Privacy Policy
How we collect, use, and protect your personal data.
This policy explains how TIKF Group Ltd ("TIKF", "we", "us", "our") handles personal information when you visit www.tikfgroup.com, when you contact us, and when we contact organisations about our services. We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.
Last updated: 11 August 2026
Supersedes: version dated 4 June 2026
Summary of changes: this version adds Section 4 (Direct marketing and business outreach), which explains how we obtain and use business contact details when we contact organisations directly, and updates Sections 1, 3, 6 and 7 accordingly.
1. Who we are
Legal basis: UK GDPR Art.13(1)(a) and Art.14(1)(a) — identity and contact details of the controller.
TIKF Group Ltd ("TIKF", "we", "us", "our") is a company registered in England and Wales under company number 17230400. Our registered office is at 22 Cavell Street, London, E1 2HP.
We are the data controller for the personal information we collect through our website at www.tikfgroup.com, through enquiries made to us, and through our business development and outreach activities.
ICO registration number: ZC164586
Contact: info@tikfgroup.com
We have not appointed a Data Protection Officer as we are not required to do so under UK GDPR Art.37. Data protection enquiries should be directed to info@tikfgroup.com.
2. What information we collect
Legal basis: UK GDPR Art.13(1)(d) — categories of personal data.
When you use our contact form, we collect:
- Your name
- Your email address
- Your message
- Your firm or company name (if provided)
- Your industry (if provided)
When you visit our website, our hosting provider (Vercel Inc.) may automatically collect:
- Your IP address
- Browser type and version
- Pages visited and time spent on each page
- Referring website address
- Device type and operating system
Where we contact an organisation directly rather than in response to an enquiry, the information we collect and the sources we obtain it from are set out separately in Section 4.
We do not collect any special category data (as defined in UK GDPR Art.9). We do not use marketing cookies, tracking pixels, or third-party analytics tools.
3. How and why we use your information
Legal basis: UK GDPR Art.13(1)(c) and Art.14(1)(c) — purposes and lawful basis for processing.
| Purpose | Lawful basis | Art.6 provision |
|---|---|---|
| To respond to your enquiry submitted through our contact form | Legitimate interest — it is in our legitimate interest to respond to people who contact us, and you would reasonably expect us to do so | Art.6(1)(f) |
| To provide information about our services where you have requested it | Legitimate interest — providing information that has been directly requested | Art.6(1)(f) |
| To contact organisations about our services as part of business-to-business outreach (see Section 4) | Legitimate interest — promoting our services to organisations likely to have a professional interest in them, where the impact on the individual is minimal | Art.6(1)(f) |
| To maintain, secure, and improve our website | Legitimate interest — ensuring site security, uptime, and performance | Art.6(1)(f) |
We do not use your data for automated decision-making or profiling (UK GDPR Art.22).
We do not send unsolicited marketing email to individual subscribers — including sole traders, individuals and unincorporated partnerships — unless they have separately and explicitly consented to receive it. Where we contact corporate subscribers about our services, we rely on legitimate interests as explained in Section 4.
Where we rely on legitimate interest, we have carried out a legitimate interests assessment and concluded that the processing is necessary for our purposes, is proportionate, and does not override the rights and freedoms of data subjects. You have the right to object to processing based on legitimate interest at any time (see Section 7).
4. Direct marketing and business outreach
Legal basis: UK GDPR Art.6(1)(f), Art.14 and Art.21; Privacy and Electronic Communications Regulations 2003 Reg.22.
From time to time we contact organisations directly to introduce our services. This section explains that activity, and applies where we have obtained your details from a source other than you.
4.1 Who we contact
We send unsolicited business-to-business email only to corporate subscribers — companies registered under the Companies Act 2006, limited liability partnerships, and other incorporated bodies.
We do not send unsolicited marketing email to sole traders, individuals, or unincorporated partnerships, who are treated as individual subscribers under PECR Reg.22 and require prior consent.
We contact people in their professional capacity only, using business contact details, about services relevant to their work. We do not contact people at personal email addresses.
4.2 Where we obtain the information
Legal basis: UK GDPR Art.14(2)(f) — the source of the personal data, including whether it came from publicly accessible sources.
| Source | Information we may obtain |
|---|---|
| Public regulatory registers (for example the Solicitors Regulation Authority, ICAEW, or the Immigration Advice Authority) | Organisation name, regulated status, registration number, registered or trading address, published contact details, and the names of principals or authorised individuals |
| Companies House | Entity type, company number, registered office address, and the names of directors and members |
| The organisation's own website and publicly available professional directories | Names, job titles, business email addresses, business telephone numbers, and information about the organisation and its services |
| Professional networking platforms (for example LinkedIn) | Name, job title, and employer |
All of these are publicly accessible sources. We do not purchase marketing lists and we do not obtain contact data from third-party data brokers.
4.3 What we collect
Name; job title or role; business email address; business telephone number; employer name and business address; and publicly available information about the organisation, including the presence, absence or condition of its website and other online listings.
4.4 Why we do this, and our lawful basis
Our purpose is to introduce our services to organisations we believe are likely to have a professional interest in them. Our lawful basis is legitimate interests under UK GDPR Art.6(1)(f).
We have carried out and documented a legitimate interests assessment covering the purpose of the processing, whether it is necessary, and whether it is outweighed by your interests, rights and freedoms. In reaching our conclusion we took into account that we contact you in a professional capacity at a business address, about a subject connected to your work; that the volume of contact is low and the sequence is short; that we hold only limited business contact data; and that you can stop the contact at any time, immediately and without giving a reason. A summary of that assessment is available on request from info@tikfgroup.com.
4.5 Your right to object
Legal basis: UK GDPR Art.21(2)-(3) — the right to object to direct marketing is absolute.
You can object to receiving direct marketing from us at any time. You do not need to give a reason, and we do not have to weigh anything against your request. Once you object, we must stop.
The simplest way to object is to reply to any message from us with the word "unsubscribe". You can also email info@tikfgroup.com. We will stop contacting you and add your details to our suppression list.
4.6 Information we provide when we first contact you
Legal basis: UK GDPR Art.14(3) — timing of the information.
Where we have obtained your details from a source other than you, we include a link to this policy in our first communication with you, so that this information is available to you at the point of first contact.
4.7 Tracking
We do not use open-tracking pixels, read receipts, or similar technologies in our outreach emails. We do not track whether or when a message has been opened.
5. Who we share your information with
Legal basis: UK GDPR Art.13(1)(e) and Art.14(1)(e) — recipients of personal data; Art.13(1)(f) and Art.14(1)(f) — international transfers.
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Web3Forms | Contact form processing — receives and delivers your form submission to us | United States | Standard Contractual Clauses |
| Google Workspace (Google LLC) | Email — enquiries and correspondence are received and stored in our email system | United States | UK Extension to EU-US Data Privacy Framework (certified) |
| Vercel Inc. | Website hosting — serves our website and processes server logs | United States | UK Extension to EU-US Data Privacy Framework (certified) |
We do not sell, rent, or trade your personal information to any third party. We do not share your data with any other organisations except where required to do so by law or by order of a court or regulatory authority.
6. How long we keep your information
Legal basis: UK GDPR Art.13(2)(a) and Art.14(2)(a) — retention period or criteria used to determine it.
| Data type | Retention period | Basis |
|---|---|---|
| Contact form submissions (Web3Forms) | 30 days (automatically deleted by Web3Forms) | Processor's retention policy |
| Contact form submissions (our email) | As long as necessary to respond to your enquiry and any follow-up. Maximum 12 months unless a client relationship is established. | Proportionate to purpose |
| Business contact details used for outreach (Section 4) | 12 months from the date of last contact, after which the record is deleted unless a business relationship has been established or you have asked us to keep in touch | Proportionate to purpose; reviewed annually |
| Suppression list (details of people who have objected) | Retained indefinitely, limited to the minimum information needed to ensure we do not contact you again — normally name, email address and the date of your objection | Necessary to give effect to your objection |
| Server logs (Vercel) | Up to 30 days, per Vercel's data retention policy | Processor's retention policy |
We keep a suppression list because it is the only reliable way to make sure an objection is honoured permanently. We do not use it for any other purpose.
7. Your rights
Legal basis: UK GDPR Art.13(2)(b)-(d), Art.14(2)(c)-(e) — data subject rights.
Under UK GDPR, you have the following rights:
- Right of access (Art.15) — request a copy of the personal data we hold about you.
- Right to rectification (Art.16) — ask us to correct inaccurate or incomplete data.
- Right to erasure (Art.17) — ask us to delete your personal data where there is no compelling reason for continued processing.
- Right to restrict processing (Art.18) — ask us to suspend processing in certain circumstances.
- Right to data portability (Art.20) — request your data in a structured, commonly used, machine-readable format.
- Right to be informed (Art.13 and Art.14) — be told what data we hold, why, and where we obtained it. This policy is how we provide that information.
Right to object (Art.21)
Where we process your data for direct marketing, including the outreach described in Section 4, your right to object is absolute. If you object, we must stop processing your data for that purpose immediately. There is no balancing test and you do not need to give a reason.
For processing based on legitimate interests other than direct marketing, you may also object at any time. In those cases we must stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.
To exercise any of these rights, email us at info@tikfgroup.com. We will respond within one calendar month of receiving your request (UK GDPR Art.12(3)). In complex cases, we may extend this by a further two months, but we will inform you within the first month if this is necessary.
There is no fee for exercising your rights in most cases. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act (UK GDPR Art.12(5)).
If you are not satisfied with how we handle your request, you have the right to lodge a complaint with:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk | Telephone: 0303 123 1113
8. Cookies and similar technologies
Legal basis: PECR 2003 Regulation 6; Data (Use and Access) Act 2025 amendments.
Our website uses only strictly necessary cookies required for the website to function correctly. Under PECR Regulation 6(4)(b), strictly necessary cookies do not require your consent. The "strictly necessary" test is assessed from the user's perspective: these cookies are essential to deliver the service you have actively requested (i.e. loading and navigating our website).
We do not use advertising cookies, third-party tracking cookies, analytics cookies, social media tracking pixels, or any technology that stores or accesses information on your device for non-essential purposes. No cookie consent banner is required.
For full details, please refer to our separate Cookies Policy.
9. Changes to this policy
We may update this policy from time to time to reflect changes in our processing activities, legal requirements, or ICO guidance. The "last updated" date at the top of this document will always reflect the most recent version. Where changes are material, we will take reasonable steps to bring them to your attention.
10. Contact
TIKF Group Ltd
22 Cavell Street, London, E1 2HP
Company number: 17230400
ICO registration: ZC164586
Email: info@tikfgroup.com