1. Who is responsible for your data
JorTech is a trading name of TicketWave HQ Ltd, a company registered in England and Wales, company no. 17143167. TicketWave HQ Ltd is the data controller for the personal data described below. Contact us about privacy at hello@jortech.co.uk.
2. What we collect, and why
| Data | When / why | Lawful basis |
|---|---|---|
| Your name, email address, phone number, the device and the fault you describe, and any details you add to the enquiry | When you use our enquiry form, or contact us by phone or email, so we can call you back, diagnose the fault, quote the work and arrange a visit or collection. | Steps to enter into a contract; our legitimate interest in responding to enquiries |
| Details of the repair we carry out, the device, the parts fitted, the work done and the price agreed | To carry out the repair, give you an honest fixed quote before any work, and keep a record of what we did. | Performance of our contract with you; legal obligation (accounting) |
| Photographs of your device and of everything handed over with it (the case, the charger, the bag), and the list of those items on your job ticket | Taken when a device comes into our care, with you there, so there is a record of exactly what came in and what condition it was in, and everything goes back to you. We photograph the device and its accessories; we do not open your files to do it. The photographs are stored end-to-end encrypted in Proton Drive, in a folder for your job. See how we look after your device. | Performance of our contract with you; our legitimate interest in being able to show what we received |
| Access to your device and the files on it, only where a repair requires it (for example a data recovery job or a virus clean-up) | Only to carry out the repair you have asked for. We do not copy, keep or look through your files beyond what the job needs, and we tell you first if a repair puts your data at risk. | Performance of our contract with you |
| Records of our dealings, messages, receipts and invoices | To run the job and meet accounting obligations | Contract; legal obligation; legitimate interests |
| Job applications: your name, contact details, the role you are interested in, where you are based, any links you share, your written answers, and the CV you email us | When you apply for a job through the careers form or by emailing careers@jortech.co.uk, so we can assess your application, contact you about it, and run the hiring process. | Steps to enter into a contract (of employment); our legitimate interest in recruiting |
| Technical data, IP address, browser/device type, pages viewed, referring page, timestamps | Standard server/CDN logs kept by our hosting provider (Vercel London), plus cookieless analytics (Plausible Community Edition on our own server, OVHcloud, France) and error monitoring (Sentry, EU region). None of these profile you or set tracking cookies. | Our legitimate interest in a secure, working website |
We do not ask for sensitive information, and our forms do not want any. The one job where sensitive information reaches us anyway is a data recovery, and section 2a below explains what we do about that. We do not carry out automated decision-making or profiling. The forms on this site (the enquiry form and the careers application form) are delivered to our inboxes by email, and an enquiry is also recorded in our own commercial system (section 4); they do not take payment. There is no online checkout on this website, you pay for a repair once it is done, in person or by an invoice we send you.
2a. Sensitive information on your device
A data recovery is different from every other job we do, so it gets its own rule.
When we copy a drive, we copy all of it. We cannot lift out the photographs and leave the rest. So the copy may hold things the law treats as especially private: medical letters, test results, photographs of your family, what you believe, who you vote for. We did not ask for any of it and we would rather not have it. We have it because it was on your drive.
The law does not care that we did not choose it, and it does not care that we never open it. Holding it is enough. So before we take a copy we ask you to say yes to it, in writing and in plain words, as a separate question. You can say no. You can change your mind afterwards, and we will destroy the copy that day and tell you when it is gone.
If you would rather we did not take a copy at all, say so. Where the job allows it we move your data straight to its new home instead, and then no copy ever exists.
While we do hold it: it sits on our own encrypted drive, nobody browses it, it never becomes part of your repair record, and it is erased within 30 days of your device being returned to you at the latest.
What we find. A repair can put things in front of us that have nothing to do with the fault: your documents, your photographs, other people's details, things you would rather nobody saw. We treat all of it as private. We do not read it, copy it, mention it or act on it, and it never goes into your job record. Whoever does the work is bound by the same rule, and our staff and contractors sign up to it.
There is one exception, and we would rather state it than hide it. If, in the course of a repair, we come across material that the law requires us to report, such as images of child abuse, we will report it to the police, we will not tell you we have done so, and we will not continue the work. We do not go looking, and a repair never includes a search of your files. This exception exists because the law leaves us no choice, not because we want to look.
2b. Remote support sessions
If you ask us to fix something over a remote session, you run the RustDesk program and read us a one-time code. While the session runs we can see your screen and use your keyboard and mouse. You watch the whole time and can end it at any moment.
We look only at what you asked us to fix. We do not record the session, and we do not copy, photograph or note anything on your screen beyond the fault. Files are moved only if you ask us to. If a password is needed, we look away while you type it.
The two computers are joined through our own relay server, which we run on hardware rented from OVHcloud in Gravelines, France. The session is encrypted end to end, so the relay passes it on without being able to read it. The relay keeps your device's support ID, its IP address and when it connected. We delete those device records after 90 days, and the relay's connection logs after 7 days. We also write a short note of the session, when it was and what we did, into your job record.
We do this because you asked us to: it is part of the service you agreed to. We never start a session you did not ask for. If someone says they are from JorTech and asks to connect to your computer, end the call and contact us through this website.
3. Cookies and tracking
This website does not set any tracking, advertising or marketing cookies, and does not profile you. Our analytics are cookieless: Plausible Community Edition, run on our own server in France, counts pageviews without cookies or shared identifiers, and is the only analytics on this site. The full breakdown lives on the standalone Cookie Policy. If we ever add non-essential cookies, we will ask for your consent first via a banner. You can block or delete cookies in your browser settings at any time.
4. Who we share it with
We do not sell your data. We share it only with the service providers who help us run the business, and only as needed:
- Hosting & CDN, Vercel Inc. The site and its server-side functions are configured to run in the London (lhr1) region. Two endpoints, the enquiry and careers form handlers, run on Vercel's edge network, which means they may execute at the network location nearest the visitor rather than in London; each processes the submission in memory and passes it on without storing it, by email and, for an enquiry, to our commercial system as well.
- Analytics, our own Plausible Community Edition server, on hardware rented from OVHcloud (OVH Limited) in Gravelines, France: cookieless pageview counts on jortech.co.uk, no personal profiles. No analytics data goes to Plausible Insights OÜ or anyone else.
- Error monitoring, Sentry, hosted in Sentry's EU region (de.sentry.io). The integration is present but is currently switched off: no error reports are sent at all. If we turn it on, what would be sent is a technical error report (the page, the browser type and the error itself) so we can find and fix the fault. No session recordings, no marketing use.
- Email delivery (outbound), Resend delivers your enquiry from the form to our inbox.
- Commercial records, Odoo, TicketWave HQ Ltd's own commercial system. We run it on our own server, on hardware rented from OVHcloud (OVH Limited) in Gravelines, France. An enquiry you send through the form is recorded there as well as emailed to us, so we can keep track of it and follow it up. Odoo S.A., the company that publishes the software, does not host it and receives no enquiry data. Enquiries that do not become jobs are deleted from it after 12 months (section 5).
- Photo storage, Proton Drive (Proton AG, Switzerland), end-to-end encrypted, holds the photographs taken when a device comes into our care, for the period in section 5.
- Email hosting (inbound), Proton Mail (Proton AG, Switzerland) hosts the mailbox that receives mail sent to
@jortech.co.uk. Switzerland has a UK adequacy decision. - Remote support relay, our own RustDesk server on hardware rented from OVHcloud (OVH Limited), in Gravelines, France. It connects remote sessions and keeps only the records described in section 2b.
- Professional advisers (for example our accountant) and, if legally required, regulators or law enforcement.
Some upstream providers may transfer data internationally. Where transfers happen, they are protected by an appropriate safeguard, a UK International Data Transfer Agreement / Addendum, UK adequacy regulations, or equivalent.
5. How long we keep it
Job applications: for the recruitment round and up to 6 months after we have answered you, then deleted, unless you ask us to keep your details for future roles. Applications are used for recruitment only and never shared or sold. Enquiries that do not become jobs: up to 12 months, then deleted. That includes their record in our commercial system, which removes them automatically. Repair records, receipts and invoices: for the life of the job and then up to 6 years afterwards, to handle warranty queries, disputes and accounting requirements. Photographs taken when your device comes into our care: 90 days after it is handed back to you, the same period as our workmanship guarantee, then deleted from Proton Drive, its trash included. The list of what came in stays on your job ticket as part of the repair record. Server logs: a short period set by the hosting provider. Analytics records on our analytics server: 24 months, then deleted. We then delete or anonymise the data.
Copies of your files are different, and we keep them for days, not years. If a job needs us to copy data off your device, for a data recovery or a backup taken before risky work, that copy is held on an encrypted drive, kept only until you have confirmed you have your data back, and securely erased within 30 days of your device being returned to you at the latest. We will tell you when it has gone. The 6-year retention above applies to the record of the repair, never to the contents of your device. If you want the copy destroyed sooner, ask and we will do it that day.
6. Your rights
Under UK data protection law you have the right to: access a copy of your data; have inaccurate data corrected; have data erased (in certain cases); restrict or object to processing (including processing based on legitimate interests); data portability; and to withdraw consent where we rely on it (without affecting earlier processing). To exercise any of these, email hello@jortech.co.uk, and we will respond within one month.
If you are not happy with how we have handled your data you can complain to the Information Commissioner's Office (ICO), ico.org.uk, helpline 0303 123 1113, though we would appreciate the chance to put things right first.
7. Keeping data safe
We use reasonable technical and organisational measures to protect personal data, for example access controls, encryption in transit (HTTPS), and limiting who can see it. When we work on your device we treat your files as private and confidential. No method of transmission or storage is completely secure, but we take it seriously and review our practices.
7a. If something goes wrong
We would rather tell you about a problem than have you find out.
If your information is ever lost, stolen or seen by someone who should not have seen it, we investigate the same day. Where the law requires it we report it to the Information Commissioner within 72 hours of finding out. Where there is a real risk to you, the clearest case being a drive holding a copy of your files going missing, we contact you directly and tell you what happened, what was on it, what we have done and what you should do. We do not wait to be asked.
We keep a written record of every incident, however small, including the ones that turn out to be nothing.
8. Other websites
This site may link to other websites. We are not responsible for their content or privacy practices, so please check their own policies.
9. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top shows when. Significant changes will be highlighted on this page.
10. Contact
Any privacy questions or requests: hello@jortech.co.uk.
11. Related documents
Cookie Policy · Terms & Conditions · Accessibility
12. Changelog
- v1.8, October 2026, enquiries sent through the form are now also recorded in our own commercial system, Odoo, which we run on our own server at OVHcloud in Gravelines, France. Odoo S.A., which publishes the software, receives no enquiry data. Enquiries that do not become jobs are deleted from it after 12 months, the same period as before (sections 2, 4 and 5).
- v1.7, October 2026, section 2a now says what we do with things on your device that have nothing to do with the fault, names the one exception the law imposes (material we are required to report), and says the yes to a whole-drive copy is taken in writing. In sections 2a and 5 the 30-day erasure of a copy is now counted from your device being returned to you, which is the promise we keep in practice. Matches terms v1.6.
- v1.6, October 2026, analytics moved from Plausible's cloud (Plausible Insights OÜ, Germany) to our own Plausible Community Edition server on OVHcloud in Gravelines, France, and its records are kept for 24 months (sections 2, 3, 4 and 5).
- v1.5, October 2026, named where the check-in photographs are kept: Proton Drive (Proton AG, Switzerland), end-to-end encrypted (sections 2, 4 and 5).
- v1.4, October 2026, added the photographs we take when a device comes into our care (section 2) and how long we keep them, 90 days after handover (section 5).
- v1.3, October 2026, added remote support sessions (section 2b): what we see, what we keep, where the relay runs and for how long, and the relay in section 4.
- v1.2, August 2026, corrections found by an audit. Inbound email is hosted by Proton Mail, not Cloudflare Email Routing, which was named in error and is not in the mail path. Error monitoring is present but switched off, and now says so. The hosting description now explains that the enquiry-form endpoint runs on the edge network rather than only in London.
- v1.1, August 2026, renamed throughout from Leeds Tech Repair to JorTech, and the stated service area widened to West Yorkshire and parts of North Yorkshire. The trading entity, TicketWave HQ Ltd, is unchanged.
- v1.0, July 2026, initial publication, as Leeds Tech Repair.