Legal
Privacy Policy
What we collect, why we collect it, how long we keep it and what you can ask us to do about it.
The short version
We are a business to business consultancy. We collect personal data in two situations: when you send us an enquiry, and in the ordinary server logs that record visits to this website. We do not run advertising, we do not profile visitors, we do not sell data to anyone, and this website sets no tracking cookies of its own.
Who we are
Total Asset Consultancy Ltd is the data controller for the personal data described in this policy. That means we decide what is collected and why. We are registered in England and Wales under company number 17387209.
If you have any question about this policy or about data we hold, email ops@totalassetconsultancy.com and address it to the data protection contact.
What we collect and why
When you send an enquiry
There is no form on this website. Enquiries reach us by email, at ops@totalassetconsultancy.com, which is a mailbox hosted on Google Workspace. That means we hold only what you choose to write to us, which will usually include:
- Your name and job title
- Your company name
- Your email address and, if your signature carries one, a telephone number
- Whatever you tell us about your sites, your suppliers and what has prompted you to get in touch
We use this only to respond to you and to have a conversation about whether we can help. If that turns into work, the same details become part of our client records. We keep your message and our replies as a record of the correspondence.
When you simply visit the site
Our hosting provider records standard server log data, including IP address, browser type, the pages requested and the time of the request. This is generated automatically by the web server and is used for security and for diagnosing faults. We do not use it to identify individuals.
Our lawful basis
| What | Lawful basis |
|---|---|
| Responding to your enquiry | Legitimate interests: you have approached us about our services and expect a reply. If we are already in a contract or heading towards one, performance of a contract also applies. |
| Keeping records of correspondence | Legitimate interests: running the business, resolving disputes and demonstrating what was agreed. |
| Server logs | Legitimate interests: keeping the site available and secure. |
| Meeting accounting and tax obligations | Legal obligation. |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and we think it is not, because the data is limited, business related, and used only for the purpose you gave it to us for. You can object at any time, as set out below.
Who else sees your data
We keep the list short on purpose. Your data is shared only with the following, and only so that they can provide a service to us:
- Google (Google Workspace), who host our email. Google acts as our processor.
- IONOS, who host this website and generate the server logs.
- Our accountant, where a transaction has to be recorded.
- A regulator, court or law enforcement body, where we are legally required to disclose.
We do not sell personal data, we do not share it with advertisers or data brokers, and we do not pass client information between clients.
Transfers outside the UK
Google may process data outside the United Kingdom, including in the United States. Where that happens it is covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, which are the safeguards recognised under UK GDPR.
How long we keep it
- Enquiries that do not become work: up to 24 months from our last contact, then deleted.
- Client records and correspondence: for the life of the engagement and 6 years afterwards, which reflects the limitation period for contract claims.
- Financial records: 6 years after the end of the accounting period, as required by HMRC.
- Server logs: retained by our host on their standard cycle, typically a matter of weeks.
Client confidentiality
Confidentiality is central to how we work. We do not name clients on this website, in marketing material or in conversations with other clients, and information we see inside a client's business stays there. Where an engagement needs it, we sign a non-disclosure agreement before any information changes hands.
How we protect it
Access to enquiry data and client records is limited to the people who need it. Accounts are protected by strong passwords and multi-factor authentication. Data sits in Google Workspace rather than on local machines, and this website is served over an encrypted HTTPS connection.
No system is perfect. If a breach happens that is likely to risk your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours and tell you directly where required.
Cookies
This website sets no cookies at all and runs no analytics. There is no embedded form and there are no third-party scripts, so nothing is stored in your browser. The Cookie Policy sets this out in full.
Your rights
Under UK GDPR you can ask us to:
- Give you a copy of the personal data we hold about you
- Correct it if it is wrong or incomplete
- Delete it, where we have no continuing reason to keep it
- Restrict how we use it while a question about it is resolved
- Transfer it to you or another organisation in a portable format
- Stop using it, by objecting to processing based on legitimate interests
Email ops@totalassetconsultancy.com and we will respond within one month. There is no charge. We may ask you to confirm your identity first, so that we do not disclose someone else's data by mistake.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113
ico.org.uk/make-a-complaint
Changes to this policy
If we change how we handle personal data we will update this page and change the date at the top. Material changes affecting people we already hold data about will be notified directly.
Any questions about your data?
Email us and we will answer properly, not with a form letter.