Privacy Policy
Last updated: 5 August 2026 | Version 2.0 (Compliance Audit)
1. Introduction
GLS Tech Limited ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal information when you contact us via our website.
2. Information We Collect
We collect personal data through the following methods:
Contact Form
When you use our website contact form, we collect:
- Full name
- Email address
- Phone number
- Message content
Other Methods
We may also collect personal data when you:
- Contact us by email or phone
- Visit our premises
- Request a quote or service
Cookies and Analytics
Our website uses Google Analytics to understand how visitors use our site. This involves:
- Tracking cookies stored on your device
- Collection of anonymized usage data (pages visited, time on site, etc.)
- Your IP address (partially anonymized)
Note: Google Analytics data is not personally identifiable on its own but may be combined with other information. You can opt out using the Google Analytics Opt-Out Browser Add-on.
3. Legal Basis for Processing (UK GDPR Article 6)
We process your personal data under the following legal bases:
- Legitimate Interest (Article 6(1)(f)): We process contact information to respond to your enquiry and enter into a service contract with you. We have assessed that our interest in providing customer service outweighs any privacy impact on you.
- Contract (Article 6(1)(b)): If you proceed to use our services, we process data necessary to fulfill our contractual obligations.
- Legal Obligation (Article 6(1)(c)): We retain business records for tax and accounting purposes as required by UK law.
4. How We Use Your Information
We use your contact information for the following purposes:
- Respond to your enquiry
- Provide the services you request
- Keep records of our communication (business record keeping)
- Follow up if you don't respond (legitimate business interest)
- Improve our website and services (aggregate/anonymized only)
Important: We do not sell, rent, share, or rent your personal information to third parties for marketing purposes. We never use your data for automated decision-making or profiling.
5. Data Retention
We retain personal data only as long as necessary for the purposes it was collected. Specific retention periods:
- Enquiry data (no purchase): 12 months from last contact, then deleted unless there's an ongoing relationship
- Customer data (active service): Duration of service plus 3 years (for business accounting purposes)
- Invoice/payment records: 6 years (UK tax law requirement)
- Disputes or complaints: Retained for 3 years from resolution date
- Backup/archived data: Automatically deleted within 90 days of primary deletion (unless legal hold applies)
You can request deletion at any time (subject to legal retention obligations); we will comply within 30 days unless a legal basis requires retention.
6. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of Access (Article 15): Request a copy of all data we hold about you. We will respond within 30 days.
- Right to Rectification (Article 16): Request correction of inaccurate or incomplete data.
- Right to Erasure (Article 17): Request deletion of your data (subject to legal retention obligations).
- Right to Data Portability (Article 20): Request your data in a portable, machine-readable format.
- Right to Object (Article 21): Object to processing based on legitimate interest. We will stop processing unless we have a compelling legal reason.
- Right to Restrict Processing (Article 18): Request we limit how we use your data while a dispute is resolved.
Important: We do not obtain explicit consent for contact form processing—we rely on legitimate interest. Therefore, you cannot "withdraw consent" but you can object to processing or request deletion.
To exercise any rights, contact us using the details in Section 9 below. We will respond within 30 days (extendable to 90 days for complex requests).
7. Security Measures
We implement appropriate technical and organizational security measures to protect your personal data:
- Encryption in Transit: All contact form submissions use HTTPS (TLS encryption)
- Access Controls: Only authorized staff can access customer data
- Secure Storage: Data is stored on secured servers with restricted access
- Backups: Encrypted backups are maintained separately from primary systems
- Monitoring: We monitor for unauthorized access attempts
Limitation: While we use industry-standard security practices, no method of internet transmission is 100% secure. You use our services at your own risk. We are not liable for unauthorized access due to factors beyond our control (e.g., compromised user credentials).
Data Breach Notification: If we experience a data breach affecting your data, we will notify you and the ICO within 72 hours as required by law.
8. Third-Party Data Processors
We use third-party service providers who process personal data on our behalf:
Web3Forms (Contact Form Processing)
- Purpose: Receives and forwards your contact form submissions to our email
- Data Shared: Name, email, phone, message
- Data Processing Agreement: Web3Forms operates under a standard Data Processing Agreement (UK GDPR Article 28 compliant)
- Privacy Policy: web3forms.com/privacy
- Data Location: EU-based infrastructure (compliant with UK data protection law)
Google Analytics
Note: These processors are "Data Processors" under UK GDPR and are contractually bound to protect your data to the same standard we do.
9. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in law or our practices. We will notify you of any significant changes by updating the "Last updated" date above and posting the new version on this page. Continued use of our services after changes constitutes acceptance of the updated policy.
10. Contact Us
If you have questions about this Privacy Policy or our privacy practices, please contact us:
11. Data Subject Complaints & Disputes
If you believe we have violated your data protection rights:
- Contact us first: Use the details in Section 10. We will investigate and respond within 30 days.
- File a complaint with the ICO: If you're unsatisfied with our response, you can lodge a complaint with the Information Commissioner's Office (ICO), the independent UK regulator for data protection.
ICO Contact:
Legal Action: You also have the right to pursue legal action against us in UK courts for breach of data protection law.
12. Data Protection Officer Designation
As a small business, we are not required to appoint a Data Protection Officer (DPO) under UK GDPR. However, we take data protection seriously and have designated a privacy contact for all data protection enquiries (see Section 10).
.png){kind=small}