Privacy Policy

01. Who we are

Torsik Ltd (Company No. 16864103), registered in England and Wales. Registered office: Bartle House, Oxford Court, Manchester, England, M2 3WQ. Email: info@torsik.co.uk.

Torsik Ltd is the data controller under UK GDPR. We are registered with the Information Commissioner's Office (ICO), registration number ZC138992.

02. The data we collect

We collect:

• Name.
• Email address.
• Company.
• Job title.
• Phone number.
• The content of any message, enquiry, form, historical diagnostic response, email or application you send us.
• Newsletter subscription, unsubscribe and suppression records.
• Website, form, historical diagnostic, campaign, landing-page, attribution, consent and event records where they relate to a named person or company.
• When a personalised Torsik link is used, the link reference and limited request information used to classify the request as Likely security or Likely human. This can include IP-derived country, a protected IP hash, device type, browser family, operating-system family and automation or security signals. We do not place the raw IP address in Zoho CRM.
• Where a personalised-link request is classified as Likely human, the fact that the link was used and related campaign context may be recorded against the CRM record assigned to that link. A forwarded link or shared device means this does not prove that the named person used it.
• After you select Accept all, which gives Marketing consent, a personalised-link visit may also be connected to later website activity. This can include pages viewed, measured active time, recorded actions, broad device, browser, operating-system and country information, consent evidence and the relevant campaign reference.
• Privacy-limited first-party website statistics, such as page path, event type, source fields, referrer domain, device type, browser family, viewport size, scroll depth, clicks and form attempts.
• Search performance records from Google Search Console, including search terms, aggregate clicks and impressions, the Torsik page shown, country, device and indexing status. Search terms may occasionally contain information entered by a user.
• Search-ranking records from DataForSEO for a fixed list of Torsik business keywords, including rank, result domain and a sanitised result URL without credentials, query strings or fragments. A public result URL path may occasionally contain a person's name.
• Candidate or applicant information where someone applies for, or is introduced for, a Torsik role.
• Client, prospect and project information shared with us during commercial discussions or delivery.

We do not intentionally collect special category data through the website. Please do not send us sensitive personal information through the website.

03. Why we use it

We process personal data to:

• Respond to enquiries.
• Arrange and hold clarity calls.
• Assess whether our services suit your needs.
• Enter into and perform consulting agreements.
• Maintain our client, prospect, supplier, applicant and operational records.
• Classify personalised-link requests as Likely security or Likely human, exclude Likely security requests from Zoho CRM, and record a narrow Likely human response signal so our team can measure the campaign and plan proportionate follow-up.
• After Accept all gives Marketing consent, connect a personalised-link website journey to the assigned Zoho CRM record so our team can understand campaign response and tailor proportionate follow-up.
• Send marketing communications where you have asked us to or where we are otherwise permitted.
• Run form routes and newsletter flows, and retain historical diagnostic records while the approved retention position is completed.
• Review candidates and manage recruitment routes.
• Prepare internal research, analysis, drafts, transcripts and operational records.
• Measure and improve how the website and related routes perform, including privacy-limited first-party aggregate statistics where the cookie rules allow this and you have not objected, and consented analytics such as GA4 and Microsoft Clarity heatmaps or session replay where analytics cookies are accepted.
• Measure how Torsik pages appear in search results, identify indexing problems and improve the relevance of our public website.
• Preserve audit trails, consent records, source-system records, contract records and compliance evidence.

04. Our lawful basis

We rely on:

• Legitimate interests, for business-to-business communication, responding to enquiries, running and improving our service, privacy-limited first-party aggregate website statistics where the cookie rules allow this and you have not objected, classifying a personalised-link request as Likely security or Likely human, recording a narrow Likely human campaign response against the assigned business contact, understanding search performance, fixing indexing problems, preserving business records, handling recruitment routes and keeping evidence of how records entered our systems.
• Contractual necessity, where we are entering into or performing an agreement with you.
• Consent, for marketing where consent is required, non-essential cookies that require it, and linking website activity to the CRM record assigned to a personalised link after Accept all gives Marketing consent.
• Legal obligation, where we need to keep records for tax, accounting, regulatory or legal reasons.

Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us about that assessment at any time.

When a personalised Torsik link is first used, we may use limited request information to classify it as Likely security or Likely human. We use the raw IP address only long enough to derive limited location information and a protected hash, then delete the raw value from this process. A Likely security request creates no Zoho CRM event. If the request is Likely human, we may record that the personalised link was used against the CRM record assigned to it. This initial response record does not include the person's later page journey. If you select Accept all, Marketing consent allows us to connect later website activity from that personalised link to the assigned CRM record. A forwarded link or shared device means the association does not prove that the named person was the visitor.

05. Service providers we use

We share personal data with trusted providers who process it on our behalf, under written terms that require them to protect it and use it only as we instruct:

• Website hosting, staging, rollback and domains: Hostinger, Squarespace and GoDaddy.
• Website operational database, consent, form, event and outbox records: PostgreSQL.
• Website analytics, search performance, statistics and reporting: Torsik first-party website analytics, Google Analytics 4, Google Search Console, Microsoft Clarity, DataForSEO and Google Cloud BigQuery.
• Customer relationship management (CRM): Zoho CRM.
• Invoicing and accounting: Zoho Books.
• Email, calendar and file storage: Google Workspace (Gmail, Drive and Calendar) and Apple iCloud.
• Project management, documents and knowledge base: Notion.
• Internal messaging and agent-access gateways: Slack.
• Hosted AI-agent computer infrastructure: Orgo.
• Email and newsletters: MailerLite.
• Historical diagnostic records: ScoreApp, pending the approved retention decision.
• Automation and handoff routes: Zapier.
• Video conferencing: Google Meet, Microsoft Teams and Zoom, whichever a client prefers.
• Artificial intelligence tools: see section 6.
• Audio, transcription, text-to-speech and workstation productivity: Speechify API, Speechify and Wispr Flow.
• Documents and notes: Obsidian and Obsidian Sync.
• Recruitment and candidate sourcing: SalesAgents.uk.
• Social media: LinkedIn, Instagram (Meta) and X, where you interact with our pages or embedded content.

We do not sell your personal data.

Some retired, rollback or transitional systems may still hold historic records while we preserve audit trails, export records or complete deletion checks. ClickUp is retired as a current task system, but historic data has not yet been deleted. HubSpot, SurveyMonkey, Teamwork and Zoho Inventory are not current operating systems. Mailchimp is not a current email platform and is treated as a retired test system unless later evidence shows real customer or prospect data remains there.

06. How we use AI

We use artificial intelligence tools and related agent infrastructure to help prepare internal research, analysis, draft materials, transcripts, operational records and delivery support. Current AI providers may include OpenAI, Anthropic (Claude) and Google systems, including Gemini and NotebookLM. Orgo may provide hosted cloud computers used by AI agents. xAI (Grok) and Perplexity are not treated as adopted operational processors unless later evidence confirms use.

Where these tools process personal data:

• We use them on business terms that do not allow the provider to train its models on our data.
• Providers retain prompts and outputs only for the limited periods set out in their own business terms.
• AI-assisted output is reviewed by a person before it is delivered to a client.

Please do not submit confidential material through the website. Confidential information should only be shared once a written agreement is in place.

07. Sending data outside the UK

Some of our providers, including some of the AI tools above, are based outside the UK, including in the United States. Where we transfer personal data abroad, we rely on a recognised safeguard:

• UK adequacy regulations, where the destination country is covered.
• The UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), where the US provider is certified under it.
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, in other cases.

We take reasonable steps to make sure your data is protected to a UK standard wherever it is processed.

08. How long we keep it

We keep personal data:

• For the duration of our relationship with you.
• For up to six years after that, where we may need it to defend a legal claim, meet a legal obligation, keep accounting records or preserve a business audit trail.
• Marketing data, until you withdraw consent or ask us to stop.
• Candidate and applicant data only for as long as needed for the recruitment purpose, unless we need to keep a limited record for legal, accounting or audit reasons.
• Retired-system records only while we need to preserve evidence, complete an export or deletion check, or keep a lawful audit trail.
• Detailed identifiable records used to assess a personalised-link request or record a person's consented website journey are kept for up to 24 months from collection.
• Other personal records created by this personalised-link and website-measurement flow, including Likely human response records, campaign attribution, consent evidence and CRM journey summaries, are kept for up to five years from collection.
• We remove these records earlier when they are inaccurate, no longer serve an active business purpose, or your rights require removal or anonymisation. Selecting Reject optional stops new Marketing-consented journey collection. An objection stops further use of the Likely human response record. We retain only the minimum suppression evidence needed to respect that choice.
• Individual-level first-party website event records collected only to produce aggregate statistics are kept only as long as needed to produce them and never beyond the applicable period above. Truly anonymised aggregate statistics that no longer identify or single out a visitor may be kept indefinitely.
• Restricted search-performance facts and daily history for up to 16 months. Sanitised ingestion and cost-control ledgers are kept for up to 24 months.

09. Your rights

Under UK GDPR you have the right to:

• Access your data.
• Correct inaccurate data.
• Erase data, where the law allows.
• Restrict how we use it.
• Object to processing.
• Data portability.
• Withdraw consent at any time, where we rely on it.

To exercise any of these, including objecting to the first-request signal, email info@torsik.co.uk. You can withdraw Marketing and other optional cookie consent at any time through Cookie settings by selecting Reject optional. We will respond within one month.

10. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. Email info@torsik.co.uk. We operate a formal complaints procedure: we will acknowledge your complaint promptly and respond within one month.

If you remain dissatisfied, you have the right to complain to the ICO at any time. Telling us first may help resolve the issue faster.

ICO: ico.org.uk, or 0303 123 1113.

11. Cookies

We use cookies and similar technologies on this website. How they work, which ones we use, and how to manage them are set out in our Cookie Policy.

12. Security

We protect your data with secure hosting, access controls and other commercially reasonable safeguards. No system is ever completely secure, but we take the protection of your data seriously.

13. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always appear on this page, with the date at the top.