Privacy Policy
Telo Technology Limited ("we", "us", "our") is committed to protecting personal data. This policy applies to personal data collected through this website, our client and partner portals, and related communication channels, and to the services we provide to our clients.
1. Data Controller
Data controller: Telo Technology Limited, registered in England and Wales (Company No. 11560747). For data protection requests, please use our contact page and mark your message as "Data Protection Request".
2. Data We Collect
- Contact details you submit (for example: name, email, phone, company).
- Project inquiry details (for example: services requested, message content, timeline).
- Technical/usage data (for example: IP address, browser type, pages visited, timestamps).
- Cookie preferences and consent records.
- Client account and portal data (see Clients and the Client Portal).
- Billing records, such as invoices and subscription status. Card details are handled by our payment provider and are never seen or stored by us.
- Publicly available business contact details (see Business Contacts).
3. How We Use Data
- To respond to enquiries and provide requested information or proposals.
- To deliver and support our services.
- To improve website performance, security, and usability.
- To maintain legal, accounting, and compliance records.
4. Lawful Bases (UK GDPR)
- Legitimate interests: managing enquiries, service quality, site and portal security, and contacting businesses that may benefit from our services (business-to-business outreach).
- Contract: taking steps before entering a contract, performing our services, providing client portal accounts, and billing.
- Legal obligation: record-keeping and compliance duties.
- Consent: optional analytics cookies.
5. Sharing and Processors
We share data only where necessary with trusted service providers acting on our behalf under contractual controls. We may also share data where required by law or to establish, exercise, or defend legal claims. We do not sell personal data. Our main providers are:
- Akamai (Linode): hosting, databases and file storage (London and Frankfurt data centres).
- Stripe: card payments, subscriptions and invoices. Stripe processes card details directly; we never receive full card numbers.
- Mailgun (EU region): delivery of account, billing and service emails.
- Sentry: error monitoring, so we can find and fix problems quickly.
- Cloudflare: bot protection (Turnstile) on sign-in and contact forms.
- Microsoft: email, and sign-in for our own staff.
- OpenAI: AI tools we use internally. We do not use client portal data to train AI models.
- Google Analytics: website analytics, only with your consent.
6. International Transfers
Some providers may process data outside the UK, including in the European Economic Area and the United States. Where this happens, we rely on UK adequacy regulations (including the UK-US Data Bridge where the provider is certified) or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.
7. Data Retention
- Enquiry data: retained only as long as needed for communication and business follow-up.
- Contract/project records: retained for operational and legal/accounting requirements.
- Technical logs: retained for security and troubleshooting for a limited period.
- Consent records: retained to demonstrate compliance with consent choices.
- Client account and project data: for the length of the contract, then up to 12 months after it ends (so we can hand over or restore work), unless you ask us to delete it sooner.
- Invoices and billing records: 6 years, as required by UK accounting and tax law.
- Business contact data: up to 24 months from when it was collected, or sooner if you ask us to remove it.
- Job applications: see Job Applicants below.
Job Applicants
If you apply for a role through our careers page, we collect the details you give us: your name, email address, phone number, any profile or portfolio links, your cover note and your CV, together with the date you applied and the IP address it was sent from (used only to prevent abuse).
- Why: to assess your application for the role you applied for, or similar roles for a general application, and to contact you about it.
- Lawful basis: taking steps at your request before entering into a contract, and our legitimate interest in recruiting. You confirm you agree to this when you submit the form.
- Who sees it: only the people at Telo Technology involved in hiring. It is stored in our own internal system and is not shared with recruiters or other third parties.
- How long we keep it: while your application is being considered. Once a decision is made, it is permanently deleted, CV included, 180 days later. If you are hired, the details you need for employment move to your employee records.
- Your rights: you can ask to see, correct or delete your application at any time, or withdraw it, using our contact page.
Clients and the Client Portal
When you become a client, we create an account for you and your colleagues on our client portal. We process:
- Account details: names, email addresses, phone numbers, job roles, and the business you represent.
- Sign-in and security data: hashed passwords, two-factor authentication settings, sign-in times and IP addresses.
- Service data: change requests, messages, files you upload, approvals, quotes, and your services agreement.
- Billing data: your plan, subscription status, invoices and payment history. Card details are entered on Stripe's secure pages and never reach our systems.
We use this to provide and support the services in your agreement, to bill you, to keep your account secure, and to send you service and billing emails (for example quotes, payment receipts, or a failed-payment notice). The lawful basis is the performance of our contract with your business, our legal obligations for financial records, and our legitimate interest in keeping the portal secure. Where we host or manage a website for you, any personal data of your own customers on that website is processed by us as your processor, on your instructions and under our services agreement.
Business Contacts
We may use business contact details that are publicly available to contact businesses about our services. We rely on our legitimate interest in business-to-business marketing and follow UK electronic marketing rules. If you would prefer not to hear from us, tell us via our contact page or reply to our message, and we will stop and remove your details.
8. Cookies
We use essential cookies required for basic site functionality and preference storage. Optional analytics cookies (Google Analytics) are only activated if you consent via our cookie banner.
- Essential cookies: required for core site operation and cookie preferences.
- Analytics cookies: help us understand usage and improve the site.
You can change your cookie preferences at any time using the "Cookie settings" control shown on the website.
9. Your Rights
Subject to applicable law, you may have the right to:
- request access to your personal data;
- request correction of inaccurate data;
- request erasure of data in certain circumstances;
- request restriction of processing;
- object to processing based on legitimate interests;
- request data portability where applicable;
- withdraw consent where processing relies on consent.
10. Security
We use appropriate technical and organizational controls to reduce the risk of unauthorized access, disclosure, or misuse of personal data. No internet transmission or storage method is completely risk-free.
11. Children
This website is not intended for children under 13, and we do not knowingly collect personal data from children under 13.
12. Policy Updates
We may update this policy from time to time. The latest version will always be published on this page.
13. Contact and Complaints
For privacy questions or to exercise your rights, contact us via the contact page. If you are dissatisfied with our response, you may raise a complaint with the UK Information Commissioner's Office (ICO).