Privacy Policy

This policy explains what personal data Tingeworks collects, why, on what legal basis, and what rights you have over it. It is written to satisfy Articles 13 and 14 of the UK and EU General Data Protection Regulation (GDPR).

Who is responsible for your data

Tingeworks is the data controller for the personal data described here.

• Address: Ventura Iconia, Holding 37, Road No. 11, Block H, Banani, Dhaka 1213, Bangladesh
• Email: privacy@tingeworks.com

We have not appointed a Data Protection Officer, as we are not required to under Article 37.

What this website collects

This website uses no cookies for analytics, advertising, or tracking, and asks for no consent because none is needed. We run no analytics, no advertising pixels, and no third-party scripts. We store nothing on your device. Fonts are served from our own servers rather than from a third-party CDN, so loading a page here sends no request from your browser to an external company.

Our hosting provider, Cloudflare, processes standard server request data (IP address, timestamp, user agent, requested URL) to deliver the site and protect it from abuse, and may set a strictly necessary security cookie (__cf_bm, which expires after about 30 minutes) to distinguish automated traffic from real visitors. Under the ePrivacy Directive this category of cookie does not require consent. Cloudflare retains the request data for a short period; we do not use it to identify or profile visitors.

What the consultation form collects

If you submit the form on our consult page, we collect:

Legal basis: your consent, under Article 6(1)(a), given by ticking the consent box. Where the exchange progresses towards an engagement, our continued processing rests on the necessity of taking steps at your request prior to entering a contract, under Article 6(1)(b).

Retention: enquiry data is kept for 24 months from your last contact with us, then deleted. If the enquiry becomes a project, the data is retained for the duration of the engagement and for six years afterwards, where we are required to retain records relating to a contract.

Recipients: enquiry data is read by Tingeworks staff and stored in our email system. We do not sell it, do not use it for marketing, and do not share it with third parties other than the processors listed below.

Research participant data

Where we conduct user research, we may process personal data about participants — including recordings, transcripts, and observation notes.

• Participation is always voluntary and on the basis of specific, informed consent obtained before any session.
• Findings are reported in anonymised or pseudonymised form unless a participant has separately agreed to be identified.
• Recordings are stored encrypted and deleted on the schedule agreed with the client, and no later than 12 months after the study concludes unless a longer period is separately agreed.
• Where a client determines the purposes of the research, that client is the controller and Tingeworks acts as a processor under a data processing agreement compliant with Article 28.
• Participants may withdraw at any point during or after a session and have their data erased, with no need to give a reason.

Processors we use

Where a processor is located outside the European Economic Area, transfers are made under the European Commission’s Standard Contractual Clauses or an adequacy decision.

Bangladesh is not the subject of an EU adequacy decision. Where we process the personal data of EU or UK residents in Bangladesh, we do so under Standard Contractual Clauses and appropriate supplementary measures, and we will provide a copy of the relevant safeguards on request.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Article 15)
• Rectify inaccurate or incomplete data (Article 16)
• Erase your data — the “right to be forgotten” (Article 17)
• Restrict how we process it (Article 18)
• Portability — receive your data in a machine-readable format (Article 20)
• Object to processing based on legitimate interests (Article 21)
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3))

To exercise any of these, email privacy@tingeworks.com. We will respond within one month, as required by Article 12(3).

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with a supervisory authority in the EU or UK member state where you live, work, or where the alleged infringement took place. We would appreciate the chance to address it first, but you are not required to contact us before complaining.

Security

Data is transmitted over TLS and stored on services protected by access control and encryption at rest. No system is perfectly secure; if a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform you where Article 34 requires it.

Children

This website is not directed at children and we do not knowingly collect data from anyone under 16.

Changes

We may update this policy. The date at the top reflects the most recent revision. Material changes affecting how we use data already collected will be notified directly where we hold contact details for you.