Legal

Privacy Policy

What we collect (almost nothing), why, who sees it and your rights. In plain English.

Last updated: 15 October 2026

Who we are

Kazap Technologies Ltd ("Kazap", "we", "us") is the data controller for personal data processed through this website and in relation to our services. We are a private limited company registered in England and Wales under company number 08218660, with our registered office at Wellesley House, Duke of Wellington Avenue, Royal Arsenal Riverside, Greenwich, London, SE18 6SS, and we are registered with the Information Commissioner's Office (ICO) under reference ZA300616. You can reach us at contact@kazap.co.uk.

We are committed to protecting your privacy. This policy explains, in plain English, what we collect, why, who sees it and what your rights are under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

The short version

  • No analytics, no tracking pixels, no advertising technology, no profiling and no cookies of our own.
  • If you send us a message, it goes to our inbox, and we use it to reply. Nothing is stored on this website.
  • Our web server keeps standard technical logs for 7 days, then deletes them automatically.
  • We never sell, rent or trade personal data.
  • We do not transfer your personal data outside the UK ourselves, and we give no one outside the UK access to it.

What we collect, and why

Messages you send us. If you use the message form on our Contact page, or email us, we receive your name, your email address, the company or project name if you give it, and whatever you choose to tell us. The form sends your message from our web server straight to our Microsoft 365 mailbox, which Microsoft holds in the UK; the web server does not keep a copy. We use your message to reply, arrange a conversation and, if we work together, deliver that work.

Lawful basis: our legitimate interests in answering enquiries and, where a contract follows, the steps you ask us to take before entering into it and the performance of that contract (UK GDPR Article 6(1)(f) and 6(1)(b)).

Web server logs. Like every web server, ours records each request: the IP address, the date and time, the page requested, the referring page and the browser type. We use these logs only to keep the site secure, find faults and stop abuse. They are kept for 7 days and then deleted automatically.

Lawful basis: our legitimate interest in running a secure, reliable website.

Cloudflare. Every visit passes through Cloudflare, which delivers and protects this site. Cloudflare sees the same technical request data as our server (including your IP address) in order to route traffic, block attacks and keep the site fast, acting as our processor. We have turned off Cloudflare's web analytics and do not use it to track visitors.

What we never do: analytics, tracking, advertising, profiling, selling data, or automated decision-making about you.

Clients and business contacts

Business contacts are personal data too, and we treat them with the same care. We hold the names and contact details of clients, prospective clients, suppliers and the people who work with them when we are in correspondence because one of us is interested in the other's services, when one of us is the other's client, or when you represent or collaborate with one of our clients. Our lawful basis is our legitimate interests or, where a contract exists, its performance.

When we work on a client's own systems, the personal data inside them is covered by our contract with that client, in which we act as their processor, not by this policy.

Who we share it with

Only the service providers ("processors") we need to run this website and our business, each under a written data processing agreement:

Our sister company and development partner in Brazil never receives personal data from this website. We may disclose personal data if the law requires it, for example to a court or regulator. We will never sell, rent or lease your personal data.

Where your data is, and international transfers

Our web server, and the logs on it, are in London, and our Microsoft 365 mailbox and Azure services are in Microsoft's UK South region. We do not transfer personal data outside the UK ourselves, and we give no one outside the UK access to it.

To be completely open about our providers: Cloudflare runs a global network, so a visitor browsing from another country is served by the Cloudflare data centre nearest to them; and Cloudflare, DigitalOcean and Microsoft are groups headquartered in the United States. Each is bound by data processing terms that include the UK International Data Transfer Addendum, so any data they process outside the UK keeps the protection UK law requires.

How long we keep it

  • Web server logs: 7 days, then deleted automatically.
  • Enquiries that do not lead to work: deleted once they are no longer needed, and reviewed at least once a year.
  • Client correspondence and records: for the length of the engagement and up to six years afterwards, the period set by UK tax and limitation rules.

All data is reviewed regularly and deleted when it is no longer relevant or useful.

How we protect it

This website is served only over encrypted connections (HTTPS, with HTTP Strict Transport Security), runs no third-party code, and enforces a strict content security policy. Access to our systems and mailboxes is limited to the people who need it. We review these measures regularly.

Your rights

Under UK GDPR you have the right to:

  • ask for a copy of the personal data we hold about you (a subject access request);
  • have it corrected if it is wrong, or erased;
  • restrict how we use it, or receive it in a portable format;
  • object to our use of it where we rely on legitimate interests. We will then stop, unless we have compelling grounds that the law recognises.

To use any of these rights, email contact@kazap.co.uk. It is free, and we will respond within one month.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first at contact@kazap.co.uk. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office: online at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.

This site links to other websites, such as our social media pages and our providers' policies. Once you leave our site we have no control over those websites, and this policy does not cover them. Please read their own privacy policies.

Changes to this policy

If we change how we handle personal data, for example if we add an online booking tool, this policy will change first and the date at the top will change with it.