Privacy statement.

GRECU TECH LTD, 5 Ashdowne Lodge, 158-160 High Street, Harrow HA3 7AX, United Kingdom. Registered at Companies House (England & Wales) under company number 17411646. Contact: info@grecutech.com.

We are the controller for data we process for our own purposes (website visitors, prospects, candidates, suppliers). When we operate advertising accounts, CRM or HR workflows on behalf of a client, that client is the controller and we act as processor under a written data processing agreement (Article 28 GDPR).

We have not appointed a statutory Data Protection Officer; privacy questions are handled by our management board at the address above.

Website visitors. IP address (truncated where possible), device and browser data, pages visited, referrer. Purpose: security, availability and — with your consent — analytics and advertising measurement. Legal basis: legitimate interest (Article 6(1)(f)) for security; consent (Article 6(1)(a)) for non-essential cookies.

Contact and quote requests. Name, company, email, phone, message, configured placement details. Purpose: answering your request and preparing an offer. Legal basis: pre-contractual necessity (Article 6(1)(b)) and legitimate interest.

Placement orders and invoicing. Business buyers: company name, VAT number, contact details, order and payment data. Private buyers: name, address, postcode, city, country, contact details, order and payment data. Purpose: performing the agreement, invoicing and statutory bookkeeping. Legal basis: contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).

Candidates (recruitment). CV data, work history, qualifications and certificates, availability, work authorisation status, references. Purpose: sourcing and introducing candidates to construction, road-building and shipbuilding employers. Legal basis: consent for keeping your file in our database, and pre-contractual necessity for a specific vacancy. We do not process special category data unless legally required for a placement and you have explicitly consented, and we do not run automated decision-making or profiling that produces legal effects.

Marketing. Email address and interest data for service updates. Legal basis: consent, or the soft opt-in for existing clients under Regulation 22 of the Privacy and Electronic Communications Regulations (PECR). Every message contains a one-click unsubscribe.

We share personal data only where necessary: hosting and infrastructure providers, email and CRM tooling, analytics, publishers and media owners executing your placement, advertising platforms (Meta, Google), payment providers, accountants and, for recruitment, the prospective employer. Each processor is bound by a data processing agreement with confidentiality, security and sub-processor obligations. We never sell personal data.

Our default is processing inside the United Kingdom and the European Economic Area. Where a provider processes data outside the UK or EEA (typically United States advertising and analytics platforms), the transfer relies on UK adequacy regulations, the UK extension to the EU–US Data Privacy Framework, or on the ICO International Data Transfer Agreement (or EU Standard Contractual Clauses with the UK Addendum) combined with a transfer impact assessment and supplementary measures. A copy of the relevant safeguards is available on request.

Invoices and accounting records: 6 years (Companies Act 2006 and HMRC requirements). VAT records where applicable: 6 years. Client contracts and campaign files: 7 years after the end of the engagement. Contact and quote requests without a resulting contract: 24 months. Candidate files: 4 weeks after the procedure ends, or 12 months with your consent, renewable. Cookie consent records: 12 months. Server and security logs: up to 12 months.

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time without affecting the lawfulness of prior processing. Send your request to info@grecutech.com; we respond within one month and may ask for proof of identity in a data-minimising way. If you are not satisfied you may lodge a complaint with the UK Information Commissioner’s Office (ICO, Wycliffe House, Water Lane, Wilmslow SK9 5AF) or the supervisory authority of your habitual residence.

Our use of cookies and similar techniques, including the consent categories and how to change or withdraw your choice, is described in the cookie policy.

We apply TLS in transit, access control on a need-to-know basis, least-privilege credentials for advertising accounts, logging and regular review of processors. Personal data breaches are assessed without delay and, where required, reported to the Information Commissioner’s Office within 72 hours and to affected individuals where the risk is high.

We may update this statement to reflect changes in our services or the law. Material changes are announced on this page; the version date is shown at the top.