Skip to content

Privacy policy

LAST UPDATED · 8 OCTOBER 2026

This policy explains what personal information Tamkoz Ltd (“we”, “us”) collects through this website, why, who we share it with, and what rights you have. We are the data controller, which means we decide how and why it’s used.

Tamkoz Ltd is a company registered in Scotland, company number SC829447. Our registered office is 8 Muirhouse Road, Motherwell, Scotland, ML1 2LS. Questions about your information? Email hello@tamkoz.com. We haven’t appointed a data protection officer, so that address reaches the people who handle your information.

The short version

  • We collect what you choose to send us (a quote request, a chat, a booking, a review) and the minimum technical detail needed to keep the site safe.
  • Analytics are off unless you say yes in the cookie banner, and you can change your mind any time.
  • We never sell your information, use it to advertise to you, or add you to a mailing list without your clear consent.
  • You can ask to see, correct or delete what we hold. Just email us.

What we collect, why, and our legal basis

The articles cited below are UK GDPR. The EU GDPR numbers them the same way, so where it also applies (see “Where you are”) the same bases are the ones we rely on.

We get this information from you directly, and, for security and analytics, from your browser. We don’t buy information about you or collect it from other sources.

Quote requests and messages

WHAT WE COLLECT
Your name, email, optional phone number, business details, what you need, budget and timing, and anything you write.
WHY
To reply, prepare a quote and keep a record of the conversation.
LEGAL BASIS
Steps you ask us to take before a contract (UK GDPR art. 6(1)(b)).
KEPT FOR
Up to 24 months if no work follows. If you become a client, see “Clients”.

Live chat

WHAT WE COLLECT
Your name, email, your messages, the page you started from, your browser type, and a keyed one-way hash of your IP address (never the address itself).
WHY
To answer you, link the conversation to your browser, and keep chat free of spam and abuse. A person at Tamkoz answers, not an AI.
LEGAL BASIS
Steps you ask us to take (art. 6(1)(b)); our legitimate interest in security and preventing abuse (art. 6(1)(f)).
KEPT FOR
Up to 24 months. Messages identified as spam: up to 90 days.

Bookings

WHAT WE COLLECT
What you enter into the Cal.com booking form (name, email, time, any notes). For paid sessions, payment is handled by Stripe and we never see your card details.
WHY
To run the call you booked.
LEGAL BASIS
Steps you ask us to take (art. 6(1)(b)).
KEPT FOR
Up to 24 months in our records unless you become a client. Cal.com and Stripe keep their own records under their own policies.

Clients

WHAT WE COLLECT
Contact details, what we agreed, invoices and payments.
WHY
To deliver what you’ve engaged us for, and to keep accounts and meet tax rules.
LEGAL BASIS
Contract (art. 6(1)(b)); legal obligation (art. 6(1)(c)).
KEPT FOR
While we work together, plus 6 years for accounting.

Client reviews and testimonials

WHAT WE COLLECT
A review you write through a private link we send you, or a testimonial you’ve given us another way (for example by email or in a Google review) and agreed we can publish: the text, your name, role, business, town, and how you’d like your name shown.
WHY
To publish your review or testimonial the way you chose, and to learn from private feedback.
LEGAL BASIS
Your consent to publish (art. 6(1)(a)), which you can withdraw at any time; our legitimate interest in learning from feedback (art. 6(1)(f)).
KEPT FOR
Published reviews and testimonials: until you ask us to take them down or we stop showing them. Private feedback: with your client record.

Spam and security checks

WHAT WE COLLECT
A keyed one-way hash of your IP address, when the form was loaded, a hidden form field, and the result of Cloudflare Turnstile’s check. We also check that your email’s domain can receive mail.
WHY
To stop bots and abuse of our forms and chat.
LEGAL BASIS
Our legitimate interest in keeping the site and inbox safe (art. 6(1)(f)).
KEPT FOR
With the message it relates to (see above).

Analytics (only if you accept)

WHAT WE COLLECT
Pages viewed, clicks, errors, your browser and device, approximate location, where you came from, an anonymous ID in a cookie, and anonymous session recordings with typing hidden. Vercel adds anonymous page counts and measurements of how quickly pages load on your device. We also remember, in your browser, the page and website that first brought you here, and send it to us only if you submit a form.
WHY
To see which pages help people and which lead to enquiries, and to find and fix errors.
LEGAL BASIS
Your consent (art. 6(1)(a) and PECR regulation 6), which you can withdraw at any time.
KEPT FOR
Analytics events: up to 12 months. Recordings: 30 days. The “how you found us” note: until you clear your browser or withdraw consent.

Your cookie choice

WHAT WE COLLECT
A random ID, what you chose and the date. No name, email or IP address.
WHY
To show that you gave or withdrew consent.
LEGAL BASIS
Our legitimate interest in being able to prove it (art. 6(1)(f), and art. 7(1)).
KEPT FOR
24 months.

Hosting and server logs

WHAT WE COLLECT
Technical details of each request (such as IP address and page) in our host’s logs. We also send PostHog a note that something happened, like “quote request saved”, never what it contained.
WHY
To keep the site running, secure and fast, and to find faults.
LEGAL BASIS
Our legitimate interest in running a reliable, secure site (art. 6(1)(f)).
KEPT FOR
A short period set by the provider.

We don’t use automated decision-making or profiling that has a legal or similarly significant effect on you.

Who we share it with

Only the service providers we need to run the site and our business, each bound by data protection terms:

  • Vercel: hosting and, if you accept analytics, anonymous page counts and page speed measurements.
  • Neon: our database, where enquiries, chats and reviews are stored.
  • Resend: sends our replies, confirmations and notifications, with its servers in the EU.
  • Google: Gmail, where we read the messages you send us and write our replies.
  • Cloudflare: spam protection (Turnstile) on our forms, our domain name records, and the forwarding that carries mail sent to our address through to our inbox.
  • PostHog: analytics and error reports, only if you accept analytics, with its servers in the EU.
  • Cal.com and Stripe: bookings and, for paid sessions, payments.
  • Telegram: instant alerts to us when someone writes to us, when we have them switched on.
  • Our accountants and other professional advisers, and public authorities where the law requires it.

Some providers process information outside the UK, for example in the United States. Where they do, the transfer is protected by UK adequacy regulations (including the UK–US data bridge for certified companies) or by appropriate safeguards such as the UK International Data Transfer Addendum. The EU, where PostHog stores our analytics, is covered by UK adequacy regulations. If you are in the EU or EEA, transfers of your information to us in the UK rely on the European Commission’s adequacy decision for the UK.

Cookies and similar technologies

We use a small number of strictly necessary cookies, and analytics only with your consent. Our cookie policy lists every one, what it does and how long it lasts.

Where you are

We work with clients around the world, so which law gives you your rights depends on where you are. Whichever it is, we would rather answer the request than argue about the threshold.

  • Anywhere: we are established in the UK, so the UK GDPR applies to everything we do with your information, and the rights below are available to you.
  • The EU or EEA: the EU GDPR also applies, because we offer our services to people in the EU. Your rights are the same as those below, and you can raise a concern with the data protection authority where you live as well as with the ICO.
  • The United States: state privacy laws may give you additional rights depending on where you live. Email us and we will handle your request as though they applied. We do not sell or share your personal information, and we do not use it for cross-context behavioural advertising.
  • Somewhere else: email us and we will apply the rights below to your request.

Your rights

You have the right to:

  • ask for a copy of the personal information we hold about you;
  • have anything inaccurate corrected, or incomplete information completed;
  • have your information deleted, or its use restricted, in the circumstances the law sets out;
  • object to us using your information on the basis of our legitimate interests;
  • receive information you gave us in a portable format; and
  • withdraw your consent whenever we rely on it, which doesn’t affect what we did before.

Email hello@tamkoz.com. We’ll reply within one month, and it’s free. We may ask you to confirm who you are first. You don’t have to give us your information, but without it we can’t answer an enquiry or make a booking.

If you’re unhappy

Please tell us first at hello@tamkoz.com. We’ll acknowledge your complaint within 30 days, look into it without delay, and keep you updated on what we find. You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you are in the EU or EEA you can complain to your own national data protection authority instead.

Keeping it safe

The site runs over HTTPS. Our inbox is protected by a passphrase and only we can read it. We store a keyed hash of your IP address rather than the address, and we keep what we collect to the minimum above. If a breach puts your rights at risk, we’ll tell you and the ICO as the law requires.

Children

This site is for businesses and isn’t aimed at children. We don’t knowingly collect information from anyone under 13.

Changes

If we change this policy we’ll update the date at the top of this page, and tell you if the change is significant.