Privacy policy
What we collect through this website, why, and what you can ask us to do about it.
Who we are
Prioto Ltd. is the data controller for personal data collected through this website. We are a company registered in Scotland, company number SC521487, with a registered office at Suite 8 Buchanan Business Park, Cumbernauld Road, Glasgow, G33 6HZ.
For anything in this policy, including any request about your own data, contact us at info@prioto.com or 0330 010 0760.
We are registered with the Information Commissioner's Office, registration number ZB742240.
What this policy covers
This policy is about the prioto.com website — what happens when you read these pages or send us an enquiry.
It does not cover the Prioto platform. Energy and building data we process for customers is governed by the contract with that customer, and where it includes personal data we act as a processor under their instructions rather than as the controller. If you are a customer and want to know how platform data is handled, ask us and we will send you the relevant terms.
What we collect
When you send us an enquiry
The contact form asks for your name, your organisation, your email address, and whatever you write in the message. All of it goes to us so that we can reply. The organisation field is optional; the rest we need in order to respond.
The form posts to this website's own server, which delivers the enquiry straight into our Microsoft 365 mailbox. No third-party form service or email provider handles it, and any further correspondence lives in our email in the ordinary way. Sending an enquiry does not add you to any mailing list.
When you simply read a page
Our hosting provider records standard server logs: the IP address making the request, the page requested, the time, and the browser's user-agent string. These exist to keep the site running and to identify abuse, and we do not use them to build any profile of you.
What we do not do
This site sets no cookies, and we run no analytics or advertising trackers. There is nothing here that follows you to other sites, and nothing that needs your consent to store information on your device. There is no cookie banner because there is nothing to ask you about.
Web fonts
Our typefaces are served from this website, not from Google Fonts or any other font service. The font files sit on the same server as the rest of the site, so loading a page does not tell anyone else that you visited it, and no third party sees your IP address for a typeface.
Why we are allowed to use it
UK GDPR requires a lawful basis for each use. Ours are:
- Legitimate interests — replying to an enquiry you sent us, and keeping the website secure and working. Our interest is in running a business and answering the people who approach it; we think that is what you expect when you fill in a contact form.
- Legal obligation — where we have to keep records, for example for tax purposes once you become a customer.
We do not rely on consent for anything on this site, because we do not do anything here that requires it. We will not add you to a marketing list because you sent an enquiry.
How long we keep it
We keep enquiry correspondence for a maximum of 12 months from our last exchange with you, and often delete it sooner, unless it has become part of a customer relationship with its own retention terms. Server logs are kept for a short period for operational and security purposes and are then discarded.
Backups and residual data
When information is deleted from our live systems, it may still exist in encrypted backup files. These backups are maintained solely for disaster recovery and business continuity purposes. Data in backups is:
- Not actively accessed or processed for any operational purpose
- Protected with appropriate technical and organisational security measures
Who else sees it
We do not sell personal data, and we do not share it for anyone else's marketing. It reaches only the suppliers who help us run the site and our business:
| Supplier | What for | What they receive |
|---|---|---|
| Microsoft 365 | Our email, including delivery of the contact form | Enquiries and any correspondence that follows |
| Railway | Website hosting | Server logs, including your IP address |
We may also disclose information where the law requires it.
Where your data goes
Your enquiry stays in the UK. Our Microsoft 365 tenancy is in the UK, and the contact form delivers into it directly, so what you write in the form does not pass through another company or leave the country.
The website itself is hosted in the Netherlands, so the server logs described above sit there. Transfers from the UK to countries in the European Economic Area are permitted under the UK's adequacy regulations, so no additional safeguard is needed for that — and nothing on this site sends your data to the United States.
Your rights
Under UK GDPR you can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict how we use it, or provide it in a portable form. You can also object to our processing where we rely on legitimate interests — including, at any time, asking us not to contact you again.
Email info@prioto.com and we will respond within one month. There is no charge.
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113.
Changes to this policy
If we change how this site handles personal data, we will change this page and update the date at the top. The version you are reading is the current one.