Privacy Policy

1. Who we are

TASK Global Technologies Ltd (company number 13750713, registered in England and Wales) operates TAP. For the processing described in this notice, TASK may act as controller for account, commercial, website, support and platform-administration data. Where TAP is used by an organisation to assess its own controls or upload evidence, the customer may also determine the purposes for which that information is processed.

2. Information we process

• Account and identity data: name, email, account identifiers, role, workspace membership and authentication-related metadata.
• Organisation and partner data: organisation name, sector, size, subscription state, membership and relationship information.
• Assessment and assurance data: assessment responses, scores, gaps, remediation actions, review notes, reports and evidence references.
• Documents: files and metadata that authorised users upload to an organisation workspace.
• Commercial data: plan, billing cadence and identifiers needed to link the workspace to payment services. TAP does not intentionally store full payment-card details.
• Contact and health-check data: information you submit through enquiries, demonstrations, partnership requests or the free health check.
• Security and audit data: activity records, authorisation decisions, security events, timestamps and technical records needed to protect and operate the service.
• Operational journey data: where you opt in to anonymous journey metrics, TAP uses a random session-only identifier with limited event metadata such as route, selected plan, audience and billing cadence. These events do not include your name, email address, health-check answers, enquiry text or uploaded document content. Authoritative business events such as an accepted lead, trial workspace creation, checkout creation and subscription activation may also be recorded as operational service records using account or workspace identifiers where relevant.
• Communications and privacy requests: support correspondence, invitations, privacy requests, complaints and related evidence.

3. Why we use information

We use personal information to provide and secure TAP, administer accounts and workspaces, deliver assessments and reports, provide support, manage billing and subscriptions, communicate about requested services, meet legal and regulatory obligations, investigate security or service issues, and improve the reliability and usability of the platform. Anonymous public-journey metrics are optional and are enabled only after you choose to allow them.

The lawful basis depends on the activity. Depending on the circumstances this may include performance of a contract or steps requested before a contract, legitimate interests in operating and securing the service, compliance with legal obligations, and consent where the law requires it.

4. Sharing and service providers

We disclose information only where needed to operate the service, meet an obligation, or follow your organisation's authorised workflow. This can include infrastructure and application-platform providers, payment services such as Stripe, email/communications services, professional advisers, and authorised partners or consultants where the workspace configuration permits access. When checkout is initiated, governed Stripe metadata can include a random journey identifier where anonymous journey metrics were previously allowed, together with workspace and plan references needed to reconcile the checkout securely.

We do not sell personal information. Access inside TAP is governed by account membership, role and tenant scope.

5. International processing

Some technology providers may process information outside the United Kingdom. Where a restricted international transfer occurs, the relevant controller is responsible for using an applicable transfer mechanism or safeguard. Customers with specific residency or transfer requirements should raise them during procurement so they can be assessed against the services actually used.

6. Retention

We keep personal information only for as long as it is needed for the purpose for which it was collected, to provide the service, preserve required audit and assurance evidence, resolve disputes, meet legal or contractual obligations, and protect legitimate security interests. Different categories can therefore have different retention periods. We consider account status, customer instructions, legal requirements, evidential value, security needs and whether information can be safely deleted or anonymised.

7. Your rights

Depending on the circumstances and applicable law, you may have rights of access, rectification, erasure, restriction, data portability and objection, and rights relating to automated decision-making. These rights are not identical in every situation and some are subject to exemptions or competing legal obligations.

Your right to object: where the right applies, you can object to processing. You have an absolute right to object to personal information being used for direct marketing.

Registered TAP users can use the Privacy Centre to download a self-service account-data export and submit a formal request. Anyone can use the public Privacy Request form.

8. Data-protection complaints

You can raise a data-protection complaint directly with TASK through the Privacy Request form or by emailing info@taskglobaltechnologies.com. We record the complaint, acknowledge receipt, investigate as appropriate, keep you informed where necessary, and communicate the outcome. You may also complain to the UK Information Commissioner's Office (ICO).

9. Security

TAP uses authentication, scoped membership and role controls, row-level access rules, server-authoritative workflows, audit logging and other technical and organisational safeguards. No online service can guarantee absolute security, so suspected security or privacy incidents should be reported promptly.

10. Automated processing and AI

TAP may include automated scoring, workflow logic or governed AI-enabled features. We do not represent automated outputs as a substitute for professional judgement where human review is required. Material access-control, billing and mandatory approval decisions are designed to remain governed by authoritative controls rather than an AI model acting independently.

11. Changes to this notice

We may update this notice as TAP, our service providers or applicable requirements change. The date at the top shows the current published version.