Privacy policy
Updated
This policy explains how Penta Services ("we", "us") handles personal data when you use pentaservices.co.uk, create an account, place an order or contact us. We are the controller of this data. Contact: info@pentaservices.co.uk.
What we collect
- Enquiries: the details you enter in our contact, quote, audit, assessment and partner forms, such as your name, email, company, country, budget and message.
- Accounts: your name, organisation, email address, optional phone number and website, preferred language and currency, and a securely hashed password. We never store your password in readable form.
- Social sign-in: if you choose Google, Microsoft, Apple, Facebook, LinkedIn or GitHub, we receive only your name and email address from that provider. We never see your password for that service.
- Orders and support: the services and domains you order, invoices, payment references, support tickets and messages, and homepage drafts you save.
- Technical data: your IP address, browser type and the pages you request, recorded in server logs and security records (for example to block repeated failed sign-ins).
Why we use it and our legal basis
- To answer your enquiry and prepare quotes (steps you ask us to take before a contract).
- To create and run your account, deliver services, issue invoices and provide support (performance of a contract).
- To keep the website and accounts secure and prevent abuse (our legitimate interests).
- To keep accounting and tax records (legal obligation).
We do not sell your data, and we do not use it for advertising profiles. We only send marketing emails if you have agreed to receive them, and you can opt out at any time.
Who we share it with
- Our hosting provider, which stores the website, database and email on our behalf.
- Google Fonts, which delivers the typefaces used on this site; your browser connects to Google to load them, which shares your IP address with Google.
- The sign-in provider you choose, if you use social sign-in.
- Professional advisers and authorities where the law requires it.
Some of these providers may process data outside the UK or the EEA. Where they do, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.
How long we keep it
- Enquiries that do not lead to a project: up to 24 months.
- Accounts: while your account is open, and up to 12 months after you ask us to close it.
- Orders, invoices and payment records: 6 years after the end of the financial year, for tax and accounting purposes.
- Security logs: up to 12 months.
Your rights
Depending on where you live, including under UK and EU GDPR, the UAE Personal Data Protection Law and Saudi Arabia's PDPL, you can ask to access, correct or delete your data, to restrict or object to how we use it, and to receive a copy in a portable format. You can update most account details yourself under Account → Profile. To exercise any right, email info@pentaservices.co.uk; we reply within one month.
If you are unhappy with how we handle your data, please contact us first. You can also complain to your data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk).
Security
We use HTTPS throughout the site, hashed passwords, secure sign-in sessions, limits on repeated sign-in attempts and access controls for our team. No system is completely secure, but we work to protect your data and will tell you and the authorities about a breach where the law requires.
Changes
We will update this policy when our services or the law change. The date at the top shows the latest version.