Privacy Policy

While you can browse most of our website anonymously, we collect personal data when you interact with our site features:

Contact Form

When you submit an enquiry through our contact form, we collect the following information:

• Name (mandatory)
• Email address (mandatory)
• Organisation (optional)
• Subject (optional)
• Message (optional)

We process this data on the basis of our legitimate interests to respond to your enquiries and provide business information. You are not required to provide optional fields, and omitting them will not affect our ability to respond to you.

We will not use the details you provide through the contact form to send you marketing unless you separately opt in to our newsletter.

User Account Registration

If you register for an account on our website, we collect:

• First name
• Last name
• Email address

We process this data on the basis of contractual obligation: this information is necessary to create and manage your account and provide you with access to our tools. Your account data is retained for as long as your account remains active, and for 12 months following account deletion, as set out in section 06.

Newsletter Subscription

If you opt in to receive our newsletter or marketing updates, whether at the point of account registration or separately, we will collect your email address. We process this data based strictly on your explicit consent. You can withdraw your consent and unsubscribe at any time using the unsubscribe link at the bottom of any newsletter email, or by contacting us directly.

If you unsubscribe, we keep a record of your email address on a suppression list so that we can honour your request and avoid contacting you again.

Our website does not use tracking cookies, web beacons, marketing pixels, or third-party advertising trackers.

We do use a small number of strictly necessary cookies and similar technologies, which do not require your consent because the website cannot work without them. These keep you signed in to your account and help protect the site against automated attacks:

• Authentication cookies (names beginning "sb-", set by our authentication provider, Supabase) keep you signed in to your account. These are set only when you create an account or sign in.
• Anti-bot verification (Cloudflare Turnstile): a security check on our sign-in and registration forms that helps distinguish people from automated attacks. It runs only on those forms.
• Security cookies on our engineering tools (such as "__cf_bm", set by Cloudflare) protect the tools we serve via Cloudflare against automated abuse.

If we introduce performance or analytics cookies in the future, we will update this policy and provide a cookie consent banner.

Our website is hosted using Vercel, with certain interactive tools served via Cloudflare. Like almost all web hosting providers, the underlying server automatically logs basic technical request data (such as your IP address, browser type, language preferences, and time of access) purely to safely deliver the website to your browser, monitor site performance, and prevent malicious cyber-attacks such as DDoS attacks. This technical data is handled by our hosting infrastructure providers in accordance with strict security protocols and is not used by us for marketing or tracking purposes.

An IP address is personal data under UK data protection law. We process this information on the basis of our legitimate interests in keeping the website secure and available and retain it as set out in section 06.

We do not sell, rent, or trade your personal data. We only share your data with trusted third-party service providers who assist us in operating our website and conducting our business. These are:

• Email and communications providers (Google Workspace for correspondence, and Resend for transactional and newsletter email delivery)
• Authentication and database providers (Supabase) for hosting user account data and providing access to our tools
• Form processing services for receiving and routing contact form submissions
• Video hosting providers (YouTube, operated by Google) for videos embedded on our Media page. These are embedded in privacy-enhanced mode and only load, and only set cookies, if you choose to play the video.

All of these providers process personal data on our behalf and only on our instructions, under a written data processing agreement meeting the requirements of Article 28 of the UK GDPR, including obligations of confidentiality and security.

We may also share your personal data if required to do so by law, or in connection with a change of ownership or acquisition of all or part of our business, in which case the acquiring entity’s privacy policy would govern further use of your data.

Some of the providers listed in section 04 are based outside the United Kingdom, or store data outside it. Where your personal data is transferred outside the UK, we make sure an appropriate safeguard is in place. Depending on the provider, this will be one of the following:

• The country is covered by UK adequacy regulations
• The provider is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge)
• The transfer is governed by the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses

You can ask us which safeguard applies to a particular provider by contacting us at info@talos-technology.com.

We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. Our standard retention periods are:

• Contact form submissions: 2 years from the date of submission
• User account data: Duration of account, plus 12 months following account deletion
• Newsletter subscription: Until you unsubscribe, plus 12 months
• Unsubscribe records (suppression list): Kept indefinitely so that we can continue to honour your request
• Server logs, including IP addresses: 30 days

We may retain data for longer than the above periods where we reasonably believe there is a prospect of litigation, or where we are required to do so by law.

Our website and account registration are intended for users aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you are under 18, please do not use our website or submit any personal data to us. If we become aware that we have inadvertently collected data from a person under 18, we will delete it promptly.

We implement a range of technical and organisational measures to protect your personal data, including cybersecurity software, two-step authentication, and restricting access to personal data to a limited number of authorised personnel bound by confidentiality obligations.

However, please note that no transmission of data over the internet can be guaranteed to be completely secure. Any data you transmit to us is done at your own risk. If you believe your interaction with us is no longer secure, please contact us immediately.

Under UK data protection laws, you have the following rights in relation to your personal data:

• Right to be informed: to know what data we hold, why, and how long we keep it (this policy fulfils that obligation).
• Right of access: to receive a copy of the personal data we hold about you (a "subject access request").
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure: to request deletion of your data where there is no longer a lawful basis for us to hold it.
• Right to object: to stop or prevent us from processing your data in certain circumstances, including for direct marketing purposes.
• Right to restrict processing: to request that we limit how we use your data in certain circumstances.
• Right to data portability: to request that we provide your personal data in a structured, commonly used, machine-readable format, or transfer it to another controller. This right applies to data processed by automated means on the basis of consent or contract.
• Right to withdraw consent: where we rely on consent as our legal basis (e.g. newsletter), you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

We do not use your personal data for automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

To exercise any of these rights, please contact us at info@talos-technology.com. You will not ordinarily be charged a fee. We may need to verify your identity before processing your request. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection: www.ico.org.uk or 0303 123 1113. We would, however, appreciate the opportunity to address your concerns directly before you contact the ICO.

We keep this Privacy Policy under regular review. Any updates will be posted on this page with a revised Effective Date. Where a change is significant, we will take reasonable steps to bring it to your attention.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:

Email: info@talos-technology.com

Post: Talos Consulting Services Ltd, Unit 11, Penhill Industrial Estate, 18 Beaumont Road, Banbury, OX16 1RW, United Kingdom