How we handle personal information
Who is responsible
TDH3 Systems Ltd (company number 17419887), registered in England and Wales, with its registered office at 27 Old Gloucester Street, London, England, WC1N 3AX, is responsible for personal information where TDH3 Systems determines why and how it is used. This includes public website and sales enquiries, TDH3 account and subscription administration, provider support administration, security and abuse prevention, and business records TDH3 must keep for its own purposes.
For personal data a business customer places in its TDH3 operational workspace for that customer's own business purposes, the customer normally acts as controller and TDH3 Systems normally acts as processor on the customer's documented instructions. See the data processing terms for that relationship.
Information we may process
For website, account, billing and support purposes we may process company and contact names, work email address, phone number, account and subscription identifiers, support correspondence, security/request metadata and information supplied in a sales or support request.
Customer operational workspaces may contain business contacts, job and site details, employee or subcontractor allocation information, qualification and competence evidence, operational notes, documents, communications history, delivery/evidence records and related audit data. TDH3 does not require customers to place unnecessary special-category or criminal-offence data in the service.
Why we use controller data
We use controller data to respond to B2B enquiries, take pre-contract steps, administer customer accounts and subscriptions, provide support, operate and secure the service, prevent abuse, maintain proportionate business records and comply with legal obligations. Depending on the activity, the lawful basis may include taking steps before or performing a contract, our legitimate interests in operating and protecting a B2B service, or compliance with a legal obligation.
We may also identify and contact relevant business decision-makers to introduce TDH3 Systems. Where we use a named person's business contact details for targeted B2B prospecting, we normally rely on legitimate interests after considering necessity and the person's rights and reasonable expectations. We do not treat the public availability of contact details as consent, and we do not use this basis to override electronic-marketing rules that require consent for particular recipients or channels.
Where prospect information comes from
Where we did not collect prospect information directly from you, it may come from publicly available business sources such as your organisation's website, Companies House records where relevant, reputable business directories, or professional and social networks used in a business context. We record the source where appropriate and provide this privacy information at or before the first direct contact where required.
You can object to direct marketing at any time. If you do, we will stop using your details for direct marketing and may retain only the minimum suppression information needed to make sure we do not contact you again for that purpose.
Customer operational data
When TDH3 acts as processor, the customer decides the purpose and lawful basis for the operational personal data it places in TDH3. TDH3 processes that data to provide the authorised service, tenant isolation, storage, retrieval, security, backup/recovery and customer-selected workflows. Rights requests concerning customer operational data should normally be made to the customer controller; TDH3 will provide reasonable assistance to the customer as described in the data processing terms.
Service providers and sharing
We use specialist providers where needed to host, secure, back up and bill for the service. Core operational infrastructure currently includes Supabase and Vercel, with Cloudflare R2 used for independent retained-document backup. Stripe is used for TDH3 subscription billing. Optional email, messaging, telephony, telematics, accounting or other providers are not treated as active merely because the product contains an integration boundary; provider processing begins only when the relevant service is approved, configured and enabled.
We do not sell personal information. We may disclose information where needed to provide an authorised service, comply with law, protect the platform or users, or establish, exercise or defend legal rights.
International transfers
Where a processing route involves a restricted transfer outside the UK, we use an applicable lawful transfer route such as UK adequacy regulations or appropriate safeguards, together with any assessment required for the selected safeguard. Transfer arrangements are reviewed against the providers and locations actually used by the production service.
Retention and deletion
We retain controller data only for as long as reasonably needed for the purpose for which it was collected, applicable contractual/accounting/security needs and legal obligations. Prospect records are periodically reviewed rather than retained indefinitely.
Operational customer data follows the active service, customer instructions and record-specific legal or operational requirements. End-of-service export/deletion does not mean that every protected backup copy disappears instantly: data removed from live use may remain inaccessible in time-limited recovery copies until the relevant backup deletion cycle completes.
Your rights and complaints
UK data-protection law may give you rights of access, correction, erasure, restriction, objection and data portability depending on the circumstances. Where TDH3 is controller, you can raise the request directly with us. Where a customer controls the operational record, the customer is normally the correct first contact and TDH3 will assist it as processor.
You may also complain to the UK Information Commissioner's Office.
Contact
Send a privacy or data request through the website →
Last updated: 1 September 2026.