Privacy notice
How Tarlo Ltd uses personal information
Last updated: 3 November 2026
Who we are
Tarlo Ltd (Tarlo, we, us) is an IT, security, privacy and AI governance consultancy. We are a company registered in England and Wales (company number 17554021) with our registered office at 4th Floor, 14 Museum Place, Cardiff CF10 3BH.
This notice explains how we collect and use personal information when we decide how and why it is used (when we are the controller). That includes when you visit our website, use our health checks, get in touch, receive updates from us, work with us as a client contact, partner, supplier or associate, or apply to work with us.
When we act for our clients. Much of our work involves handling personal information on behalf of our clients, for example when we run a client's managed security or privacy operations, or act as a client's data protection officer. In that work we act as the client's processor, following their instructions, and the client's own privacy notice applies. If your question is about that processing, please contact the client organisation. We will help them respond.
How to contact us
Our privacy lead is Marc Troake, Director. You can contact us about this notice or your personal information by:
- email: [email protected];
- post: Privacy, Tarlo Ltd, 4th Floor, 14 Museum Place, Cardiff CF10 3BH.
We are not legally required to appoint a data protection officer, so we have a named privacy lead instead.
What we collect, why, our lawful basis and how long we keep it
The table below sets out the personal information we use, why we use it, the lawful basis we rely on under the UK GDPR, and how long we keep it. We keep information only for as long as we need it for the purpose we collected it for, or for as long as the law requires.
| Who you are | What we collect | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|---|
| Website visitor | Your cookie choice, recorded by our consent tool, Cookiebot (a consent ID, the date and time, and basic browser and device details). Only if you accept statistics cookies: how you use our pages (heatmaps and visit recordings, with what you type masked), plus device, browser and approximate location, collected by Microsoft Clarity; and page counts from Cloudflare Web Analytics. Statistics tools never run on our health check pages. Security and access logs kept by our website host, 123 Reg (IP address, browser, pages requested, date and time) | To record your cookie choice, understand how the site is used and improve it, and keep the site secure and working | Statistics tools: your consent, which you can withdraw at any time with Cookie settings at the bottom of every page. Record of your cookie choice: legal obligation (to show what you agreed to). Security logs: legitimate interests (keeping our website secure and working) | Your cookie choice: for the period shown in our cookie declaration, then we ask again. Cookiebot's record of your choice: 12 months. Clarity playback data: 30 days. Heatmap and click data, and sessions we label or favourite: 9 months. Host logs: for the period set by 123 Reg |
| Someone who contacts us (email, phone, LinkedIn) | Name, job title, organisation, contact details, your message and our reply | To answer your enquiry and, if you ask, give you a proposal or quote | Legitimate interests (responding to enquiries); steps you ask us to take before entering a contract | 2 years after our last contact, unless you become a client |
| Someone who books a call with us | Name, email address, phone number (if given), organisation, your answers to our booking questions, and the date and time you choose | To arrange and hold the call, usually by Microsoft Teams, using Microsoft Bookings | Steps you ask us to take before entering a contract; legitimate interests (responding to your request) | 2 years after the call, unless you become a client |
| Someone who uses our free health checks | Your answers stay in your browser unless you choose to send your results to us with the form on the results page. If you do: your name, work email address, company (if given), your answers, score and recommendations, which boxes you ticked, and the date and time you sent them | To look at your results before any call with you; to contact you about your results, only if you tick that box; to send you occasional Tarlo news, only if you tick that box | Your consent (you choose to send your results, and each tick box is a separate choice). You can withdraw it at any time | 90 days after you send them, if you did not ask us to contact you and did not book a call. Otherwise 2 years after our last contact with you, unless you become a client. You can ask us to delete them sooner |
| Prospective client or business contact (including people we meet at events, connect with on LinkedIn, or are introduced to by a partner) | Name, job title, organisation, business contact details, information from your public professional profile, who introduced us, notes of our conversations | To develop our business and tell you about services relevant to your role | Legitimate interests (business-to-business marketing and business development) | 2 years after our last meaningful contact |
| Subscriber to our updates | Name, email address, organisation, your preferences and unsubscribe history | To send you our updates and insights | Consent, where the law requires it (for example a personal email address or a sole trader); otherwise legitimate interests. You can unsubscribe at any time | Until you unsubscribe. We then keep your email address on a suppression list so we do not contact you again |
| Client contact | Name, job title, contact details, communications, meeting notes, contract and billing details | To deliver our services, manage our relationship, invoice and keep proper business records | Contract (if you are personally our client, for example as a sole trader); otherwise legitimate interests; legal obligation (accounting and tax records) | 6 years after the end of the financial year in which our contract ends |
| Partner, supplier, associate or contractor | Name, company, contact details, payment details, CV, qualifications and certifications, insurance details. Where client work requires it: identity, right to work, references, employment history and a basic criminal record (DBS) check | To engage and pay you, and to meet our clients' security vetting requirements | Contract; legitimate interests; legal obligation (right to work checks). For criminal record checks: a condition in Schedule 1 of the Data Protection Act 2018, under our appropriate policy document | 6 years after the end of the financial year in which the engagement ends. For DBS checks we record only that the check was done, its date and the outcome; we do not copy certificates, and we delete any certificate information within 6 months |
| Job applicant | CV, application details, interview notes, references, right to work documents. Optional equality monitoring information, which may include special category data | To assess your application and meet our legal obligations as an employer | Steps before entering a contract; legal obligation; legitimate interests. Equality monitoring: your explicit consent | If unsuccessful, 6 months after our decision (12 months if you agree we can consider you for future roles). If successful, it becomes part of your staff record |
| Someone who makes a complaint or uses a data protection right | Your contact details, your request or complaint, our correspondence and the outcome | To handle your request or complaint and keep a record of how we dealt with it | Legal obligation (UK GDPR and the Data Protection Act 2018) | 3 years after the matter is closed |
Health check results: who sees them and when we delete them
If you send us your health check results, they arrive in a Tarlo mailbox that only our three directors can access. We use them only for the purposes in the table above. We delete them at the end of the retention period, or sooner if you ask us to.
To stop the form being misused, our results service (run on Cloudflare) keeps short-lived technical records, such as counts of recent requests. It stores a scrambled (hashed) form of your IP address, not the address itself, and it does not keep your name, email address or answers. These records are deleted within about 24 hours.
Calls, meetings and AI
If we record or transcribe a call or meeting (for example using Microsoft Teams), we will tell you at the start. You can ask us not to.
We use AI tools, Microsoft 365 Copilot and Claude (made by Anthropic), to help us draft, summarise and analyse information. We use them only with settings or terms under which the provider does not use what we enter to train its AI models. A person at Tarlo reviews anything they help produce. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Microsoft Clarity
If you accept statistics cookies, we use Microsoft Clarity to see how visitors use our website. Clarity never runs on our health check pages. Microsoft acts as a controller for the information Clarity collects, so Microsoft's own privacy statement also applies to it: the Microsoft Privacy Statement. You can change your choice at any time with Cookie settings at the bottom of every page. Clarity retains playback data for 30 days. Heatmap and click data, and sessions we label or favourite, are retained for 9 months.
Where we get your information
Most information comes from you. We may also receive it from:
- your employer or organisation, for example when you are named as a contact for a project;
- publicly available sources, such as LinkedIn, Companies House and organisation websites;
- people who introduce us, such as referral partners, technology vendors, distributors and event organisers;
- vetting and reference providers, and referees you nominate (for associates and job applicants).
Who we share it with
We do not sell personal information. We share it only where needed, with:
- service providers who process it for us under contract (listed below);
- professional advisers, such as our accountants, lawyers and insurers;
- partners and subcontractors who help us deliver client work, under contracts that protect your information;
- clients, where we propose an associate for their work (with the associate's agreement);
- regulators, law enforcement, courts and other authorities, where the law requires it or to protect our legal rights;
- a buyer or investor, if we sell or restructure our business, under confidentiality obligations.
| Service provider | What they do for us | Where data is processed |
|---|---|---|
| Microsoft (Microsoft 365: Outlook, Teams, SharePoint and OneDrive, Bookings and Copilot) | Email, file storage, calls and collaboration, call bookings, receiving health check results you send us, and AI drafting and summarising | UK and EU |
| 123 Reg | Hosts our website and keeps security logs | Europe (the hosting region selected for our website). 123 Reg says it may also transfer data to the US or other countries where it or its providers operate |
| Cloudflare | Runs the service that receives health check results, checks the form for spam (Turnstile) and, if you accept statistics cookies, counts page views | UK, EU and other countries, including the US |
| Usercentrics (Cookiebot) | Shows the cookie banner and records your cookie choice | EU |
| Monzo | Business bank account: payments we make and receive | UK and EU |
| Anthropic (Claude) | AI drafting, summarising and analysis | US and other countries |
International transfers
Some of our service providers and delivery partners process information outside the UK, for example in the European Economic Area, the United States or India. When that happens, your information stays protected by one of the safeguards UK law allows: UK adequacy regulations (for example for the EEA), the UK extension to the EU-US Data Privacy Framework (the UK-US data bridge) for certified US organisations, or the ICO's International Data Transfer Agreement or Addendum, backed by a transfer risk assessment. You can ask us for more information about these safeguards.
How we keep your information secure
We protect personal information with measures appropriate to the risk, including multi-factor authentication, encryption, access limited to people who need it, managed and protected devices, and training.
Your rights
You have the right to:
- access the personal information we hold about you and receive a copy;
- ask us to correct inaccurate or incomplete information;
- ask us to delete your information;
- ask us to restrict how we use your information;
- object to how we use your information where we rely on legitimate interests, and to object at any time to direct marketing, which we will always respect;
- ask us to transfer information you gave us to you or another organisation (data portability), where it applies;
- withdraw your consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.
Some rights apply only in certain circumstances. To make a request, contact us using the details above. We will respond within one month. If your request is complex, we may extend this by up to two further months and will tell you why. We may need to confirm your identity, and if we need more information to deal with your request, the time limit starts once we receive it. We will carry out reasonable and proportionate searches to find your information.
Complaints
If you are unhappy with how we have used your personal information, please tell us first at [email protected]. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113. The ICO may ask whether you have raised your concern with us first.
Children
Our website and services are for businesses and are not aimed at children. We do not knowingly collect information about children.
Changes to this notice
We review this notice regularly and will update it when the way we use personal information changes. The date at the top shows when it was last updated. Our cookie policy explains the cookies and similar technologies on our website.