sent directly to our email inbox. We do not store form submissions in a database on our website. Your data is protected by:

• SSL/TLS encryption on all pages (HTTPS)
• Secure email hosting via Microsoft 365
• Access controls limiting who can view enquiries

Retention period: we retain contact form enquiries in our email system for up to 12 months after your last communication with us, unless you become a client, in which case we retain your data for the duration of our business relationship plus 6 years (as required for tax and legal purposes). You can request deletion at any time.

Cookies.

Our website uses only one cookie:

• PHPSESSID — a session cookie set when you submit the contact form. It is used solely to prevent spam (rate limiting). It expires when you close your browser. It does not track you or collect any personal information.

We do not use analytics cookies, advertising cookies, or any third-party tracking cookies — no Google Analytics, no Facebook Pixel, no similar tools. Because our only cookie is strictly necessary for the contact form’s spam protection, it falls under the “strictly necessary” exemption in the Privacy and Electronic Communications Regulations (PECR), which is why you won’t see a cookie banner on this site.

Third-party sharing.

We do not sell, trade, or rent your personal data to anyone. Your data may be shared with:

• Our hosting provider: who stores the website files on their servers (located in the UK/EU)
• Microsoft 365: where our email is hosted and where your contact form submission is delivered
• Google Fonts: our website loads fonts from Google’s servers, which may log your IP address (see Google’s Privacy Policy)

We do not transfer your data outside the UK or EU unless one of the above third parties, or a supplier we use for managed support, processes data in other jurisdictions under appropriate safeguards.

Your rights.

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access: you can request a copy of the personal data we hold about you
• Right to rectification: you can ask us to correct any inaccurate data
• Right to erasure: you can ask us to delete your data (the “right to be forgotten”)
• Right to restrict processing: you can ask us to limit how we use your data
• Right to data portability: you can request your data in a structured, machine-readable format
• Right to object: you can object to our processing of your data
• Right to withdraw consent: where we rely on consent, you can withdraw it at any time

To exercise any of these rights, please email us at privacy@tautiss.co.uk. We will respond within one month.

Children’s privacy.

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us and we will delete it promptly.

Changes to this policy.

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated “last updated” date. We encourage you to review this page periodically.

Complaints.

If you are unhappy with how we handle your data, please contact us first at privacy@tautiss.co.uk — we would rather put things right ourselves. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at any time: ico.org.uk · 0303 123 1113.