Privacy and GDPR

Who we are

This website, www.tacitous.com, is run by Tacitous Ltd (“Tacitous”, “we”, “us”), a company registered in England and Wales (company number 15313336) with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are the controller of the personal data described in this notice. You can contact us about privacy at any time at info@tacitous.com.

This notice applies to visitors to this website, wherever they are, including in the United Kingdom and the European Economic Area. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and the EU General Data Protection Regulation (EU GDPR).

Personal data held in the Tacitous Next platform is handled under your organisation’s agreement with Tacitous, not under this notice.

What we collect and why

When you send an enquiry

When you use our contact form, we collect your name, email address, organisation (optional), the topic you choose, your message and the page you sent it from. When you email us directly, we receive your email address and whatever you include in your message.

We use this only to reply to you and to discuss how we might work together. Our lawful basis is our legitimate interest in responding to enquiries, or taking steps at your request before entering into a contract. We keep enquiries for up to 24 months after our last contact with you, unless they lead to a contract, in which case we keep them for as long as the contract requires.

Protecting the contact form from abuse

To stop automated spam, the form limits how many messages can be sent from one connection each hour. For this we store a one-way hashed form of your IP address with a count, set to expire after two hours. We never store your IP address itself. Our lawful basis is our legitimate interest in keeping the website secure.

Running the website

Like any website, our hosting provider (Google Firebase Hosting) processes technical information such as your IP address, browser type and the pages you request in order to deliver pages to you and keep the service secure. Our lawful basis is our legitimate interest in operating a secure website.

Analytics and advertising measurement, only with your consent

If you choose Accept in the cookie banner, we load:

• Google Analytics 4, to understand how visitors use the site, for example which pages are visited and how visitors arrive. Google processes this data under its own privacy policy.
• The LinkedIn Insight Tag, to measure how our LinkedIn adverts perform, including when a visitor clicks to book a call or sends the contact form. LinkedIn processes this data under its own privacy policy.

Neither is loaded unless you accept, and nothing changes if you decline. Our lawful basis is your consent, which you can withdraw at any time using Cookie settings at the bottom of every page.

Booking a call

Our “Book a call” links take you to zcal, a separate scheduling service. Information you enter there is collected by zcal under its own privacy policy and shared with us so we can hold the meeting.

Cookies and similar technologies

• Your cookie choice (stored in your browser’s local storage as tacitous-cookie-consent-v2). Strictly necessary to remember whether you accepted or declined. It is not sent to us.
• Google Analytics cookies (names beginning _ga). Set only if you accept. Google’s standard expiry for these is up to two years.
• LinkedIn cookies (for example li_sugr, bcookie, lidc, UserMatchHistory and AnalyticsSyncHistory). Set only if you accept. LinkedIn describes them in its cookie policy.

To change your choice, select Cookie settings at the bottom of any page. If you withdraw consent, we remove the Google Analytics and LinkedIn cookies set on this site and stop loading the tags. Fonts and all other files on this site are served from our own domain, so no other third party receives your data when you browse.

Who we share personal data with

We do not sell personal data. We share it only with service providers who process it on our behalf, under contracts that require them to protect it:

• Google (Firebase Hosting, Cloud Functions and Cloud Firestore) to host the website and store enquiries, and Google Analytics if you accept cookies.
• GoDaddy, which hosts our email, so that enquiries reach our team.
• LinkedIn, if you accept cookies.

We may also disclose personal data where the law requires it, or to professional advisers under a duty of confidentiality.

International transfers

Some of our providers, including Google and LinkedIn, may process data outside the UK and the European Economic Area, for example in the United States. Where they do, the transfer is protected by recognised safeguards, such as the EU–US Data Privacy Framework and its UK Extension, or standard contractual clauses approved for UK and EU transfers.

Your rights

Under the UK GDPR and the EU GDPR you have the right to:

• be informed about how your personal data is used
• access a copy of your personal data
• have inaccurate data corrected
• have your data erased
• restrict how we use your data
• receive your data in a portable format
• object to processing based on our legitimate interests
• withdraw consent at any time, without affecting processing before you withdrew it

We do not make decisions about you based solely on automated processing.

To exercise any of these rights, email info@tacitous.com. There is no charge, and we will reply within one month. We may need to confirm your identity first.

Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to a data protection supervisory authority:

• In the UK, the Information Commissioner’s Office: ico.org.uk.
• In the European Economic Area, the authority in the country where you live or work, or where you believe the problem happened. The European Data Protection Board lists them: edpb.europa.eu.

Keeping your data secure

The website is served only over encrypted HTTPS connections. Enquiries are stored in access-controlled cloud storage that only our team can reach, and the credentials our systems use are kept in a secret manager, not in code.

Children

This website is intended for organisations and professionals. It is not aimed at children, and we do not knowingly collect personal data from anyone under 16.

Links to other websites

This site links to other websites, such as LinkedIn, YouTube and our partners’ sites. We are not responsible for their privacy practices, so please read their privacy notices when you visit them.

Changes to this notice

We will update this notice when our practices change, and show the date of the latest version at the top of this page.