General Privacy Notice

Purpose

This Notice sets out how Tayside Technical Services collects and processes personal data in order to provide you with our products and services. This Notice complies with the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

We may process types of personal data as listed below:

• Identity and contact information
• Financial and transaction information
• Technical and usage information
• Marketing and communications

Special Category Data

For the avoidance of doubt, we do not collect special category data.

Who are we?

We are Tayside Technical Services, a company registered in the United Kingdom. Any reference in this Notice to “we” “our”, “us” or “TTS” means Tayside Technical Services and our affiliates. TTS is a "controller”, which means that we are responsible for deciding how we hold and use personal information about you.

If you are providing personal information about, or on behalf of, another person, you must make sure that you tell them what you are providing to us, why you are providing it and make them aware of this Notice. Please do not provide any personal information to us unless you have the right to do so.

This Notice governs our practices in relation to the personal data collected and processed by TTS only. If you are receiving our services through your employer, we refer to your employer as our “Direct Client”. You may also receive services through a third party that we refer to as a “Partner” who, as an independent controller, may distribute TTS products.

It is important that you read this Notice and that you are fully aware of how and why we are using your data. This Notice does not govern the practices of third parties which TTS does not own or control such as, but not limited to, our Direct Clients and/or Partners.

Legal Basis of Processing

We will only collect and process personal data if we have a lawful basis to do so. We will collect and process your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you;
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; and
• Where we need to comply with a legal obligation.

Generally, we do not rely on consent as a legal basis for processing your personal data although we may ask for consent, where required, to send marketing communications to you via email or text message. Where we have relied upon your consent for any reason, you have the right to withdraw consent at any time. You can withdraw it by emailing us.

How we collect your personal data

We generally collect your personal data in order to provide you with products and services. We may collect your personal data in the following ways:

• At the time of engagement in order to facilitate any future orders.
• When you place orders with us for our services (e.g., a Sentinel Pilot).
• To provide you with access to our client portal and AI-driven services.
• When you submit source documents for analysis by our systems.
• For ongoing customer administration and billing.
• When you complete any form on our website or contact us to provide feedback.
• When you visit our websites, in accordance with our Cookie Policy.
• For advertising measurement and optimisation.

For the avoidance of doubt, whilst we provide analytical reports, we do not use any type of automated decision-making such as profiling as defined in data protection laws.

The Sentinel Service

In order to produce our services, such as the Sentinel pipeline analysis reports, we require the collection and processing of client-provided data, which may include business contact information and sales data. This data is processed by our secure, automated systems to identify patterns, qualify leads, and generate actionable reports.

We keep a copy of your source data and the generated reports on file to:

• Provide you with the agreed-upon reports and services.
• Enable continuous improvement and re-calibration of your Ideal Customer Profile (ICP).
• Allow you to track performance and your operational improvements over time.
• To enable TTS engineers to provide support and system tuning.

Once reports are created and shared, your data may be accessible to authorised users within your organisation. We can remove your data from our systems upon request, but we may not be able to recall or delete copies already in existence within your own environment.

Who do we share your information with?

We may have to share your personal data with third parties for processing or sub-processing purposes in order to provide you with our services. We do not sell any personal data we collect.

We may share your personal data with third parties, some of whom may be located outside the UK/EEA, as follows:

• Google Cloud Platform & Google AI: Our infrastructure and AI models run on Google Cloud. Data is processed securely to provide our services. We do not permit Google to use your data for training their general models.
• Crisp IM SARL: To provide integrated chat support.
• Other Suppliers: Who provide essential IT, database, and system administration services.

Where personal data is transferred outside the UK/EEA, we take all reasonably necessary steps to ensure that your data is treated securely and in accordance with this Notice.

Advertising Measurement

When you fill out our forms, we may share a hashed (scrambled and unreadable) version of your email address with advertising platforms like Google Ads to help us understand how well our advertisements work. We do this to see which ads bring us customers and to improve our advertising. You will be given a choice of whether we use your data for this purpose when completing our online forms, and you may change your mind at any time by contacting us.

Data retention and anonymisation

We will only retain your personal data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Typically, client operational data is retained for the duration of the service contract and for a reasonable period thereafter.

Your legal rights

Under data protection law, you have rights including:

• Request access to your personal data.
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data.
• Object to processing of your personal data.
• Request restriction of processing of your personal data.
• Request the transfer of your personal data to you or to a third party.
• Withdraw consent at any time where we are relying on consent to process your personal data.

You may exercise these rights by contacting our Data Protection Officer at: scott.simmons@taysidetech.com.

How you can contact us and your right to complain

If you have any questions or concerns about this Notice please contact us at scott.simmons@taysidetech.com.

You may also wish to raise any concerns with the relevant data protection supervisory authority. The UK Information Commissioner’s Office (ICO) is the relevant supervisory authority for Tayside Technical Services. The ICO can be contacted at casework@ico.org.uk.

We may change this Notice from time to time so please check regularly to keep informed of updates. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.