For privacy questions, data subject requests, or to request our Data Processing Agreement, email privacy@tenhaw.com.
Tenhaw LTD ("Tenhaw", "we", "us") is a company registered in England and Wales, based in London. We are an AI-native transformation consultancy providing professional services. We are the data controller for personal data collected through this website and in the course of our business development. For personal data we process on behalf of clients during an engagement, the client is the controller and we act as processor under a separate Data Processing Agreement.
From website visitors: pages viewed, referring source, approximate location derived from IP address, device and browser characteristics, and interactions with the page including clicks and scrolling. Our analytics tooling is configured to capture interaction events automatically and to record browsing sessions, which means your mouse movement, clicks and navigation on this site may be recorded and replayed by us for the purpose of understanding how the site is used. From people who contact us or book a call: your name, email address, company, telephone number where provided, and the content of your enquiry or booking. From the case-study assistant on this site: the text of questions you type into it.
We process enquiry and booking data to respond to you and to provide our services, on the basis of performance of a contract or steps taken at your request prior to entering one. We process analytics and session-recording data to understand and improve how this site performs, on the basis of our legitimate interests in operating and improving our business, balanced against your interests. We process data to comply with legal obligations where applicable. We do not sell personal data, and we do not use it for advertising or profiling.
Vercel Inc. (website hosting and delivery; United States, with EU edge processing). Plausible Insights OÜ (privacy-focused website analytics; Estonia, European Union. Plausible sets no cookies and stores nothing on your device, so it runs for every visitor and is not gated behind the consent banner). Google LLC. Google Analytics 4 (website analytics; United States, standard contractual clauses). Mixpanel Inc. (product analytics and session recording, configured to use the EU data-residency endpoint api-eu.mixpanel.com). Cal.com Inc. (scheduling, when you book a discovery call). Anthropic PBC (processes the text of questions you submit to the on-page assistants, in order to generate an answer). RB2B (business visitor identification; United States. Where enabled, RB2B attempts to identify the company and, in some cases, the individual professional visiting this site, using your IP address and its own data sources. It is loaded only if you consent to analytics, and never otherwise.). Google Fonts is self-hosted at build time, so no request is made to Google when you load a page. A current sub-processor list for consulting engagements, including entity, location, purpose and transfer mechanism, is published on our Security page, annexed to our Data Processing Agreement and provided during supplier onboarding.
Nothing non-essential loads on this site until you consent. Analytics (Google Analytics and Mixpanel event tracking, and RB2B visitor identification where enabled) and session recording (Mixpanel session replay and automatic interaction capture) are separate choices, and both are off by default: the scripts are not loaded at all, rather than loaded and suppressed. You can accept, reject, or choose per category, and rejecting is exactly as easy as accepting. You can change your mind at any time using the "Cookie settings" link in the footer, and withdrawing consent stops collection immediately rather than at your next visit. We honour Global Privacy Control and Do Not Track signals automatically as a rejection, without showing you a banner. We do not use advertising or cross-site tracking cookies. One tool is deliberately outside this gate: Plausible, which sets no cookies, stores nothing on your device and does not build a cross-site profile. We run it for every visitor so that we can still count page views for people who decline everything else, and we are telling you here rather than relying on the exemption quietly.
Where RB2B is enabled, we may learn the name of the company visiting this site and, occasionally, the name and professional profile of an individual visitor. We use that only to decide whether to contact you about our services. We do not use it for automated decision-making and we do not sell it. You can object to this processing and ask us to delete anything we hold about you, and we will act on it without asking for a reason: email privacy@tenhaw.com. You also have the right to complain to the Information Commissioner's Office.
During a consulting engagement we may be given access to systems and data belonging to our client, which can include personal data relating to their staff and customers. In that context the client is the controller and Tenhaw is the processor. We act only on documented instructions, under a Data Processing Agreement that specifies purposes, sub-processors, international transfer mechanisms, security measures, retention and deletion. We do not use client data to train models, and we do not transfer client data into third-party AI tools unless the client has expressly approved that tool in writing.
Some of our processors are based in the United States. Where personal data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with supplementary measures where required. Mixpanel is configured to use its EU data-residency endpoint.
Enquiry and booking data is retained for up to 24 months from your last interaction with us, unless you are or become a client, in which case it is retained for the duration of the relationship and for six years afterwards to meet legal and professional record-keeping obligations. Website analytics data is retained for 14 months. Session recordings are retained for 30 days. Case-study assistant conversations are retained for 30 days.
Data is encrypted in transit and at rest. Access to systems containing personal data is restricted to personnel who need it, protected by multi-factor authentication. Our technical and organisational measures, our assurance roadmap and our responsible-disclosure process are described on our Security page.
Under UK GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing (including profiling and session recording), to data portability, and to withdraw consent where processing is based on consent. To exercise any of these rights, email privacy@tenhaw.com. We will respond within one month. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office at ico.org.uk.
We will update this policy when our processing changes, and will change the date shown at the top of this page. Material changes affecting existing clients will be notified directly.
For privacy questions, data subject requests, or to request our Data Processing Agreement, email privacy@tenhaw.com.
A 30-minute call with James Rooney. Bring your privacy review, your DPIA questions or your sub-processor list, and we will tell you what we can evidence today and what is still in progress.
most start with a fixed-price Agent-Readiness Audit · £30k–£90k · 6–8 weeks