Privacy

Who we are

Tassen Limited ("Tassen", "we", "us" or "our") is the controller responsible for your personal data in connection with this website.

Tassen Limited is registered in England and Wales under company number 11223106. Our registered office is:

16–17 Little Portland Street
London
England
W1W 8BP

If you have any questions about this Privacy Policy or how we process your personal data, please contact us using the contact details provided on our website.

Personal data we collect

The personal data we collect depends on how you use our website.

We may collect:

• Contact information, such as your name, email address and telephone number, if you provide it to us;
• Information contained in communications, such as the contents of messages or enquiries you send to us;
• Technical information, such as your IP address, browser type, operating system, device information and information about how you interact with our website;
• Cookie and similar technology information, where applicable and subject to the requirements described in our Cookies section below; and
• any other personal data that you choose to provide to us.

We do not ask you to provide special category personal data through this website. Please do not provide sensitive personal information unless it is necessary and we have specifically requested it.

How we collect personal data

We generally collect personal data directly from you, for example when you:

• contact us;
• submit information through a form on our website;
• communicate with us by email or other means; or
• browse or use our website, where technical information is collected automatically.

We may also receive limited personal data from third-party service providers or publicly available sources where this is necessary for legitimate business purposes and permitted by law.

How and why we use your personal data

We use personal data only where we have a lawful basis to do so.

Depending on how you interact with us, we may use your personal data to:

• respond to enquiries and requests;
• communicate with you about matters you have asked us about;
• operate, maintain and secure our website;
• monitor and improve the performance, functionality and security of our website;
• understand how visitors use our website, where applicable;
• prevent fraud, misuse or other unlawful activity;
• establish, exercise or defend legal claims;
• comply with legal and regulatory obligations; and
• carry out other purposes that are compatible with the purposes for which the information was originally collected or which are otherwise permitted by law.

We will not use your personal data for a new purpose that is incompatible with the original purpose without taking any further steps required by applicable data-protection law.

Our lawful bases for processing

Under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, we must have a lawful basis for processing personal data.

The lawful basis we rely on depends on the particular processing activity.

Responding to enquiries

Where you contact us, we may process your name, contact details and the contents of your enquiry in order to respond to you.

Our lawful basis will generally be:

• legitimate interests, where we have a legitimate interest in responding to communications and managing enquiries; or
• taking steps at your request, where the processing is necessary in connection with a contract or potential contract.

Operating and securing the website

We process technical information, including information contained in server logs, where necessary to operate, maintain and secure our website.

Our lawful basis is generally legitimate interests in operating a secure, reliable and functional website and protecting our systems and business.

Website analytics

We do not currently use analytics or advertising tracking technologies on this website. If this changes, we will update this Privacy Policy and, where required by law, obtain your consent before using non-essential cookies or similar technologies.

Where we use analytics or similar technologies to understand how visitors use our website, we will process the relevant information in accordance with applicable data-protection and electronic-communications laws.

Where consent is required under the Privacy and Electronic Communications Regulations 2003 ("PECR"), we will obtain your consent before using non-essential cookies or similar technologies.

Legal obligations

We may process personal data where necessary to comply with a legal or regulatory obligation to which we are subject.

Our lawful basis is legal obligation.

Protecting our business and legal rights

We may process personal data where necessary to prevent misuse, investigate security incidents, protect our property and systems, or establish, exercise or defend legal claims.

Our lawful basis is generally legitimate interests.

Where we rely on legitimate interests, our interests include operating, maintaining and securing our website, responding to enquiries, preventing misuse, protecting our business and legal rights, and complying with applicable legal and regulatory requirements.

Cookies and similar technologies

Our website may use cookies and similar technologies.

Cookies are small text files placed on your device when you visit a website. Some cookies are necessary for the website to function, while others may be used for purposes such as analytics or remembering preferences.

We distinguish between:

• strictly necessary cookies, which are required for the operation or security of the website; and
• non-essential cookies, such as analytics or advertising cookies, where applicable.

Where PECR requires consent for a cookie or similar technology, we will request your consent before using it.

You can withdraw or change your consent where a consent mechanism is provided.

We do not currently use non-essential cookies for analytics or advertising purposes. The website may use strictly necessary technical functionality required for the operation, security or delivery of the website. If we introduce non-essential cookies or similar technologies in the future, we will provide appropriate information and obtain consent where required by law.

Who we share personal data with

We may share personal data with third parties where this is necessary for the purposes described in this Privacy Policy or where required or permitted by law.

These recipients may include:

• website hosting and infrastructure providers;
• email and communications providers;
• analytics providers, where applicable;
• IT, security and technical service providers;
• professional advisers, such as lawyers, accountants or insurers;
• regulators, government authorities or law-enforcement bodies where required or permitted by law; and
• other parties where necessary to establish, exercise or defend our legal rights.

Where a third party processes personal data on our behalf, we will take appropriate steps to ensure that the processing is subject to appropriate contractual and other safeguards required by applicable data-protection law.

We do not sell your personal data.

International transfers

Some of our service providers may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK and the transfer is subject to the UK GDPR's international-transfer requirements, we will ensure that the transfer is made using an appropriate legal mechanism and appropriate safeguards.

These mechanisms may include:

• a UK adequacy regulation;
• appropriate contractual safeguards, including the applicable UK International Data Transfer Agreement or International Data Transfer Addendum; or
• another lawful transfer mechanism permitted under applicable data-protection law.

You can contact us using the details on our website if you would like further information about the safeguards applicable to a particular international transfer.

Some of the service providers we use to operate the website and process communications may process personal data outside the United Kingdom. Where this happens, we will ensure that appropriate safeguards are used in accordance with applicable UK data-protection law.

How long we keep your personal data

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to satisfy legal, accounting or reporting requirements.

Information submitted through our contact form is retained only for as long as reasonably necessary to respond to your enquiry, manage any follow-up and maintain appropriate business records. We may retain information for longer where necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

Where a specific retention period cannot reasonably be stated, we determine the appropriate retention period by considering:

• the purpose for which the information was collected;
• the nature and sensitivity of the information;
• the amount and type of personal data involved;
• relevant legal and regulatory requirements;
• whether we need the information to establish, exercise or defend legal claims; and
• whether the purpose can be achieved without retaining the information.

When personal data is no longer required, we will securely delete it or anonymise it where appropriate.

Your data-protection rights

Subject to applicable legal conditions and exemptions, you may have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• request restriction of the processing of your personal data;
• object to processing where we rely on legitimate interests as our lawful basis;
• request data portability where the right applies; and
• withdraw consent where we rely on your consent as our lawful basis.

Your rights are not absolute and may be subject to legal conditions or exemptions.

For example, we may be permitted or required to retain certain information even where you request its deletion.

How to exercise your rights

You can exercise your data-protection rights by contacting us using the contact details provided on our website.

We will normally respond to a valid request within one month of receiving it. Where a request is particularly complex or we receive a number of requests, this period may be extended by up to a further two months where permitted by law. We will tell you if an extension is necessary.

We may need to request additional information from you to verify your identity before completing a request.

In most circumstances, we will not charge a fee for exercising your rights. However, where permitted by law, we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive.

Right to complain

If you have concerns about how we process your personal data, we encourage you to contact us first so that we can try to resolve your concern.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection.

Further information about making a complaint is available from the ICO at:

https://ico.org.uk/make-a-complaint/

Automated decision-making and profiling

We do not use your personal data to make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on you.

If this changes, we will update this Privacy Policy and provide any information required by applicable data-protection law.

Security

We take appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure.

However, no method of transmitting or storing information over the internet can be guaranteed to be completely secure.

Where appropriate, we limit access to personal data to people and organisations that need access for legitimate business purposes and require them to handle it securely.

Children's privacy

This website is not specifically directed at children, and we do not knowingly collect personal data from children through the website.

If you believe that a child has provided us with personal data, please contact us so that we can consider whether the information should be deleted.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our activities, technology, legal requirements or the way we process personal data.

When we make changes, we will update the "Last updated" date at the top of this Privacy Policy.

Where required by law, we will provide additional notice of material changes.