For privacy questions, data subject requests, or to request our Data Processing Agreement, email privacy@tenhaw.com.
AI voice conversations
Kawl Now provides the optional AI voice widget on this website. The widget loads from app.kawlnow.com, which receives the browser request information needed to serve it. If you start a conversation, your question and the AI answer are processed to provide the service and saved in a transcript that our team can review. Microphone access requires your browser permission; you can end the conversation at any time. Please keep passwords, payment details, customer records and sensitive personal information out of the conversation. Contact us through this website for questions about a transcript or a privacy request.
1. Who we are
Tenhaw LTD ("Tenhaw", "we", "us") is a company registered in England and Wales, based in London. We are an AI-native transformation consultancy providing professional services. We are the data controller for personal data collected through this website and in the course of our business development. For personal data we process on behalf of clients during an engagement, the client is the controller and we act as processor under a separate Data Processing Agreement.
2. What data we collect
From website visitors: pages viewed, referring source, approximate location derived from IP address, device and browser characteristics, and measurement events such as link clicks and calendar interactions. Plausible provides cookie-free analytics. Google Analytics and advertising measurement depend on your choices as described in section 5. We do not record or replay browsing sessions. From people who contact us or book a call: your email address, the work you describe, your role and budget range where supplied, and the page, engagement door or case study associated with your enquiry. Booking details may also include your name, company and telephone number where provided. We use Close to manage website enquiries, acknowledge receipt and arrange a reply from James within two working days. From the case-study assistant on this site: the text of questions you type into it. From people who use the free planning tools on this site: the work email address you give, the answers you choose and the figures you enter, the result the tool returns, the tool and page you used, and the site that referred you to us where your browser tells us. We show you the result and keep it in Close with your answers so that James can follow up and so that a call you book starts from what you told the tool.
3. Why we process it, and our lawful basis
We process enquiry and booking data to respond to you and to provide our services, on the basis of performance of a contract or steps taken at your request prior to entering one. We process website analytics data to understand and improve how this site performs, on the basis of our legitimate interests in operating and improving our business, balanced against your interests. We process data to comply with legal obligations where applicable. We process what you give a planning tool to show you the result, as a step taken at your request, and to follow up with you about that result, on the basis of our legitimate interest in responding to a business enquiry. We do not add planning-tool users to a mailing list, and you can ask us to stop following up at any time by replying to the email or writing to privacy@tenhaw.com. We do not sell personal data. Optional advertising relies on a separate advertising choice, described below.
4. Third parties who process data for us
Vercel Inc. (website hosting and delivery; United States, with EU edge processing). Plausible Insights OÜ (privacy-focused website analytics; Estonia, European Union. Plausible sets no cookies and stores nothing on your device, so it runs for every visitor and is not gated behind the consent banner). Google LLC. Google Analytics 4 (website analytics; United States, standard contractual clauses). OpenAI (optional ChatGPT advertising conversion measurement, as described below). Cal.com Inc. (scheduling, when you book a discovery call; a call booked from a planning tool's result carries your answers and the result with the booking). Close, provided by Elastic Inc. in the United States (customer relationship management for website enquiries, bookings and planning-tool results, and the emails we send about them, under the UK International Data Transfer Addendum and Standard Contractual Clauses). Kawl Now (serves the optional AI voice widget and processes conversations as described above). Anthropic PBC (processes the text of questions you submit to the on-page assistants, in order to generate an answer). Google Fonts is self-hosted at build time, so no request is made to Google when you load a page. A current sub-processor list for consulting engagements, including entity, location, purpose and transfer mechanism, is published on our Security page, annexed to our Data Processing Agreement and provided during supplier onboarding.
5. Cookies, local storage and session recording
Google Analytics and advertising measurement are off by default and their scripts are not loaded until the relevant choice is allowed. Accept on the banner allows analytics and advertising together; Cookie settings lets you choose categories separately. You can accept, reject or change your choice using Cookie settings in the footer. Withdrawal stops further collection. Global Privacy Control and Do Not Track signals keep these optional tools off. Plausible runs without cookies or device storage for all visitors, independently of these choices. We do not record or replay browsing sessions; Mixpanel and its session-replay toggle were removed on 26 August 2026. The optional voice widget loads its interface as described above; microphone access requires browser permission. The planning tools keep one item in your browser's session storage once you have given your email: a signed reference that lets you use another tool, or return to the tab, without being asked again. It holds no email address, name or answers, it is not used for analytics, and it is removed when you close the tab.
Optional OpenAI advertising measurement
OpenAI's ChatGPT Ads Measurement Pixel stays off until you allow advertising. Allowing analytics on its own does not allow this Pixel. With your permission, it uses browser attribution cookies to connect visits and successful booking submissions with our ChatGPT ads, and records those submissions as lead conversions. The __oppref cookie stores an advertising click reference for 30 days, with that period restarting when a new reference is captured from a page address. The __obref cookie stores a browser reference for 365 days from creation; that expiry does not refresh. Use Cookie settings in the footer to change or withdraw your choice. Withdrawal stops further Pixel measurement and removes these cookies. Global Privacy Control and Do Not Track signals keep the Pixel off.
6. If our website identified you
It does not, and this section stays so that the answer is on the record rather than absent. Until 26 August 2026 this site could run RB2B, which attempted to resolve a visitor's IP address to the company they work for and, occasionally, to them personally. It has been removed. Nothing on this site now attempts to identify you or your employer, and no visitor identification data is collected. The planning tools ask for a work email, which you choose to give; that is the only way this site learns who you are. If RB2B identified you while it was running, you can ask us what we hold and to delete it, and we will act on it without asking for a reason: email privacy@tenhaw.com. You also have the right to complain to the Information Commissioner's Office.
7. Client data during an engagement
During a consulting engagement we may be given access to systems and data belonging to our client, which can include personal data relating to their staff and customers. In that context the client is the controller and Tenhaw is the processor. We act only on documented instructions, under a Data Processing Agreement that specifies purposes, sub-processors, international transfer mechanisms, security measures, retention and deletion. We do not use client data to train models, and we do not transfer client data into third-party AI tools unless the client has expressly approved that tool in writing.
8. International transfers
Some of our processors are based in the United States. Where personal data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with supplementary measures where required.
9. How long we keep it
Enquiry, booking and planning-tool data is retained for up to 24 months from your last interaction with us, unless you are or become a client, in which case it is retained for the duration of the relationship and for six years afterwards to meet legal and professional record-keeping obligations. Website analytics data is retained for 14 months. We do not currently collect session recordings. Case-study assistant conversations are retained for 30 days.
10. Security
Data is encrypted in transit and at rest. Access to systems containing personal data is restricted to personnel who need it, protected by multi-factor authentication. Our technical and organisational measures, our assurance roadmap and our responsible-disclosure process are described on our Security page.
11. Your rights
Under UK GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing (including processing based on legitimate interests), to data portability, and to withdraw consent where processing is based on consent. To exercise any of these rights, email privacy@tenhaw.com. We will respond within one month. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office at ico.org.uk.
12. Changes to this policy
We will update this policy when our processing changes, and will change the date shown at the top of this page. Material changes affecting existing clients will be notified directly.
13. Contact
For privacy questions, data subject requests, or to request our Data Processing Agreement, email privacy@tenhaw.com.
Questions your data protection team needs answered?
A 30-minute call with James Rooney. Bring your privacy review, your DPIA questions or your sub-processor list, and we will tell you what we can evidence today and what is still in progress.
Google Ads, provided by Google LLC, stays off until you allow advertising. It can use cookies and your page addresses, IP address, browser/device information and cookie identifiers to measure advertising and show you personalised ads for this site across other websites. Allowing analytics on its own does not allow advertising. Google Analytics advertising features remain disabled.
Your advertising decision and its timestamp are stored separately in your browser. Use Cookie settings in the footer to change or withdraw it. Withdrawal denies further advertising use, removes this site's advertising cookies and reloads the page to unload the advertising tag, while preserving your analytics choice. Browser privacy signals keep advertising off. We exclude pages or referring addresses with sensitive paths or parameters; ordinary marketing query strings and section navigation may still be processed by Google Ads.