Privacy Policy

1. Who We Are

This privacy notice explains how Haj Tech collects, uses and protects your personal data.

We are committed to handling your personal data responsibly, in line with UK GDPR (the UK General Data Protection Regulation) and the Data Protection Act 2018.

2. What Personal Data We Collect

Contact form and email enquiries

When you submit our contact form or email us directly, we collect: your name, business name (optional), email address, phone number (optional), and the content of your message.

Service delivery

When delivering security assessments or automation services, we may process information about your business systems (domain names, IP addresses, software versions, configuration details) to the extent necessary to perform the service. Where you provide contact details for members of your team, we process those details solely for service delivery purposes.

Client Communication Autopilot — end-client data

Where you subscribe to our Client Communication Autopilot service, you provide us with the contact details of your clients (names and phone numbers) so that we can send automated SMS messages on your behalf. In this context, Haj Tech acts as a data processor on your behalf: you are the data controller for your clients’ data, and we process it only according to your instructions. A data processing agreement is provided to Autopilot customers.

Website usage

Our hosting provider (Netlify) and CDN provider (Cloudflare) may collect standard server logs including IP addresses, browser type and page requests as part of normal hosting operations. We do not use Google Analytics or any other tracking cookies. See our Cookies page for details.

3. Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR:

• Contract — processing your data is necessary to perform the service you have ordered, or to take steps at your request before entering into a contract.
• Legitimate interests — responding to enquiries submitted via our contact form, where the enquiry relates to a potential business relationship.
• Consent — where we ask for your consent before sending any marketing communications (we will ask explicitly and you may withdraw at any time).

4. How We Use Your Data

We use your personal data to:

• respond to your enquiry or provide the service you have requested;
• send you information about your order, including delivery of reports or automation setups;
• send marketing communications, only where you have given explicit consent;
• comply with our legal obligations.

We will never sell, rent or share your personal data with third parties for their own marketing purposes.

5. Third-Party Processors and Sub-Processors

We use the following third-party services to operate our business. Each is engaged under a data processing agreement and (where data is transferred outside the UK) either benefits from an adequacy decision or relies on standard contractual clauses (SCCs) approved by the UK ICO.

• Netlify — website hosting and form processing. Based in the United States (UK-to-US transfer covered by SCCs).
• Cloudflare — CDN, DNS and DDoS protection. Based in the United States (SCCs).
• Twilio — SMS delivery for the Client Communication Autopilot. Based in the United States (SCCs). Used only where you subscribe to the Autopilot service.
• Stripe — payment processing. Stripe operates under its own PCI-DSS-compliant infrastructure. Based in the United States (SCCs).
• SendGrid (Twilio) — transactional email delivery. Based in the United States (SCCs). Used for service delivery communications only.
• DigitalOcean — cloud server hosting for RemindFlow and automation infrastructure. UK/EU region selected where available.

6. Retention Periods

We retain your data for no longer than necessary:

• Enquiry data (contact form, email) — retained for up to 2 years after last contact, then securely deleted.
• Contract and order data — retained for 6 years from the date of the transaction to comply with financial record-keeping obligations.
• Autopilot end-client data — deleted within 30 days of your subscription ending, or sooner on your request.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to ask us to correct inaccurate or incomplete data.
• Right to erasure — to ask us to delete your data (subject to legal retention requirements).
• Right to restriction — to ask us to limit how we use your data in certain circumstances.
• Right to data portability — to receive your data in a structured, commonly used format where processing is based on consent or contract.
• Right to object — to object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month.

8. Right to Complain to the ICO

If you believe we have not handled your personal data appropriately, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection supervisory authority:

We would welcome the opportunity to resolve any concern directly before you contact the ICO — please reach out to us first.

9. Changes to This Policy

We may update this privacy notice from time to time. The current version will always be available at hajtech.uk/privacy. The date at the top of this page reflects the most recent update.

10. Contact Us