Privacy Policy

1. Who We Are

This privacy notice explains how Haj Tech collects, uses and protects your personal data. Haj Tech is a trading name operated by an individual sole operator based in Lancashire, UK. For any privacy question, contact [email protected].

We are committed to handling your personal data responsibly, in line with UK GDPR (the UK General Data Protection Regulation) and the Data Protection Act 2018. We collect only what we need to respond to your enquiry and deliver any service you ask for.

2. What Personal Data We Collect

Contact form and email enquiries

When you submit our contact form or email us directly, we collect: your name, your website address, your email address, and the content of your message (optional).

Service delivery

When delivering security assessments, we may process information about your business systems (domain names, IP addresses, software versions, configuration details) to the extent necessary to perform the service. Where you provide contact details for members of your team, we process those details solely for service delivery purposes.

Website usage

Our hosting provider (Netlify) and CDN provider (Cloudflare) may collect standard server logs including IP addresses, browser type and page requests as part of normal hosting operations. We do not use Google Analytics or any other tracking cookies. See our Cookies page for details.

3. Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR:

• Contract — processing your data is necessary to perform the service you have ordered, or to take steps at your request before entering into a contract.
• Legitimate interests — responding to enquiries submitted via our contact form, where the enquiry relates to a potential business relationship.
• Consent — where we ask for your consent before sending any marketing communications (we will ask explicitly and you may withdraw at any time).

4. How We Use Your Data

We use your personal data to:

• respond to your enquiry or provide the service you have requested;
• send you information about your order, including delivery of reports;
• send marketing communications, only where you have given explicit consent;
• comply with our legal obligations.

We will never sell, rent or share your personal data with third parties for their own marketing purposes.

5. Third-Party Processors and Sub-Processors

We use the following third-party services to operate our business. Each is engaged under a data processing agreement and (where data is transferred outside the UK) either benefits from an adequacy decision or relies on standard contractual clauses (SCCs) approved by the UK ICO.

• Netlify — website hosting and form processing. Based in the United States (UK-to-US transfer covered by SCCs).
• Cloudflare — CDN, DNS and DDoS protection. Based in the United States (SCCs).

6. Retention Periods

We retain your data for no longer than necessary:

• Enquiry data (contact form, email) — retained for up to 2 years after last contact, then securely deleted.
• Contract and order data — retained for 6 years from the date of the transaction to comply with financial record-keeping obligations.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to ask us to correct inaccurate or incomplete data.
• Right to erasure — to ask us to delete your data (subject to legal retention requirements).
• Right to restriction — to ask us to limit how we use your data in certain circumstances.
• Right to data portability — to receive your data in a structured, commonly used format where processing is based on consent or contract.
• Right to object — to object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month.

8. Right to Complain to the ICO

If you believe we have not handled your personal data appropriately, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection supervisory authority:

We would welcome the opportunity to resolve any concern directly before you contact the ICO — please reach out to us first.

9. Changes to This Policy

We may update this privacy notice from time to time. The current version will always be available at hajtech.uk/privacy. The date at the top of this page reflects the most recent update.

10. Contact Us