Legal
How Tea Powered Projects Limited collects, uses, and protects your personal data.
Tea Powered Projects Limited is the data controller for the personal data described in this policy.
Company number: 10542712
Registered office: C/O XNM Accountancy Limited, Creative Suite 1, Mill 3, Pleasley Vale Business Park, Mansfield, NG19 8RL
Email: hello@teapowered.pro
Phone: +44 (0) 115 647 1900
ICO registration number: ZB004209
This policy covers personal data we handle as a controller: visitors to teapowered.pro, people who enquire about our services, our clients' contact details and billing information, and people at businesses we contact about our services.
It does not cover the personal data we handle on behalf of our clients when we run their website or platform. There we are a processor and the client is the controller. That relationship is governed by our Data Processing Agreement.
Name, email, phone, company, message - To answer your enquiry and, if it goes ahead, to prepare a quote. Steps taken at your request before entering a contract.
Client contact details - To run the project and support your account. Performance of our contract with you.
Billing address, invoice records, payment references - To invoice you and keep accounting records. Legal obligation (tax and company law).
Website usage data - pages viewed (including the full page address), referrer, approximate location, device and browser - To understand how the site is used and improve it. Consent, given through the cookie banner.
Ad click reference - If you reach our site from one of our Google ads, Google adds a click reference to the page address. We send it with your enquiry, and later tell Google Ads whether that click led to an enquiry or a signed project, so we can see which ads bring in work. Our legitimate interests in measuring our own advertising. We send Google only the click reference, the type of result, its value and the date. We never send your name, email, phone number or message. We store nothing on your device to do this.
IP address, browser and request details - To keep the site secure - preventing form abuse, limiting automated requests, and detecting bots. Our legitimate interests in protecting the site and the people who use it.
Marketing emails - To tell you about our services. Consent, or the soft opt-in where you are an existing customer and we offer similar services. Unsubscribe in any email. If we have contacted your business without you asking us to, see "Business contacts we approach" below.
We do not collect special category data. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
From time to time we email businesses that have not contacted us first, to point out a specific problem we have noticed with their website or email set-up and to offer to help fix it. This section explains what we use and why.
We only contact limited companies, limited liability partnerships and other incorporated businesses. We do not send unrequested marketing emails to sole traders or ordinary partnerships, and we do not use personal or home email addresses.
Your business details - The company name, website, business address and phone number, from the company's own website and public business directories.
Business email address - The address your company publishes on its own website, usually a general inbox such as info@ or sales@. Sometimes it is a named address you or your company have published for business contact.
Directors' names - The name and role of a director, from the public register at Companies House, so that an email sent to a general inbox can reach the right person.
What we noticed - The fact our email is about, taken from public information: your domain's public email security records, or something visible on your website, such as a security warning or a form that does not work.
Our emails and your replies - What we sent, when, and any reply you send us.
We do not use dates of birth, home addresses or personal social media, and we do not buy contact lists.
We do this to find new business customers for our website, IT and email security services. Our lawful basis is our legitimate interests in marketing those services to businesses they are relevant to. We have weighed that against your interests in a written assessment. We keep the contact low in volume and specific to your business, we use only business contact details, and we stop as soon as you ask.
We send a small number of plain emails, one at a time, each one checked by a person before it goes. We do not track whether you open our emails or click anything in them.
You can object at any time, and we will stop. Reply to any of our emails with "no thanks", or email hello@teapowered.pro. We act on it the same working day, by any route we might use to contact you, without asking you to explain.
We then keep your email address or domain on a short "do not contact" list, with the date, so that we never contact you again by mistake. That list is used for nothing else.
If you do not reply, we delete your name, any named email address and our emails 12 months after our last email. If you ask us to stop, we keep only the "do not contact" record described above. If you reply asking to hear more, we treat it as an enquiry and keep it as set out in "How long we keep it" below. Backups are overwritten on their normal cycle and are not restored.
Only us. The emails go through our own Microsoft 365 mailboxes and the records stay on our own systems in the UK. We do not sell or share these details with anyone. Your other rights, and how to complain, are set out below.
We use one cookie, for analytics, and we set it only if you accept it. We place no advertising or social media tags or cookies on our site, and nobody else places tags on it. You can change or withdraw your choice at any time. Full detail is in our Cookie Policy.
We use the following providers. Each acts on our instructions under a contract that meets UK GDPR requirements.
DigitalOcean - Hosting and DNS. United Kingdom (London).
Backblaze - Encrypted backups. European Union.
Mailgun - Sending email. European Union.
Microsoft 365 - Our email and documents. United Kingdom / EU.
Stripe - Card payments. United States / EU.
Twilio - SMS notifications. United States.
Namecheap - Domain registration. United States.
Our error monitoring runs on our own systems in the United Kingdom. It is not sent to a third party.
If you clicked one of our Google ads, we also tell Google whether that click led to an enquiry or a project, as described under "Ad click reference" above. Google uses that information as a separate controller, under its own privacy policy. United States / EU.
We do not sell your personal data, and we do not share it for anyone else's marketing.
We do not use Google Analytics, and we place no advertising or social media tracking on our site. Our website analytics are first party and run on our own platform.
We may disclose data where the law requires it, or to establish or defend legal claims.
Our systems, and the data held in them, are hosted in the United Kingdom, and our error monitoring runs on our own UK servers.
Backups and email delivery are handled in the European Union. The UK government has decided that the EEA offers adequate protection for personal data, so those transfers are covered by that decision and need no further safeguard.
A few providers are in the United States - card payments, SMS, domain registration and ad measurement (Google). Where we transfer personal data there we rely on the UK International Data Transfer Agreement, or EU Standard Contractual Clauses with the UK Addendum. We assess each transfer to satisfy ourselves that protection for the data is not materially lower than under UK data protection law.
Enquiries that do not become clients - 12 months from last contact.
Business contacts we approach who do not reply - 12 months from our last email, then deleted.
Requests not to be contacted - The email address or domain and the date, kept for as long as we contact businesses in this way, so we do not contact you again.
Client records - For the life of the contract, then 12 months.
Platform and website data after a subscription ends - Up to 90 days, then deleted. Platform clients receive the full offboarding terms as a schedule to their service agreement.
Invoices and accounting records - 6 years after the end of the financial year, as tax law requires.
Ad click references - Kept with the enquiry they arrived with, for the same period.
Website usage data - 3 years.
Marketing consent records - Until you withdraw consent, plus 12 months to evidence the withdrawal.
You have the right to ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or transfer it to someone else. You can object to processing we base on legitimate interests, and withdraw consent at any time where we rely on it.
Ask us at hello@teapowered.pro. We respond within one month. There is no charge.
If you are unhappy with how we have handled your personal data, tell us and we will deal with it properly.
Make a complaint: use the contact form and begin your message with "Data protection complaint", email hello@teapowered.pro with that as the subject line, or write to us at our registered office.
We will acknowledge your complaint within 30 days of receiving it.
We will then investigate without undue delay, and keep you updated on progress and on when you can expect an answer.
If you are not satisfied with our response, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You can go to the ICO at any point, but raising it with us first is usually quicker.
We review this policy at least once a year and whenever we change how we handle personal data. The date below tells you when it last changed. Where a change materially affects you, we will tell you directly rather than relying on you noticing.
Last updated: 10 November 2026