1. Who we are
TRACIO ("we", "us", "our") is an independent advisory practice specialising in real-time location systems (RTLS), RFID, IIoT, and applied AI. Registered address and registration details are listed on our Company Information page. The data controller for personal data submitted through tracio.com is TRACIO.
2. What personal data we collect
We collect only what is needed to respond to enquiries, deliver our services, and operate the website:
- Contact-form submissions: name, work email, optional phone number, company, job title, country/region, industry, project context you choose to share, and your message.
- Email correspondence: the content of any messages you send us and the metadata that comes with them.
- Engagement data: for active clients, the information needed to deliver the engagement (project documents, technical environment details, stakeholders).
- Technical data: IP address, user agent, language preference, pages visited, referrer. Stored briefly in server logs and used for security and basic operational analytics.
- Cookies: see our Cookie Policy.
3. Why we use it (lawful basis under GDPR Art. 6)
- Legitimate interests (Art. 6(1)(f)): responding to your enquiry, providing requested information, securing the website, and improving our services.
- Performance of a contract (Art. 6(1)(b)): once you become a client, processing necessary to deliver the agreed engagement.
- Consent (Art. 6(1)(a)): for non-essential cookies and any marketing communications you specifically opt in to.
- Legal obligation (Art. 6(1)(c)): tax records, statutory accounting, regulatory requirements.
4. Who we share it with
We do not sell personal data. We share it only with:
- Sub-processors needed to operate the site and our business: email provider, SMTP service, hosting provider, accounting software, scheduling tool. Each is bound by a data processing agreement.
- Authorities where legally required (subpoena, regulator request, fraud investigation).
We do not transfer personal data to third countries without appropriate safeguards (Standard Contractual Clauses or an adequacy decision).
5. How long we keep it
- Contact form enquiries: 24 months from last interaction, then deleted unless an active engagement starts.
- Client engagement records: for the duration of the engagement and 7 years thereafter for statutory accounting and audit.
- Server logs: 90 days rolling.
- Marketing-consent records: until you withdraw consent.
6. Your rights
Under GDPR / UK DPA you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Request erasure (the "right to be forgotten") subject to legal retention obligations.
- Restrict or object to processing.
- Data portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time.
- Complain to a supervisory authority (e.g. the UK ICO, your national DPA, or the data protection authority of the EU member state where you live or work).
To exercise any of these rights, email our Data Protection Officer at dpo@tracio.com. We will respond within one month.
7. Security
We follow industry-standard controls including TLS in transit, encrypted backups, access on a least-privilege basis, MFA on all administrative accounts, and ongoing review of our sub-processor list. No system is perfectly secure; if a breach occurred we would notify affected parties and supervisory authorities within the legally required timeframes.
8. Children
TRACIO services are B2B. We do not knowingly collect personal data from anyone under 16.
9. Changes
If we change this policy materially, we will update the effective date and, where appropriate, notify clients directly. Continued use of the site after a change indicates acceptance.
10. Contact
Data Protection Officer: dpo@tracio.com
Legal enquiries: legal@tracio.com
Security disclosure: security@tracio.com · security.txt
General: hello@tracio.com
This template is provided as a starting point and should be reviewed by qualified legal counsel before relying on it for live operations.