Home/Privacy notice
Legal
Privacy notice
How Pragmatica Tech Ltd collects, uses, stores and protects personal data, and the rights you have over it under the UK GDPR and the Data Protection Act 2018.
- Who we are
- What we collect
- Lawful bases
- How we use it
- Sharing
- Transfers
- Retention
- Security
- Your rights
- Complaints
1. Who we are
Pragmatica Tech Ltd (“Pragmatica Tech”, “we”, “us”) is the data controller for the personal data described in this notice. We are a private company limited by shares, registered in England and Wales under company number 16664432, with a registered office at 129 Ladysmith Road, Plymouth, United Kingdom, PL4 7NW.
All privacy enquiries and rights requests should be sent to support@pragmaticatech.org with “Data protection” in the subject line.
2. What personal data we collect
2.1 When you contact us
Your name, email address, the organisation you represent, your role, and whatever you choose to include in your message and any attachments.
2.2 When you become a client
Contact details for the people involved in the engagement, billing and purchase-order details, correspondence, meeting notes, and interview notes taken during fieldwork.
2.3 During an engagement
To carry out an assessment we may be given access to systems and documents that contain personal data belonging to your staff, customers or suppliers — user account lists, directory exports, ticket histories, log samples and similar. Where this happens we act as a processor on your instructions, and the arrangement is governed by the engagement contract, not by this notice. We ask for read-only access and the narrowest data set that will answer the question.
2.4 Technical data held by our hosting provider
Our website host records standard server request logs, which may include IP addresses, timestamps, requested URLs and user-agent strings. These are generated by the hosting infrastructure for security and reliability purposes. We do not use them to build profiles, and we do not combine them with any other data.
We do not collect special category data through this website, and we do not knowingly collect data relating to children.
3. Lawful bases for processing
- Legitimate interests (Article 6(1)(f)) — responding to business enquiries, maintaining client relationships, protecting the security of our systems, and keeping records of the advice we have given. We have assessed that these do not override your rights and freedoms.
- Contract (Article 6(1)(b)) — taking steps at your request before entering a contract, and performing our obligations once an engagement is agreed.
- Legal obligation (Article 6(1)(c)) — keeping accounting and tax records as required by UK law.
- Consent (Article 6(1)(a)) — where we ask for it specifically. Consent can be withdrawn at any time.
4. How we use personal data
- To answer your enquiry and arrange a scoping call.
- To prepare a written scope, proposal and fee.
- To deliver an engagement, including interviews, analysis and reporting.
- To raise invoices and maintain accounting records.
- To handle contractual, insurance or professional-conduct matters if they arise.
We do not sell personal data. We do not send marketing email to people who have not asked for it, and we operate no mailing list.
5. Who we share it with
We share personal data only where it is necessary, and only with:
- Service providers acting on our instructions — email and file hosting, website hosting, accounting software and professional advisers. Each is bound by contract to appropriate confidentiality and security terms.
- Specialists brought into an engagement, and then only with your knowledge and agreement, under written confidentiality terms.
- Regulators, courts or law enforcement, where we are legally required to disclose.
We never pass your details to software or hardware vendors, and we receive no referral or commission payments of any kind.
6. International transfers
Our operations are based in the United Kingdom. Some service providers may process data outside the UK. Where that occurs we rely on UK adequacy regulations or on the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards appropriate to the transfer.
7. How long we keep it
- Enquiries that do not become work — up to 12 months, then deleted.
- Engagement records and deliverables — 6 years from the end of the engagement, reflecting the limitation period for contractual claims in England and Wales.
- Accounting records — at least 6 years, as required by UK tax law.
- Client system data accessed during fieldwork — returned or securely destroyed at the end of the engagement, or earlier on request, unless the engagement contract states otherwise.
- Server logs held by our host — retained for a short period under the provider's standard configuration.
8. How we protect it
We apply measures proportionate to the risk: encryption in transit and at rest on the services we use, multi-factor authentication on all business accounts, least-privilege access, device encryption, and prompt patching. Access to client material is limited to the consultant working on the engagement.
If a personal data breach occurs that is likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, and will inform affected individuals without undue delay where the risk is high.
9. Your rights
Under the UK GDPR you have the right to:
- be informed about how your data is used — this notice;
- request access to the personal data we hold about you;
- have inaccurate data corrected;
- request erasure, where no overriding reason to keep it applies;
- restrict processing in certain circumstances;
- data portability, where processing is based on consent or contract and is automated;
- object to processing based on legitimate interests;
- withdraw consent at any time, where consent is the basis we rely on.
Email support@pragmaticatech.org to exercise any of these. We respond within one month, and will tell you promptly if we need to verify your identity or if the request is complex enough to require an extension. There is no charge for a reasonable request.
If your request concerns data we hold as a processor on a client's behalf, we will direct you to that client, who is the controller for it.
10. Complaints
Please raise any concern with us first — we would rather fix it directly. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, via ico.org.uk or the ICO helpline on 0303 123 1113.
11. Changes to this notice
We review this notice when our practices change and at least annually. The version number and date at the top of the page record the current edition. Material changes affecting existing clients will be notified by email.