Legal
Privacy Policy
- Who we are
- Data we collect and how we collect it
- How we use your data
- Lawful basis for processing
- Who we share your data with
- International transfers
- How long we keep your data
- Your rights
- Cookies
- Security
- Children
- Changes to this policy
- Contact and complaints
1. Who we are
terlo is a product of Seneca Systems Ltd, a company incorporated in Scotland (Company Number: SC882090), with its registered office at:
Seneca Systems Ltd
Wavell Drive, Carlisle, CA1 2SA
Scotland, United Kingdom
In this policy, "we", "us", and "our" refer to Seneca Systems Ltd. We are the data controller for personal data collected through the terlo website and in connection with our services.
We are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we process the personal data of individuals in the European Economic Area (EEA), we are also subject to the EU GDPR.
We are not currently required to register with the Information Commissioner's Office (ICO) as a data controller, but we are committed to full compliance with applicable data protection law. If our processing activities change and registration becomes required, we will do so promptly.
2. Data we collect and how we collect it
2.1 Data you provide directly
When you register interest through our How We Engage page (Product Demo, One Day Workshop, or Pilot Discovery), or when you contact us by email, you provide us with:
- Your name
- Your work email address
- Your job title or role
- Your company or organisation name
- Your sector or industry
- Your phone number, where you choose to provide it
- Your answers to the qualifying questions on that page (e.g. team size in scope, AI tools in use, regulatory drivers, timeframe)
- Any information you choose to share in free-text fields
2.2 Data collected automatically
When you visit our website, we may collect certain technical data automatically, including:
- IP address
- Browser type and version
- Operating system
- Pages visited and time spent
- Basic interaction data, such as clicks on CTA and contact-email links
- Referring URL
This data is collected through standard web server logs.
3. How we use your data
| Purpose | Data used |
|---|---|
| To respond to your registration of interest and follow up | Name, email, role, company, qualifying-question answers |
| To prepare for and conduct a Product Demo, Workshop, or Pilot Discovery | All registration form data, including free-text responses |
| To respond to enquiries sent by email | Name, email, message content |
| To follow up after meetings where there is a legitimate business interest in doing so | Name, email, company, notes from the meeting |
| To improve our website and services | Anonymised technical and usage data |
| To comply with legal obligations | As required by applicable law |
We do not use your personal data for automated decision-making or profiling.
4. Lawful basis for processing
We rely on the following lawful bases under UK GDPR Article 6:
- Contract (Article 6(1)(b)): Processing necessary to take steps prior to entering into a contract — for example, progressing a Pilot Discovery registration.
- Legitimate interests (Article 6(1)(f)): Following up with prospective customers after an initial registration or meeting, where we have assessed that our interests are not overridden by your rights and interests.
- Legal obligation (Article 6(1)(c)): Where processing is required to comply with a legal obligation to which we are subject.
- Consent (Article 6(1)(a)): Where we rely on your consent — for example, for any non-essential cookies we introduce in future. You may withdraw consent at any time.
5. Who we share your data with
We do not sell your personal data to third parties. We share your data only in the following circumstances:
- Microsoft 365 — we use Microsoft Teams for meetings and Microsoft 365 for business communications and productivity. Data processed within Microsoft 365 is subject to Microsoft's data processing terms.
- Professional advisers — including legal advisers, accountants, or insurers, where necessary and subject to confidentiality obligations.
- Law enforcement or regulatory authorities — where required by law or a court order.
We do not currently use website analytics tools. If we introduce analytics in future, we will update this policy and, where required by law, seek your consent first. Where we do share data with a third-party processor, we ensure that appropriate data processing agreements are in place.
6. International transfers
Our primary infrastructure is hosted on Microsoft Azure (UK West). All data processed in connection with the terlo platform is stored within the United Kingdom.
Some of our third-party service providers may process data outside the UK or EEA. Where this occurs, we ensure that appropriate safeguards are in place, including:
- Transfers to countries recognised by the UK Secretary of State as providing adequate protection (adequacy regulations under the UK GDPR);
- UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs) where applicable; or
- Other lawful transfer mechanisms as recognised under UK GDPR.
The UK has been granted adequacy status by the European Commission, meaning that transfers of personal data from the EEA to the UK are permitted without additional safeguards.
7. How long we keep your data
| Data type | Retention period |
|---|---|
| Registration and meeting data (where no engagement follows) | 12 months from the date of registration or meeting |
| Registration and meeting data (where a customer engagement follows) | Duration of the engagement plus 6 years |
| Email correspondence | 3 years from last contact, unless part of an active engagement |
| Website technical/usage data | 13 months |
| Data held for legal compliance purposes | As required by applicable law |
We will securely delete or anonymise personal data when it is no longer needed for the purposes for which it was collected.
8. Your rights
Under UK GDPR (and EU GDPR where applicable), you have the following rights in relation to your personal data:
- Right of access — to request a copy of the personal data we hold about you.
- Right to rectification — to request that inaccurate or incomplete data is corrected.
- Right to erasure — to request deletion of your data where there is no longer a legitimate reason for us to hold it.
- Right to restrict processing — to request that we limit the way we use your data in certain circumstances.
- Right to data portability — to receive your data in a structured, machine-readable format where processing is based on consent or contract and is carried out by automated means.
- Right to object — to object to processing based on legitimate interests, or to direct marketing.
- Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
- Rights related to automated decision-making — we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
To exercise any of these rights, please contact us at hello@terlo.ai. We will respond within one calendar month. We may need to verify your identity before processing your request.
9. Cookies
This site does not currently set any non-essential cookies. Some cookies may be strictly necessary for the website to function; these do not require your consent. If we introduce analytics or other non-essential cookies in future, we will update this policy and obtain your consent first where required.
10. Security
We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration. These measures include:
- Hosting on Microsoft Azure with enterprise-grade security controls
- Access controls limiting who within our organisation can access personal data
- Encryption of data in transit and at rest where appropriate
- Regular review of our security practices
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours where required, and will inform affected individuals without undue delay where the risk is high.
11. Children
Our website and services are directed at business professionals and are not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
Continued use of our website following any changes constitutes acceptance of the updated policy.
13. Contact and complaints
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
Seneca Systems Ltd — Data Controller
Email: hello@terlo.ai
Registered in Scotland · Company Number: SC882090
For data protection enquiries, please include "Data Protection" in your subject line.
If you are not satisfied with our response, or believe we are processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
If you are located in the EEA, you also have the right to lodge a complaint with your local supervisory authority.