Privacy policy

Last updated: 29 June 2026

This privacy policy explains how Tadash Ltd (“Tadash”, “we”, “us”, or “our”) collects, uses, stores, and protects personal data when you visit our website, request a demo, or otherwise communicate with us.

Tadash is energy audit infrastructure for UK ESOS Lead Assessors. This policy applies to our public website at www.tadash.co.uk and the related demo and marketing activities described below. It does not govern the Tadash product platform — see “What this policy covers” below.

For any privacy question or request, contact us at nizaam@tadash.co.uk.

1. Who we are

Tadash Ltd is a company based in the United Kingdom. For the purposes of UK data protection law — including the UK GDPR and the Data Protection Act 2018 — Tadash acts as the data controller for personal data collected through our website, demo requests, enquiries, and marketing communications.

Where customers use the Tadash platform to carry out energy audits, Tadash generally acts as a data processor on behalf of the customer (typically a Lead Assessor’s firm), under a separate agreement and data processing terms. That processing is not governed by this policy.

2. What this policy covers

This policy covers personal data we process in connection with:

  • your use of our website;
  • demo requests and sales enquiries;
  • communications between you and our team;
  • marketing communications, where permitted.

This policy does not cover the Tadash product platform, which is hosted separately and made available to pilot customers under a separate beta or pilot agreement and a data processing agreement (DPA). Audit data, evidence, client and site information, and assessor records submitted to the platform are processed under those agreements — not under this website policy. See “The Tadash platform” below.

3. Information we collect

Information you provide to us

You may provide personal data when you request a demo, contact us, subscribe to updates, or otherwise communicate with us. This may include:

  • name;
  • work email address;
  • company or organisation name;
  • job title or professional role;
  • demo request and enquiry details;
  • messages, feedback, or support requests.

Information we collect automatically

When you visit our website, we may automatically collect limited technical data, including:

  • IP address;
  • browser type and version;
  • device type and operating system;
  • pages visited and referring source;
  • date and time of access;
  • server and security logs.

We use this information to operate the website, understand how it is used, maintain performance, and protect against misuse or security issues.

4. How we use your information

We use personal data to:

  • operate and maintain our website;
  • respond to demo requests and arrange demonstrations;
  • respond to enquiries and provide support;
  • improve our website and understand how it is used;
  • send service-related communications;
  • send marketing communications where permitted by law;
  • protect our website, systems, and business;
  • comply with legal, regulatory, and accounting obligations.

We do not use personal data collected through our website for automated decision-making that produces legal or similarly significant effects.

5. Legal bases for processing

Under the UK GDPR, we process personal data only where we have a lawful basis. These may include:

  • Legitimate interests — operating and securing our website, responding to enquiries, and developing our business, where those interests are not overridden by your rights and freedoms.
  • Consent — where required, including for certain non-essential cookies or analytics and for marketing communications. You may withdraw consent at any time.
  • Steps prior to a contract — where processing is necessary to respond to your request or take steps towards entering an agreement with you or your organisation.
  • Legal obligation — where processing is necessary to comply with applicable laws, regulations, or accounting requirements.

6. Cookies and analytics

Our website currently uses only essential cookies necessary for the site to function and to keep it secure. We do not currently set non-essential analytics or advertising cookies.

If we introduce analytics or other non-essential technologies in future, we will update this policy and, where required by law, ask for your consent before they are used. You can manage cookies through your browser settings, and through any cookie preferences tool we make available. Disabling cookies may affect some features but should not prevent basic access to the website.

7. The Tadash platform

Access to the Tadash product platform is provided separately to pilot customers and is governed by a separate beta or pilot agreement and a data processing agreement, not by this website policy.

As part of delivering the platform, we process audit, evidence, client, site, and assessor data on our customers’ instructions, and may use trusted third-party service providers — including third-party AI and large language model providers — to help deliver platform features. Where we do so, that processing, and the safeguards applied to it, are described in the separate agreement and data processing agreement.

Please do not submit confidential, client, or sensitive personal data through our website contact or demo channels. Those channels are for enquiries only.

8. How we share information

We do not sell personal data.

We may share personal data with trusted third-party service providers who help us operate our website and business. These may include categories such as:

  • website hosting and cloud infrastructure providers;
  • email and productivity tools;
  • demo scheduling and customer communication tools;
  • security and monitoring tools;
  • professional advisers, where necessary.

These providers may only process personal data as needed to provide their services to us and are required to protect it under appropriate contractual and security obligations. We may also disclose personal data where required by law, regulation, court order, or a legitimate request from an authority, and in connection with a corporate transaction such as a merger, acquisition, or sale of assets.

9. International data transfers

Some of our service providers may operate outside the United Kingdom. Where personal data is transferred outside the UK, we use appropriate safeguards where required, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, adequacy regulations, or another legally recognised transfer mechanism.

10. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy. Retention periods vary by the type of data:

  • demo request and enquiry data is kept for as long as needed to respond and to manage a potential customer relationship;
  • marketing data is kept until you opt out or it is no longer needed;
  • technical and security logs are kept for a limited period;
  • legal, billing, and business records are kept for longer where required by law.

When data is no longer needed, we delete or anonymise it, or retain it securely only where legally required.

11. Data security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These may include access controls, secure authentication, encryption where appropriate, monitoring and logging, limited internal access, and reputable cloud infrastructure. No online service can be guaranteed to be completely secure, but we take reasonable steps to protect the information we process.

12. Your rights

Depending on your circumstances and applicable law, you may have the right to:

  • request access to your personal data;
  • request correction of inaccurate data;
  • request deletion of your data;
  • object to or restrict certain processing;
  • request data portability;
  • withdraw consent where processing is based on consent;
  • object to direct marketing.

To exercise your rights, contact us at nizaam@tadash.co.uk. We may need to verify your identity before responding. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

13. Marketing communications

If you request a demo or express interest in Tadash, we may send you relevant product or company communications where permitted by law. You can opt out of marketing emails at any time using the unsubscribe link in our emails or by contacting us at nizaam@tadash.co.uk. We may still send you service-related communications where necessary.

14. Children’s privacy

Our website is intended for business and professional use and is not directed at children. We do not knowingly collect personal data from children. If we become aware that we have done so, we will take steps to delete it.

15. Third-party links

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices, content, or security of those third parties. We encourage you to review their privacy policies before providing personal data.

16. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal obligations. When we do, we will revise the “Last updated” date at the top of this page. Your continued use of our website after changes are posted means you acknowledge the updated policy.

17. Contact us

If you have questions, concerns, or requests about this privacy policy or how Tadash handles personal data, contact us at:

Tadash Ltd
United Kingdom
Email: nizaam@tadash.co.uk

Our registered office and company registration details are available on request. See also our terms of use.