Privacy notice.

1. Who we are

GraniteHalo is operated by Tachi Ltd. Tachi Ltd is the controller of personal information collected through this website.

Tachi Ltd is registered in England and Wales under company number 15104904. Its registered office is Easthampstead House, Town Square, Bracknell, England, RG12 1BH.

Privacy enquiries and requests concerning personal information may be submitted through the contact form or sent in writing to the registered office.

2. Information we collect

Information you provide

When you submit an enquiry through the website, we may collect:

• your name;
• your email address;
• your company or organisation, where provided;
• the nature of your enquiry, where provided;
• the contents of your message;
• the date and time of submission; and
• information contained in subsequent correspondence.

You should not include confidential, highly sensitive or unnecessary personal information in an initial website enquiry.

Website and technical information

When you use the website, limited technical information may be processed automatically by our hosting, analytics and security providers. This may include:

• IP address and approximate geographic location;
• browser, operating system and device category;
• pages requested and referring pages;
• dates, times and performance information; and
• user-agent, security, bot-detection and request-validation information.

Contact-form processing may also generate Cloudflare Turnstile verification information and email-delivery metadata, such as a delivery-service message identifier, submission status and related diagnostic information.

3. How we use information

We may use personal information to:

• receive, review and respond to enquiries;
• route and deliver enquiries securely;
• communicate with prospective clients, partners and suppliers;
• consider potential commercial relationships or opportunities;
• operate, maintain and improve the website;
• measure aggregate website usage and performance;
• prevent spam, fraud, abuse and security threats;
• establish, exercise or defend legal claims; and
• comply with legal, regulatory and accounting obligations.

We do not use information obtained through this website to make decisions based solely on automated processing that produce legal or similarly significant effects.

4. Our lawful bases

Depending on the circumstances, we rely on one or more of the following lawful bases:

• Legitimate interests - to operate and secure the website, respond to enquiries and conduct our business.
• Steps before entering into a contract - where you contact us about a potential service, engagement or commercial relationship.
• Legal obligation - where processing is necessary to comply with applicable law or regulatory requirements.
• Consent - where we specifically request consent for a particular activity.

Where we rely on legitimate interests, those interests include conducting and developing our business, maintaining an effective website, responding to legitimate enquiries and protecting the website against misuse.

5. Cloudflare Web Analytics

We use Cloudflare Web Analytics to understand aggregate website traffic and performance. It may provide information such as page views, referring websites, countries, browsers, operating systems, device categories and website-performance measurements.

Cloudflare Web Analytics is designed to operate without analytics cookies and without identifying or tracking individual visitors across websites.

Analytics information is used to understand whether the website is working effectively, identify performance problems and improve its structure and content.

6. Contact form, Cloudflare and Resend

When you submit the contact form, Tachi Ltd processes the information you provide together with the submission timestamp, available IP address and user-agent information. We use this information to validate, secure, deliver, review and respond to the enquiry and to maintain appropriate business and security records.

The website uses Cloudflare Pages for hosting and delivery and Cloudflare Turnstile to distinguish genuine enquiries from automated or abusive submissions. Turnstile runs a security check in your browser and generates a token that is sent to Cloudflare for server-side validation when the form is submitted. Cloudflare may process IP address, browser, device, request and verification information to provide hosting, security, bot-detection and abuse-prevention services.

After successful validation, the enquiry is sent through Resend, our email-delivery provider. Resend processes the submitted contact details and message, routing information and delivery metadata needed to transmit and operate the email service.

Cloudflare and Resend provide services to Tachi Ltd and act as service providers and, where applicable, processors acting on our behalf. They may also process limited service, security or usage information for their own legitimate operational and legal purposes under their applicable terms and privacy information.

The provision of information through the contact form is voluntary. However, we may be unable to respond if you do not provide a valid means of contact or sufficient information to understand the enquiry.

7. Cookies and similar technologies

We do not currently use advertising cookies, behavioural advertising technology or cross-site marketing profiles.

Cloudflare Web Analytics operates without analytics cookies. Cloudflare or other infrastructure providers may use strictly necessary technologies where required to deliver, secure and protect the website.

If we introduce non-essential cookies or marketing technologies, we will update this notice and provide consent controls where required.

8. Who receives information

Personal information may be disclosed where necessary to:

• website hosting, infrastructure and security providers;
• analytics, email and communications providers;
• professional advisers, including lawyers and accountants;
• insurers, auditors or prospective commercial counterparties;
• regulators, courts, law-enforcement bodies or public authorities; and
• purchasers, investors or successors involved in a proposed or completed corporate transaction.

Our processors are contractually restricted to processing personal information on documented instructions, as needed to provide their services, or as required by applicable law. Some providers may also process limited account, usage or security information as independent controllers where described in their own privacy information.

We do not sell personal information.

9. International transfers

Some service providers may process information in countries outside the United Kingdom.

Where an international transfer is subject to UK data-protection law, we take reasonable steps to ensure that an appropriate transfer mechanism or safeguard applies. This may include UK adequacy regulations, approved contractual protections or another permitted legal mechanism.

10. Retention

We retain enquiries only for as long as reasonably necessary to understand and respond to the enquiry, manage any resulting business relationship, comply with legal obligations and maintain legitimate business records.

The appropriate period depends on the nature of the enquiry, whether it leads to an ongoing relationship and whether the information is required for a transaction, dispute, legal claim or compliance purpose. Information that is no longer required will be deleted or anonymised where appropriate.

Information connected with a contract, transaction, dispute or legal obligation may be retained for longer where necessary. Cloudflare, Resend and other service providers may retain security, delivery and technical information for operational periods set under their applicable terms, retention controls and legal obligations.

11. Security

We use proportionate technical and organisational measures intended to protect personal information against accidental loss, unauthorised access, misuse, alteration or disclosure.

These measures may include encrypted transmission, access controls, request validation, bot protection, infrastructure monitoring and limiting access to those who reasonably require it. No method of transmitting or storing information can be guaranteed to be completely secure.

12. Your rights

Depending on the circumstances and applicable law, you may have the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of personal information;
• request restriction of processing;
• object to processing based on legitimate interests;
• request transfer of information in a portable format;
• withdraw consent where processing is based on consent; and
• complain to a data-protection supervisory authority.

You have the right to object to processing based on our legitimate interests. We will stop that processing unless there are compelling legitimate grounds to continue or it is required for legal claims.

These rights are not absolute and may be subject to exemptions or limitations under applicable law. To exercise a right, submit a request through the contact form or write to the registered office. We may request information reasonably necessary to confirm your identity.

13. Complaints

We encourage you to contact us first so that we can investigate and address any concern.

You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s data-protection supervisory authority. Information about making a complaint is available from the Information Commissioner’s Office.

14. External websites

The website may link to websites operated by Tachi Ltd or unrelated third parties. Those websites may have their own privacy notices and practices.

This notice applies only to personal information for which Tachi Ltd acts as controller.

15. Changes to this notice

We may update this notice to reflect changes to the website, our operations, service providers or applicable law. The current version will be published on this page with an updated revision date.