Privacy Policy

1. Information We Collect

We may collect and process the following categories of personal data:

1.1 Information You Provide Directly

• Contact form submissions: full name, email address, company name, telephone number, and the content of your enquiry.
• Email correspondence: any personal data contained in emails you send to us.
• Business enquiries: project requirements, budget ranges, and timelines.

1.2 Information Collected Automatically

• Usage data: pages visited, time spent on pages, links clicked, referring website.
• Device data: IP address, browser type and version, operating system, screen resolution.
• Cookie data: see our Cookie section below for full details.

1.3 Information from Third Parties

• Professional networking data (e.g., LinkedIn) where you contact us via those platforms.
• Referral data from business partners and introducers.

2. How We Use Your Information

We process your personal data for the following purposes and legal bases:

3. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your browsing experience. Cookies are small text files stored on your device.

Types of Cookies We Use

You can manage cookie preferences at any time by clicking "Cookie Settings" in our website footer, or by adjusting your browser settings. Please note that disabling certain cookies may affect website functionality.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We may share your information with:

• Service providers: EmailJS (email delivery), cloud hosting providers, and analytics platforms — all subject to appropriate data processing agreements.
• Professional advisors: solicitors, accountants, and auditors under confidentiality obligations.
• Law enforcement: where required by law, court order, or governmental authority.
• Business transfers: in connection with a merger, acquisition, or sale of business assets, with prior notice to you where required.

All third-party processors are carefully selected and bound by strict data processing agreements ensuring your data is handled securely and lawfully.

5. International Transfers

Some of our third-party service providers may process your data outside the UK or European Economic Area (EEA). Where such transfers occur, we ensure adequate safeguards are in place, such as:

• UK Adequacy Regulations for approved countries
• Standard Contractual Clauses (SCCs) approved by the ICO
• Binding Corporate Rules where applicable

6. Data Retention

We retain your personal data only for as long as necessary for the purposes outlined in this policy:

• Client project data: 7 years from project completion (for tax and legal compliance)
• Enquiry/contact form data: 2 years from last contact
• Marketing consent records: Until consent is withdrawn + 1 year
• Website analytics: Up to 26 months
• Financial records: 7 years (as required by HMRC)

After the applicable retention period, data is securely deleted or anonymised.

7. Your Rights Under UK GDPR

As a data subject, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your data in certain circumstances.
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making: We do not use fully automated decision-making that produces legal effects.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact our Data Protection contact at: contact@instatechltd.online. We will respond within 30 days of your request.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Security

We implement appropriate technical and organisational security measures to protect your personal data, including:

• SSL/TLS encryption for all data in transit
• Access controls and authentication protocols
• Regular security audits and vulnerability assessments
• Staff training on data protection and information security
• Incident response procedures for data breaches

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR.

9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policies of any external site you visit.

10. Children's Privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will take steps to delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on our website with a revised effective date. Your continued use of our website after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data processing activities, please contact us:

• Company: INSTATECH GROUPS LTD
• Company No.: 17590807 (England & Wales)
• Registered Address: 87 Marchmont Street, London, England, WC1N 1AP
• Email: contact@instatechltd.online
• Phone: +44 7454 742112