For privacy questions, data subject requests, or to request our Data Processing Agreement, email privacy@tenhaw.com.
Tenhaw LTD ("Tenhaw", "we", "us") is a company registered in England and Wales, based in London. We are an AI-native transformation consultancy providing professional services. We are the data controller for personal data collected through this website and in the course of our business development. For personal data we process on behalf of clients during an engagement, the client is the controller and we act as processor under a separate Data Processing Agreement.
From website visitors: pages viewed, referring source, approximate location derived from IP address, device and browser characteristics, and interactions with the page including clicks and scrolling. Our analytics tooling is configured to capture interaction events automatically and to record browsing sessions, which means your mouse movement, clicks and navigation on this site may be recorded and replayed by us for the purpose of understanding how the site is used. From people who contact us or book a call: your name, email address, company, telephone number where provided, and the content of your enquiry or booking. From the case-study assistant on this site: the text of questions you type into it.
We process enquiry and booking data to respond to you and to provide our services, on the basis of performance of a contract or steps taken at your request prior to entering one. We process analytics and session-recording data to understand and improve how this site performs, on the basis of our legitimate interests in operating and improving our business, balanced against your interests. We process data to comply with legal obligations where applicable. We do not sell personal data, and we do not use it for advertising or profiling.
Vercel Inc. (website hosting and delivery; United States, with EU edge processing). Plausible Insights OÜ (privacy-focused website analytics; Estonia, European Union. Plausible sets no cookies and stores nothing on your device, so it runs for every visitor and is not gated behind the consent banner). Google LLC. Google Analytics 4 (website analytics; United States, standard contractual clauses). Cal.com Inc. (scheduling, when you book a discovery call). Anthropic PBC (processes the text of questions you submit to the on-page assistants, in order to generate an answer). Google Fonts is self-hosted at build time, so no request is made to Google when you load a page. A current sub-processor list for consulting engagements, including entity, location, purpose and transfer mechanism, is published on our Security page, annexed to our Data Processing Agreement and provided during supplier onboarding.
Nothing non-essential loads on this site until you consent. Analytics (Google Analytics event tracking) is off by default: the scripts are not loaded at all, rather than loaded and suppressed. We do not record or replay your session. We used to offer that as a separate opt-in toggle for Mixpanel session replay; Mixpanel has been removed from this site and the toggle removed with it, so there is no session recording to consent to. You can accept, reject, or choose per category, and rejecting is exactly as easy as accepting. You can change your mind at any time using the "Cookie settings" link in the footer, and withdrawing consent stops collection immediately rather than at your next visit. We honour Global Privacy Control and Do Not Track signals automatically as a rejection, without showing you a banner. We do not use advertising or cross-site tracking cookies. One tool is deliberately outside this gate: Plausible, which sets no cookies, stores nothing on your device and does not build a cross-site profile. We run it for every visitor so that we can still count page views for people who decline everything else, and we are telling you here rather than relying on the exemption quietly.
It does not, and this section stays so that the answer is on the record rather than absent. Until 26 August 2026 this site could run RB2B, which attempted to resolve a visitor's IP address to the company they work for and, occasionally, to them personally. It has been removed. Nothing on this site now attempts to identify you or your employer, and no visitor identification data is collected. If RB2B identified you while it was running, you can ask us what we hold and to delete it, and we will act on it without asking for a reason: email privacy@tenhaw.com. You also have the right to complain to the Information Commissioner's Office.
During a consulting engagement we may be given access to systems and data belonging to our client, which can include personal data relating to their staff and customers. In that context the client is the controller and Tenhaw is the processor. We act only on documented instructions, under a Data Processing Agreement that specifies purposes, sub-processors, international transfer mechanisms, security measures, retention and deletion. We do not use client data to train models, and we do not transfer client data into third-party AI tools unless the client has expressly approved that tool in writing.
Some of our processors are based in the United States. Where personal data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with supplementary measures where required.
Enquiry and booking data is retained for up to 24 months from your last interaction with us, unless you are or become a client, in which case it is retained for the duration of the relationship and for six years afterwards to meet legal and professional record-keeping obligations. Website analytics data is retained for 14 months. Session recordings are retained for 30 days. Case-study assistant conversations are retained for 30 days.
Data is encrypted in transit and at rest. Access to systems containing personal data is restricted to personnel who need it, protected by multi-factor authentication. Our technical and organisational measures, our assurance roadmap and our responsible-disclosure process are described on our Security page.
Under UK GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing (including profiling and session recording), to data portability, and to withdraw consent where processing is based on consent. To exercise any of these rights, email privacy@tenhaw.com. We will respond within one month. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office at ico.org.uk.
We will update this policy when our processing changes, and will change the date shown at the top of this page. Material changes affecting existing clients will be notified directly.
For privacy questions, data subject requests, or to request our Data Processing Agreement, email privacy@tenhaw.com.
A 30-minute call with James Rooney. Bring your privacy review, your DPIA questions or your sub-processor list, and we will tell you what we can evidence today and what is still in progress.
most start with a fixed-price AI Readiness Audit · £44,000 · 4 weeks · working prototypes