Privacy notice
How we handle personal data.
This notice explains what personal data TKM Technologies Limited collects through this website and in the course of our work, why we collect it, and the rights you have in relation to it.
Who we are
TKM Technologies Limited is a company registered in England and Wales under company number 03454549. Our registered office is Suite C, City House, 96a High Road, Nottingham NG9 2LF, United Kingdom. We are registered with the Information Commissioner's Office (ICO) as a data controller under registration number Z9304636.
Questions about this notice, or about how we handle personal data, can be sent to info@tkmtechnologies.com or by post to the address above.
Personal data we collect through this website
This website does not use client-side analytics, advertising trackers or non-essential cookies. It sets no cookies at all, and it does not build a profile of visitors.
If you contact us through the enquiry form or by email, we collect the details you choose to give us: typically your name, organisation, email address, telephone number and a description of your enquiry. Form submissions are handled by a script on our own web server and delivered to us by email; no third-party form service is involved. We ask you not to include privileged, confidential or personal data about third parties at the enquiry stage.
This website is hosted in the United Kingdom by Fasthosts Internet Limited, Gloucester, part of the IONOS group. As our hosting provider, Fasthosts records standard server logs — the IP address of the device you use to visit the site, the pages requested and the time of the request — which are used only to keep the site running securely and, according to Fasthosts' privacy notice, are retained for no more than 60 to 90 days. Fasthosts acts as our processor for this purpose. All other resources on this site, including typefaces, are served from our own web space; nothing is loaded from third-party services.
Why we use it and on what basis
We use enquiry details to respond to you, to assess whether we can act, to carry out conflict checks and to prepare a proposal or letter of engagement if you ask us to. Our lawful basis is our legitimate interest in responding to enquiries about our services and, where you are seeking to instruct us, the steps needed to enter into a contract with you.
We do not use enquiry details for marketing, and we do not sell or share personal data with third parties for their own purposes.
Personal data we process in the course of our work
Digital forensics work necessarily involves personal data. Devices, accounts and data sets supplied to us for examination may contain information about employees, customers, correspondents and other individuals, including in some cases special category data or data relating to criminal allegations.
When we are instructed on a matter, the terms governing that processing are set out in our letter of engagement and the accompanying statement of work. In summary:
- We process personal data only for the purposes of the engagement: the provision of confidential digital forensics, e-discovery, data management and associated services at the direction of the client.
- Our role — controller or processor — depends on the nature of the engagement and is set out in the letter of engagement and any data processing terms agreed with the client. Where we act as an expert, we determine our own methods and conclusions and act as an independent controller. Where we process data solely to a client's instructions, including on the Private Cloud Lab, we act as their processor. In every case the client is responsible for ensuring it has the necessary notices, consents and lawful bases in place to supply the data to us.
- Our lawful bases are typically legitimate interests (ours and our client's, in investigating and resolving the matter), compliance with legal obligations, and the establishment, exercise or defence of legal claims. Where special category or criminal offence data is involved, we rely on the conditions for legal claims and judicial acts under Article 9(2)(f) of the UK GDPR and Schedule 1 to the Data Protection Act 2018.
- Evidence and working data are held in our own secure laboratory environment on infrastructure we own and control, in certified UK data centres. We do not ordinarily place client data on public cloud services; where a matter requires it, we do so only with the instructing party's agreement.
- We do not transfer personal data outside the United Kingdom unless the transfer is to a country with an adequacy decision, is covered by appropriate safeguards such as standard contractual clauses, or falls within a lawful derogation.
- Access is restricted to named, vetted staff. We do not subcontract examinations without the client's written consent.
Who we share personal data with
We share personal data only where the engagement requires it: with the instructing client and their legal advisers; with courts, tribunals, regulators or other bodies where we are required to by law or by the terms of the engagement; and with the data-centre operator that hosts our infrastructure, which does not have access to the content of evidence held there. If we receive a legal demand for information, we will tell the client before responding unless we are legally prevented from doing so.
If, during an examination, we encounter material whose mere possession we reasonably believe to be unlawful, we reserve the right to report it to law enforcement, and will where lawfully permitted inform the client of our intention to do so.
How long we keep it
Enquiry correspondence that does not lead to an engagement is kept for no more than 12 months from our last contact with you and then deleted.
Materials supplied for an engagement are returned, deleted or destroyed at the client's direction on request or at the end of the engagement. If no request is made within three months of the conclusion of our work, we may destroy them under our data destruction policy. Our own working papers, reports and records of the engagement are retained for as long as is necessary to meet our professional, legal and regulatory obligations, including the possibility of being called to give evidence, after which they are securely destroyed.
Your rights
Under the UK GDPR you have the right to ask for access to the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, and in some circumstances to receive it in a portable form. These rights are not absolute: in particular, where personal data forms part of evidence in an investigation or legal proceedings, exemptions may apply and we may be unable to release, amend or delete it. We will explain the position when we respond.
To exercise any of these rights, contact info@tkmtechnologies.com. We will respond within one month, or tell you if we need longer. If the data relates to a matter on which we have been instructed by a client, we will consult the client before responding, as our engagement terms require.
If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would welcome the chance to address your concern first.
Changes to this notice
We review this notice periodically and will publish any changes on this page with a revised date.