Täbiau - Privacy Notice

Version: 1.0 (draft)
Proposed effective date: 28th October 2026
Service provider: Graham Crichton trading as Täbiau
Location: Northern Ireland, United Kingdom
Postal address: Office 2104, 92 Castle Street, Belfast BT1 1HE, Northern Ireland Privacy contact: support@tabiau.com
Website: https://tabiau.com

1. About this notice

This Privacy Notice explains how Täbiau collects and uses personal information when you visit our website, contact us, register for or use the Täbiau business management service, or act as an authorised user of a business account. It also explains the different arrangements that apply when a business uses Täbiau to manage information about its own customers, staff or other contacts.

Täbiau is operated by Graham Crichton trading as Täbiau ('Täbiau', 'we', 'us' or 'our'). For the personal information described in Sections 3-5 that we use for our own business purposes, Täbiau acts as a data controller. When we store or process personal information entered into a customer's workspace on that customer's instructions, Täbiau normally acts as a data processor, and the business customer is normally the controller. Our Data Processing Agreement explains that relationship.

This notice is intended to meet relevant transparency obligations under the UK GDPR and Data Protection Act 2018, as amended, and the EU GDPR where it applies. Additional local privacy rules may apply to some users.

2. Whose information this notice covers

This notice covers website visitors; people who enquire about Täbiau; account owners and authorised staff users; payment and billing contacts; and people who speak to our support team. It also explains how we handle requests from individuals whose information a customer has entered into Täbiau.

Täbiau is designed for business and professional use. It is not aimed at children. Business customers may nevertheless enter information about children or other individuals where their own activities lawfully require it; those customers are responsible for explaining their use of that information.

3. Personal information we collect as controller

Depending on how you interact with Täbiau, we may collect:

• Identity and contact details: your name, email address, telephone number, business name, job title and contact preferences.
• Account information: usernames, account identifiers, account status, edition, subscriptions, role and permission settings, authentication and security records.
• Billing and transaction information: billing name and address, subscription, invoice, tax and payment status records. Payment card details may be collected directly by a payment provider rather than by Täbiau; the provider's checkout information identifies the arrangements in use.
• Technical and usage information: IP address, device and browser details, operating system, timestamps, diagnostic information, event logs, session information and feature usage where collected by our systems.
• Support and correspondence: enquiries, support messages, feedback, and material you choose to share with us when seeking assistance. Please avoid submitting unnecessary sensitive personal information in support messages.
• Website and preference information: essential cookies and similar technologies, saved settings and, where used, optional analytics or marketing technologies as explained in Section 10.
• Information from others: information provided by your employer or account administrator, referral partners, payment providers and connected services, where relevant to your request or our provision of Täbiau.

Some of this information is necessary to create or operate an account, issue invoices, secure the Service or comply with law. If you do not provide necessary information, we may be unable to provide the relevant feature or service.

4. How and why we use personal information

Our main purposes and usual legal bases are:

• Accounts and subscriptions: we use account details to register customers and provide requested features. The usual basis is contract for an individual customer, or legitimate interests in supplying the Service to a business for its staff users.
• Support and enquiries: we reply to questions, manage support requests and send essential service information. The usual basis is contract or legitimate interests.
• Billing and compliance: we administer payments, invoices, financial records and tax requirements. The usual basis is contract or a legal obligation, as relevant.
• Security and legal claims: we prevent misuse, investigate incidents and maintain appropriate audit records. The usual basis is legitimate interests in securing the Service or a legal obligation.
• Reliability and product improvement: we diagnose errors and review feature use. The usual basis is legitimate interests, subject to safeguards, and consent or a statutory exception where required for cookies and similar technologies.
• Marketing: we send product news and offers when permitted. The usual basis is consent where required or legitimate interests where a lawful business-marketing or soft opt-in route applies, subject to electronic marketing rules.
• Legal requests: we respond to lawful requests and meet regulatory duties on the basis of legal obligation or legitimate interests, as appropriate.

When we rely on legitimate interests, we consider the interests and rights of the people affected. Our interests include providing a functional service, maintaining security, handling enquiries, improving reliability and communicating relevant information to business users.

Where EU GDPR applies, the appropriate legal basis will be assessed under that regime rather than assuming that every UK-specific provision applies in the same way.

5. Customer workspaces: when a business controls the data

A business using Täbiau may enter contact records, booking details, messages, appointment notes, orders, invoices, documents, images and other information relating to its own customers, staff, suppliers and contacts ('Customer Data'). The business normally decides what to collect, why it is collected, who can see it, how long it should be kept and how it is used. That business is normally the controller.

Täbiau processes this Customer Data on the business's documented instructions and to operate the features it chooses. Those features may include calendars, bookings, automations, messaging, payments, integrations and AI-assisted extraction or categorisation. Where an external connection is enabled, information may be sent to the provider selected by the business, subject to the roles and terms applying to that connection.

If you are a customer, patient, client, employee or other contact of a business using Täbiau, contact that business first about your personal information or privacy rights. We will assist that business where required by our Data Processing Agreement and applicable law. If we receive a request directly, we may need to refer it to the business that controls the information.

Customer Data is not treated as ours simply because it is stored in Täbiau. We do not use it for our own general-purpose AI model training under this notice. Any materially different use would require an appropriate legal basis, transparency, and the relevant customer authorisation where we act as processor.

6. AI-assisted features

If a business chooses to use AI or optical character recognition features, text, images, receipts or other relevant content may be processed to produce the requested result. Automated results may contain mistakes and should be checked by the business before use.

Relevant AI/OCR suppliers, processing locations, data retention and any provider model-training settings must be identified in Täbiau's published subprocessor information before these features are made available for real customer personal data. The business remains responsible for deciding whether it is lawful and appropriate to submit the particular information.

We do not currently describe the Täbiau account service as making solely automated decisions about individual account holders that have legal or similarly significant effects. If such processing is introduced, we will provide any additional required information and safeguards before it begins.

7. Who receives personal information

We may disclose personal information, only as necessary and appropriate, to:

• Hosting, infrastructure, backup, security, monitoring and technical support providers.
• Payment processing, accounting and billing providers.
• Email delivery, customer support and communications suppliers.
• AI/OCR or other feature providers where the business elects to use the relevant feature.
• Advisers, auditors, insurers or professional service providers under suitable confidentiality duties.
• Regulators, courts, law enforcement or other recipients where lawful disclosure is required.
• A successor in the event of a legitimate sale, restructuring or transfer of the business, subject to applicable law.

We do not sell Customer Data merely because it is uploaded into Täbiau.

8. Storage locations and international transfers

Täbiau is designed with a preference for UK and European data handling. The exact hosting, backup, support, AI-processing and remote-access locations must be verified and listed before publication. A European server address alone does not establish that all access or data flows remain within Europe.

Where we transfer personal data internationally, we will comply with applicable transfer rules. Depending on the transfer, this may include an adequacy decision or appropriate contractual safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or EU Standard Contractual Clauses where relevant. Additional assessments and protections will be applied where required. Contact us to request information about applicable safeguards.

Our Customer Data processing locations and transfer restrictions are also addressed in the Data Processing Agreement. We will not make an unrestricted promise that data never leaves a territory until the relevant supply chain has been verified.

9. How long we keep personal information

We keep personal information only for as long as needed for the purposes described here, and then delete, anonymise or securely retain it where required by law. The period depends on the type of information:

• Account and subscription information: while an account is active, then for 7 years where necessary for account administration, disputes or legitimate records.
• Billing and tax records: for the period required by applicable accounting and tax laws.
• Support messages and operational logs: for 2 years and 1 year respectively, subject to a justified extension for an incident or legal dispute.
• Website and cookie information: for the lifetimes described in the published cookie inventory and consent/preferences controls.
• Customer Data in workspaces: for the account duration and the export, deletion and backup-cycle periods in the Data Processing Agreement and applicable retention schedule.

These bracketed periods must be completed from Täbiau's actual retention settings. We will not keep information indefinitely just because it may be useful one day.

10. Cookies and similar technologies

We may use essential technologies to keep users signed in, maintain security, remember required session state and deliver the website and application. Some preferences or analytics may also use cookies, local storage or similar technology.

Where consent is required, we will request it before using the relevant technology and provide a way to change preferences. Certain narrowly defined statistical or appearance-preference uses may qualify for an exception under current UK rules if the required notice and simple, free objection mechanism are provided. These exemptions are not a general permission for advertising trackers.

11. Security

We take a risk-based approach to protecting personal information, including appropriate access restrictions, authentication, secure transmission, system maintenance, monitoring and recovery measures. The measures actually operated for Customer Data are described in the Data Processing Agreement and its security schedule.

No connected service can guarantee absolute protection against every security incident. We investigate suspected incidents and fulfil applicable notification obligations. This does not remove our legal responsibilities for protecting personal information.

12. Marketing and service messages

We may send necessary account notices, security alerts, invoices and important service changes to the relevant account contacts. These are service messages, not a way to disguise promotional marketing.

Where we send optional promotional emails, we will follow applicable electronic marketing rules and provide an unsubscribe route. You may object to use of your personal information for direct marketing at any time, and we will stop that use. Withdrawing marketing permission does not prevent necessary operational messages.

13. Your privacy rights

Depending on the law that applies and the circumstances of the processing, you may have rights to access your personal information, correct it, request its deletion, restrict processing, receive portable information, object to processing and withdraw consent where consent is the legal basis. You may also have safeguards relating to certain automated decisions.

You have the right to object to the use of your personal information for direct marketing at any time. You may also object to some uses based on legitimate interests, subject to the applicable legal rules.

To exercise rights relating to information Täbiau controls, contact support@tabiau.com. We may need to verify identity before acting. We will respond within the time required by applicable law. If your request relates to information held in another business's Täbiau workspace, please contact that business as controller; we can help it respond as processor.

14. Complaints

You can raise a concern or a formal data protection complaint at support@tabiau.com, or by writing to the postal address above. We will provide an accessible complaints process, acknowledge a complaint within 30 days, investigate as appropriate and communicate the outcome without undue delay, in accordance with applicable UK requirements.

You also have the right to complain to the UK Information Commissioner's Office (ICO): https://ico.org.uk/. Where other data protection laws apply, you may also have the right to contact your local competent supervisory authority. Nothing in our contractual Northern Ireland jurisdiction clause removes rights to complain to a regulator or rights that cannot be restricted by contract.

15. Changes to this notice

We may update this notice when our Service, suppliers or legal obligations change. We will publish the new effective date and bring material changes to affected users' attention when required. If a new purpose requires advance notice or consent, we will provide it before the new processing begins.

16. Contact details

Graham Crichton trading as Täbiau
Northern Ireland, United Kingdom
Postal address: Office 2104, 92 Castle Street, Belfast BT1 1HE, Northern Ireland
Privacy enquiries and complaints: support@tabiau.com
Website: https://tabiau.com
Data Protection Officer / EU representative (if legally required): Graham Crichton

This notice should be read alongside the Täbiau Terms and Conditions and, for business customers, the Data Processing Agreement.