Privacy Policy

Data controller

TAIWHA GROUP LTD is responsible for the personal data it handles for website enquiries, order review, report delivery, and customer correspondence.

For privacy requests, contact support@taiwha.com.

Personal data we handle

• Contact details supplied by the customer, such as name, email address, and correspondence content.
• Project and historical order details, delivery email, payment or legacy checkout metadata (including earlier zero-value orders), and refund or support correspondence.
• Non-sensitive report context that the customer chooses to provide for scoping or delivery.
• Basic hosting and security logs, plus cookieless aggregate page-view and performance measurement, needed to operate, protect, and improve the website.
• Consent choices and, only after the relevant opt-in, website-use data such as page URL, referrer, timestamp, browser or device information, IP address, and business-identification signals. These tools may identify visiting companies and, where permitted by the provider and applicable law, U.S.-based professional contacts.

AI Sales Assistant and project enquiries

Using the AI Sales Assistant is optional. When you send a message, the current conversation context retained by the chat is sent through our website to OpenAI to provide service guidance and prepare an editable project summary. Do not enter confidential or sensitive information. Taiwha does not store chat transcripts in its D1 database. We disable optional API response storage, but this does not guarantee zero retention by OpenAI: its own security, abuse-monitoring and other applicable retention rules still apply.

Only after you explicitly agree and submit the enquiry form do we save its email address, optional name and company, project brief, selected service, language, source page path and consent time in Cloudflare D1, together with an enquiry identifier and handling status. The form itself is not sent to OpenAI. These details support human review of the scope and proposal and email contact about your enquiry; submission does not automatically add you to marketing communications.

Enquiries follow the existing retention rules below: general enquiries may be kept for up to 24 months, with the stated exceptions for an active relationship, legal issue or business record. To request deletion or withdraw your enquiry-processing consent, contact support@taiwha.com; the rights and necessary-record exceptions below still apply.

For abuse prevention, D1 also holds salted IP fingerprints and request counters, rather than raw IP addresses in those counters. Older counters are cleared when later requests are processed, using a two-day UTC date cutoff. They are not used for marketing.

What we do not want in first contact

Do not send credentials, passwords, private keys, full payment card details, medical records, legal files, tax files, confidential family archives, or unrestricted client materials in the first message.

If non-public material is needed for a commissioned project, the categories, approved transfer route, permitted processing, any external AI or other subprocessors, and retention or deletion approach must be agreed before it is shared. A separate data-processing agreement is used where legally required.

Why we use personal data

• To respond to enquiries and decide whether a report or service scope is suitable.
• To confirm payment, delivery email, refund requests, and customer support issues.
• To support historical report orders, including earlier zero-value checkouts. No new pre-written report checkout is offered on this website. A historical checkout email is not automatically added to a marketing list.
• To prepare and deliver commissioned research and fulfil outstanding obligations for historical report orders.
• To keep business, accounting, security, and legal records where required.
• To understand aggregate public-page use and performance through Cloudflare Web Analytics without using cookies or cross-site individual tracking.
• To understand website interest and business demand when a visitor consents to analytics and lead-identification tracking.

Legal bases

• Consent for optional analytics and company-identification technologies. Consent can be withdrawn through “Cookie settings” in the website footer.
• Taking steps at a person’s request and performing a contract for enquiries, orders, payment confirmation, report delivery, and support.
• Legal obligations for records that Taiwha must keep, including relevant accounting, tax, and compliance records.
• Legitimate interests for proportionate website security, cookieless aggregate performance measurement, fraud prevention, service administration, and business correspondence, balanced against the rights of the people concerned.

Cookies and local storage

The website uses necessary local storage for up to 180 days to remember separate choices for analytics and company-identification tracking. The website asks again when that consent record expires or when a material purpose change requires fresh consent.

Cloudflare Web Analytics is always on and does not use cookies or local storage. It is separate from the visitor’s optional Google Analytics 4 and Apollo choices.

The Google tag for Google Analytics 4 and Apollo are loaded only for the purposes a visitor accepts. Visitors can accept all, reject all, select purposes separately, or withdraw a choice through “Cookie settings” in the footer.

See the Cookie Notice for the current technologies, purposes, provider boundary, and review state.

Sharing and processors

Taiwha may use payment, email, hosting, security, analytics, lead-identification, accounting, and professional service providers where needed to run the business and deliver the service.

Cloudflare hosts the public website and provides always-on cookieless aggregate Web Analytics and performance measurement.

Google provides optional Google Analytics 4 measurement, and Apollo provides optional company visit identification. A visitor’s selected purpose must be enabled before the relevant script is loaded by this website.

Stripe may process agreed business payments and retain historical checkout records, including earlier zero-value orders. Taiwha does not ask customers to send full card details by email.

Cloudflare may store private report files and serve time-limited access, while Resend may send transactional delivery emails for historical orders. Retiring new sales does not delete these records or remove existing customer support.

Some providers may process data outside the United Kingdom. Taiwha uses and reviews relevant contractual or transfer safeguards where applicable.

Retention

• Order, payment, refund, and business records may be kept for up to 6 years where needed for accounting, tax, legal, or dispute reasons.
• General enquiries may be kept for up to 24 months unless a longer period is needed for an active relationship, legal issue, or business record.
• The browser consent record lasts up to 180 days. Optional tracking data is retained according to the approved provider and tag configuration; this must be reviewed before a new tag is published.
• Accidental sensitive data should be minimised, deleted, or returned where feasible unless retention is legally necessary.

Your rights

Depending on applicable law, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data.

To make a request, email support@taiwha.com. You may also complain to the UK Information Commissioner’s Office if you are concerned about how your data is handled.