Privacy notice

1. Scope and controller

This notice applies to https://cloudtales.co.uk, to correspondence arising from it, and to the end-of-engagement feedback form that refers the reader to this page. It does not apply to any other website to which this site links. The data controller for the purposes of the UK GDPR and the Data Protection Act 2018 is Cloud Tales Ltd (“we”, “us”, “our”), whose registration and contact particulars are set out in section 10.

2. Cookies and browser storage

This website sets no cookies. It carries no advertising tags, no fingerprinting and no third-party embeds. Nothing described in this notice requires consent, and no consent banner is presented.

One item is stored on the visitor’s device. Where a visitor selects light or dark using the theme control in the site header, that selection is recorded in the browser’s local storage. The stored value is the single word “light” or “dark”. It is not transmitted to us or to any third party, is not used to identify, recognise or count visitors, and is removed when browsing data is cleared. Where the control is left set to “match system”, nothing is stored.

3. Analytics

This website runs no analytics script. Our hosting provider records ordinary server-side request logs of the kind kept by every web server. We have access to those only as aggregate traffic figures.

4. Contact

This website provides no contact form and uses no third-party enquiry or form-handling service. The sole contact route offered is a link to info@cloudtales.co.uk, which opens the visitor’s own email client. No data is submitted to, processed by or passed through this website when that link is used.

5. Personal data processed on enquiry

Where you write to us at the address above, we process the personal data contained in your message. That is ordinarily your email address, your name (where you give it), and any information you choose to provide about your organisation or your requirements. We process it in order to respond to the enquiry and, where an engagement follows, to discuss, agree and carry out the work.

The lawful bases are our legitimate interests in responding to enquiries about our services, under Article 6(1)(f) UK GDPR, and, once an engagement is in contemplation or in place, performance of a contract or the taking of steps at your request prior to entering one, under Article 6(1)(b).

6. Personal data from feedback and testimonials

At the end of an engagement we invite the people we worked with to complete a feedback form. Completing it is voluntary, every question in it may be left unanswered, and declining has no consequence for you or for your organisation. The form is hosted on Microsoft Forms. Microsoft processes the responses on our behalf, on our instructions and for no purpose of its own.

The responses are held in our own Microsoft 365 tenancy. Microsoft gives no data-residency commitment for Forms: for a tenancy based in the United Kingdom it stores the responses in its European datacentres, and it does not undertake to keep them in any particular country. Where personal data is in consequence transferred outside the United Kingdom, the transfer is either to a country covered by United Kingdom adequacy regulations or made under the standard data protection clauses in Microsoft’s data protection addendum. No other processing described in this notice involves a transfer outside the United Kingdom.

The form covers three distinct matters, and they are not one piece of processing. The first asks for your name, your role during the engagement, how you worked with us, your comments on the work and a small number of ratings. We process those answers in order to assess and improve the quality of our own work. The lawful basis is our legitimate interests in understanding how our engagements are received, under Article 6(1)(f) UK GDPR. They are not published, and they are not shared with your organisation, with any agency through which the engagement was contracted, or with anyone else.

The second asks whether you are willing for a comment to be quoted publicly, how you wish to be attributed, and how the organisation should be described. The third asks whether you are willing to act as a reference for prospective clients, and for contact details if you are. A further question asks whether we may come back to you about your own answers. Each of those is a separate permission, and none follows from another or from the first part of the form. The lawful basis for each is your consent, under Article 6(1)(a) UK GDPR.

Where you consent to being quoted, we attribute the quotation in the way you have asked and no further — including with no attribution at all, where that is what you choose. We do not name the organisation you worked for, and we describe it no more specifically than the description you give us. Where you consent to act as a reference, we pass your contact details to a prospective client only for the purpose of that client taking up the reference, and to nobody else.

You may withdraw any of those permissions at any time by writing to info@cloudtales.co.uk. Withdrawal does not affect the lawfulness of anything done while the permission was in force. On withdrawal we stop passing on your contact details at once, and we remove a published quotation from material under our control at the next revision of it; we cannot recall a copy already taken by someone else.

Responses to the first part of the form are retained for as long as they remain relevant to the purpose for which they were given. A permission to be quoted or to act as a reference is retained for as long as we rely on it, and the record that a permission was given and, where applicable, withdrawn is kept after that, so that the withdrawal is not lost.

7. Retention and disclosure

We do not add enquirers to a mailing list and we send no marketing. We do not sell personal data. We do not disclose it to third parties for their own purposes, save for the reference contact details described in section 6, which are passed on only where you have consented to that. Correspondence is retained for as long as it is required for the enquiry or engagement to which it relates, and thereafter for the period for which our business and tax records must be kept, after which it is deleted.

Personal data is handled on our behalf by the providers who host this website, carry our email and host the feedback form described in section 6. Each acts on our instructions as our processor and for no purpose of its own.

8. Your rights

You have the right to request access to the personal data we hold about you; to have inaccurate data rectified; to have data erased; to restrict or object to its processing; and, in respect of data processed for the performance of a contract, to receive it in a portable form. Requests should be sent to info@cloudtales.co.uk and will be answered within one month of receipt, as required by the UK GDPR.

Where we rely on your consent, as we do for the permissions described in section 6, you may withdraw it at any time and are under no obligation to give a reason. Withdrawal is as easy to make as the permission was to give: one message to the address above is enough.

If you consider that we have not handled your personal data properly, you are entitled to complain to the Information Commissioner’s Office, the supervisory authority for the United Kingdom, at ico.org.uk.

9. Amendment of this notice

We may amend this notice from time to time. The version published on this page is the version in force and replaces any earlier version. No archive of previous versions is maintained.