Privacy Policy

This policy applies to all individuals who interact with ClickTake Technologies Ltd. via our website, contact forms, email, or any of our digital services. It does not apply to data processed on behalf of our clients under a separate Data Processing Agreement (DPA) — that data is governed by the DPA signed with each client, in which we act as a data processor.

We are ClickTake Technologies Ltd., a private limited company registered in England and Wales, headquartered in Birmingham, West Midlands, with offices in Multan (Pakistan), Austin, TX (USA), and Dubai (UAE). We act as a data controller for prospective-client data, careers-applicant data, and website visitor data, and as a data processor for data processed on behalf of clients under a separate DPA.

This policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU GDPR, the California Consumer Privacy Act (CCPA) as amended by the CPRA, and other applicable privacy laws.

Identity Data: first name, last name, job title, company name, LinkedIn profile URL (when voluntarily provided).

Contact Data: email address, telephone numbers, billing address, and country.

Project Data: information you provide in our contact form, discovery-call request, or RFP — including project scope, budget range, timeline, and current technical stack.

Technical Data: IP address, browser type and version, operating system, device type, referring URL, and pages visited. This is collected via server logs and Google Analytics 4.

Usage Data: information about how you interact with our website — pages viewed, time on page, form starts and submissions, and CTA clicks.

Application Data: CV, portfolio link, GitHub username, cover note, and right-to-work information submitted via our Careers portal.

Under Article 6 of the UK/EU GDPR, we rely on the following lawful bases to process your personal data:

Consent (Art. 6(1)(a)) — for analytics cookies, marketing cookies, and any optional communications you opt into. You can withdraw consent at any time by emailing info@clicktaketech.com.

Contract (Art. 6(1)(b)) — to process project inquiries, deliver contracted services, and manage our partnership relationship with you under a signed Statement of Work.

Legal obligation (Art. 6(1)(c)) — to comply with UK tax, accounting, and Companies House filing obligations, and to retain records as required by HMRC.

Legitimate interests (Art. 6(1)(f)) — to respond to inbound enquiries, prevent fraud, secure our systems, and improve our services. We carry out a legitimate-interests assessment (LIA) for any processing that relies on this basis.

We use your personal data to:

Respond to your discovery-call request or project inquiry within 4 business hours and scope a fixed-price proposal.

Deliver custom software development, AI automation, SEO and digital marketing, and brand-design services under a signed SOW.

Manage our ongoing client relationship — milestone updates, invoicing, support tickets, and renewal discussions.

Screen prospective candidates who apply via our Careers portal and conduct first-round technical interviews.

Send you our newsletter and resources — only if you have explicitly opted in, and you can unsubscribe in one click.

Maintain and improve our website, services, and security posture, including fraud prevention and abuse detection.

We use the following third-party services to operate our business. Each one processes a limited subset of personal data on our behalf, and we have written agreements in place with each that meet GDPR Article 28 requirements where applicable.

Cloudinary — image and video hosting for website and marketing assets. May receive asset metadata; does not receive personal data directly.

Gmail SMTP (Google Workspace) — business email. Stores your contact details, email content, and attachments to deliver correspondence with you. Google Workspace is certified under ISO/IEC 27001, SOC 2 Type II, and operates under EU GDPR.

Cloudflare Turnstile — bot protection on our public forms. May set a cookie and collect limited device signals to distinguish humans from automated traffic. No personal data is sent to Cloudflare beyond what is strictly necessary for bot detection.

Google Analytics 4 — website usage analytics, configured with IP anonymisation and a 14-month data retention window. We do not enable Google Signals or advertising features that would re-identify individuals across devices.

Vercel — hosting provider for clicktaketech.com and client projects. Operates under SOC 2 Type II and processes server logs strictly for security and abuse prevention.

Stripe — payment processing for client invoices. Stripe is the data controller for card data; we never see or store your full card number.

A full, up-to-date list of sub-processors is available on request — email info@clicktaketech.com and we will send it within 30 days.

Because we operate offices in the UK, Pakistan, the US, and the UAE, your personal data may be accessed from, or transferred to, countries outside your home jurisdiction. We protect such transfers using Standard Contractual Clauses (SCCs) approved by the European Commission, the UK International Data Transfer Agreement (IDTA), and additional safeguards such as encryption in transit and at rest.

Pakistan is not recognised as providing an adequate level of data protection under UK/EU law; we therefore rely on SCCs/IDTA + supplementary measures (encryption, access controls, and audit rights) for any transfer of personal data to our Multan engineering hub. We have conducted and documented Transfer Impact Assessments (TIAs) for these transfers.

We do not knowingly transfer personal data to any country subject to UK, EU, or US sanctions.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. Specific retention periods:

Project inquiries and discovery-call recordings — 24 months from the last interaction, then deleted unless a contract is signed.

Client project data — for the duration of the engagement + 7 years for tax and accounting purposes, then securely deleted or returned to the client.

Careers applications — 12 months from application, then deleted (or until you ask us to extend, in writing).

Website server logs — 30 days, then automatically purged.

Newsletter subscribers — until you unsubscribe, after which your email is removed within 7 days.

To exercise your rights earlier, email info@clicktaketech.com and we will respond within 30 days.

We have implemented appropriate technical and organisational measures to protect your personal data, including: TLS 1.2+ encryption in transit, AES-256 encryption at rest, role-based access control with least-privilege defaults, multi-factor authentication for all production systems, quarterly access reviews, and annual penetration testing.

Access to personal data is restricted to authorised personnel on a need-to-know basis and is logged for audit. We have a documented incident-response plan and will notify the ICO (and any affected individuals) within 72 hours of becoming aware of a notifiable personal data breach, as required by Article 33 of the UK GDPR.

Under the UK GDPR and EU GDPR, you have the following rights:

The right to be informed (this policy).

The right of access — you can request a copy of the personal data we hold about you.

The right to rectification — to correct inaccurate or incomplete data.

The right to erasure (“right to be forgotten”) — subject to legal-retention overrides.

The right to restrict processing — for example, while a rectification request is being assessed.

The right to data portability — to receive your data in a structured, machine-readable format.

The right to object to processing based on legitimate interests or for direct marketing.

Rights related to automated decision-making and profiling — we do not use automated decision-making for anything that produces legal or similarly significant effects.

To exercise any of these rights, email info@clicktaketech.com with the subject line “DSAR — [your name]”. We respond within 30 days, free of charge, except where requests are manifestly unfounded or excessive.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights:

The right to know — the categories of personal information we collect, the sources, the business or commercial purpose for collecting it, and the categories of third parties to whom we disclose it.

The right to delete — to request deletion of your personal information, subject to legal-retention overrides.

The right to correct — to request correction of inaccurate personal information.

The right to opt-out of the “sale” or “sharing” of personal information — ClickTake does not sell personal information and does not share it for cross-context behavioural advertising.

The right to limit the use of sensitive personal information — we do not collect sensitive personal information as defined by CPRA beyond what is strictly necessary for HR screening.

To exercise any CCPA right, email info@clicktaketech.com. We will verify your identity before processing the request and respond within 45 days, extendable by 45 days where reasonably necessary.

Our website and services are intended for businesses and professionals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please email info@clicktaketech.com and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. We will post any material changes on this page and update the “Last Updated” date at the top. For significant changes (e.g., new sub-processors or new lawful bases), we will also notify you by email if you are an active client or newsletter subscriber.

ClickTake Technologies Ltd. is the data controller for the personal data processed under this policy. For any privacy question, data-subject request, or complaint, contact our Data Protection Lead at:

ClickTake Technologies Ltd., UK HQ, Birmingham, West Midlands, United Kingdom.

Email: info@clicktaketech.com (please use the subject line “Privacy / DSAR”).

We respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or your local data-protection authority.