Privacy Policy

1. Who we are

This website, ptassolutions.co.uk, is operated by PTAS SOLUTIONS LTD (trading as PTAS Solutions), a company registered in England and Wales under company number 16820044.

Registered address: 321-323 High Road, Office 8874, Romford, England, RM6 6AX
E-mail: [email protected]
Phone: +44 7458 213694

We develop custom software — web applications, client portals, mobile apps, internal business systems, API integrations and cloud infrastructure — for businesses in the United Kingdom. This policy explains how we handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Questions about it can be sent to the e-mail address above.

2. Controller and processor

We handle personal data in two different roles:

As a controller — for our own business contacts, enquiries, project correspondence, contracts and invoices. This policy mainly covers that data.
As a processor — when a client gives us access to their systems, databases or files that contain personal data (for example their customers' or employees' records) so we can build, migrate, test or support software. In that case the client is the controller, and we act only on their documented instructions under Article 28 UK GDPR and a written data processing agreement (DPA). If your data is held in a system we work on for one of our clients, please contact that organisation first; we will pass on and help with any request we receive.

3. Data we collect

Business contact and enquiry data

When you e-mail or phone us, or meet us about a project: your name, job title, company name, business e-mail address, phone number and the content of your message, including any project description or files you choose to send.

Project and contract data

Names and contact details of client staff involved in a project, meeting notes, specifications, tickets and comments in project management tools, user accounts we create for you in staging or production systems, contracts, statements of work and sign-off records.

Billing data

Invoicing contacts, company billing address, VAT number, payment records and correspondence about payments. We do not collect or store card numbers.

Client data processed on instructions

Personal data contained in client systems we are given access to — the categories depend on the client and are defined in the relevant DPA.

Website data

This website has no contact forms, user accounts or ordering features: buttons open your own e-mail application or phone dialler, so nothing you type on the site is sent to us. Our hosting provider may keep standard technical server logs (IP address, browser type, pages requested, date and time) for security and troubleshooting.

4. Purposes and lawful bases

Purpose	Lawful basis
Replying to enquiries and preparing estimates or proposals	Steps at your request before entering into a contract; legitimate interests in responding to business enquiries
Delivering projects, support and maintenance, and day-to-day project correspondence	Contract; legitimate interests in communicating with the staff of our business clients
Processing client data on a client's instructions	The client's lawful basis as controller; our obligations under the DPA and Article 28 UK GDPR
Invoicing, accounting and tax records	Contract; legal obligation
Keeping the website and our systems secure	Legitimate interests in protecting our services
Occasional updates about our services to existing business contacts	Legitimate interests, or consent where required by the Privacy and Electronic Communications Regulations; you can opt out at any time
Establishing, exercising or defending legal claims	Legitimate interests; legal obligation

Where we rely on legitimate interests, we have balanced them against your rights. Business correspondence with company representatives is an expected part of B2B work, and we keep it proportionate.

We do not sell personal data. We share it only with service providers that help us run our business and deliver projects, under written contracts that require them to protect it:

cloud hosting and infrastructure providers (where client applications, databases and backups are hosted);
project management, issue tracking, source code hosting and documentation tools;
e-mail, video-call and office productivity providers;
accounting, invoicing and banking providers;
professional advisers such as accountants, insurers and lawyers;
authorities, regulators or courts where we are required by law.

When we act as a processor, we use sub-processors only with the client's general or specific written authorisation, as set out in the DPA, and we impose the same data protection obligations on them. A current list of sub-processors used for a project is available to that client on request.

6. International transfers

Some of our service providers store or access data outside the United Kingdom, for example in the European Economic Area or the United States. Where this happens we make sure an appropriate safeguard is in place, such as:

UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified);
the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses (UK Addendum), supported by a transfer risk assessment.

For client projects, hosting regions are agreed with the client and recorded in the DPA. You can ask us for details of the safeguards relevant to your data.

7. How long we keep data

Enquiries that do not lead to a contract — up to 24 months after our last contact.
Project documentation and correspondence — for the duration of the contract and 6 years after it ends, in line with limitation periods for contractual claims.
Invoices and accounting records — 6 years from the end of the financial year they relate to, as required by UK tax and company law.
Client data processed as a processor — only for as long as the client instructs; at the end of the engagement we delete or return it, as the DPA specifies, usually within 30 days, unless the law requires us to keep a copy.
Server logs — kept by our hosting provider for a limited period, typically no longer than 90 days.

8. Security

We apply technical and organisational measures appropriate to the risk, including:

access on a least-privilege basis, with named accounts and multi-factor authentication;
removing access to client systems as soon as the work no longer requires it;
encryption of data in transit and, where supported, at rest;
use of anonymised or synthetic data in development and testing environments wherever possible;
code review, dependency scanning and secret detection in our delivery pipelines;
confidentiality obligations for everyone who works with us.

If a personal data breach affects data we hold as a controller, we will notify the ICO and you where the law requires. If it affects client data we process, we will inform the client without undue delay so they can meet their own obligations.

9. Cookies

This website does not set cookies and does not use analytics, advertising or tracking tools. To display text in the intended typeface, pages load fonts from Google Fonts, which means your browser connects to Google's servers and shares your IP address with Google for that purpose. If we ever add cookies that are not strictly necessary, we will ask for your consent first and update this policy.

10. Your rights

Under UK GDPR you have the right to:

access — get a copy of the personal data we hold about you;
rectification — have inaccurate or incomplete data corrected;
erasure — ask us to delete your data where there is no good reason to keep it;
restriction — ask us to pause the use of your data in certain situations;
data portability — receive data you gave us in a structured, machine-readable format, or have it sent to another organisation, where processing is based on consent or contract and carried out by automated means;
objection — object to processing based on legitimate interests, and to direct marketing at any time;
withdraw consent — where we rely on consent.

To exercise any of these rights, e-mail [email protected]. We will reply within one month, which may be extended by up to two further months for complex requests. We may need to confirm your identity first. Exercising your rights is free of charge in most cases. We do not make decisions about you based solely on automated processing.

Where we process your data on the basis of consent, for example to send you updates you have asked for, you can withdraw it at any time by replying to any message from us or e-mailing [email protected]. Withdrawal does not affect processing carried out before it.

12. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Website: ico.org.uk
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Children

Our services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, please contact us and we will delete it.

14. Changes to this policy

We review this policy regularly and will update it when our services, suppliers or legal requirements change. The date at the top of the page shows when it was last updated. Significant changes will be highlighted on this page and, where appropriate, communicated to our clients directly.

Last updated: 12 October 2026.