Privacy Notice

Controller and contact details

Involvec Solutions Ltd, whose registered office is 2 Frederick Street, Kings Cross, London WC1X 0ND, United Kingdom, is controller of the personal data described in this Notice except where clause 8 applies.

Privacy enquiries, rights requests and data-protection complaints should be sent to privacy@involvecsolutions.com.

Legal framework

We process personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations and other applicable data protection legislation, in each case as amended or replaced.

References to a lawful basis are references to the basis applicable to the particular processing activity. More than one basis may apply to different aspects of the same relationship.

Categories of personal data

1. (a)

   identity data, including name, title, date of birth where verification requires it, business role and authorised representative details;

2. (b)

   contact data, including email address, telephone number, billing address, postal address and company information;

3. (c)

   account data, including customer identifiers, usernames, authentication events, security settings, recovery records and permissions;

4. (d)

   commercial data, including enquiries, requirements, quotations, Orders, subscriptions, invoices, payment status, transaction references, refunds and disputes;

5. (e)

   project data, including briefs, files, content, credentials supplied for delivery, approvals, revision history, support tickets, communications and acceptance records;

6. (f)

   technical data, including IP address, browser, operating system, device information, session identifiers, security events, logs and diagnostic information;

7. (g)

   usage data, including pages viewed, referral source, interactions, feature usage, performance events and cookie preferences;

8. (h)

   recruitment data, including CVs, portfolios, employment history, interview notes, eligibility information and references; and

9. (i)

   marketing data, including communication preferences, consent records, campaign interactions and suppression records.

Special-category and highly sensitive data

Our ordinary Services do not require customers or website users to provide special-category personal data, criminal-offence data, government identifiers, complete payment-card details or other highly sensitive information unless expressly agreed and legally justified.

A person must not upload unnecessary sensitive data. Where such processing is required for a project, the applicable Order must identify the purpose, lawful condition, security requirements, retention and responsibilities of the parties.

Sources of personal data

We obtain personal data directly from individuals, from authorised representatives and colleagues, from account and website activity, from payment and verification providers, from service-delivery partners and from publicly available professional or corporate sources where lawful.

A customer who provides personal data about another person must ensure that it has authority and a lawful basis to do so and must provide any privacy information required by law.

Purposes and lawful bases

1. (a)

   responding to enquiries, preparing quotations and taking requested steps before a contract: performance of a contract or pre-contractual steps;

2. (b)

   creating accounts, accepting Orders, supplying Services and Digital Products, providing support and managing billing: performance of a contract;

3. (c)

   verifying identity, preventing fraud, securing systems, investigating misuse and enforcing contractual rights: legitimate interests and, where applicable, legal obligation;

4. (d)

   maintaining accounting, tax, corporate, compliance and audit records: legal obligation and legitimate interests;

5. (e)

   diagnosing errors, measuring performance, improving Services and planning capacity: legitimate interests, subject to an assessment of individual rights;

6. (f)

   sending requested updates and lawful direct marketing: consent where required or legitimate interests where electronic-marketing law permits;

7. (g)

   recruiting and assessing applicants: pre-contractual steps, legitimate interests and legal obligations;

8. (h)

   responding to courts, regulators, law enforcement and legal claims: legal obligation and legitimate interests in establishing, exercising or defending rights; and

9. (i)

   carrying out corporate transactions, insurance, professional advice and due diligence: legitimate interests, subject to confidentiality and proportionality safeguards.

Contract and account administration

We use identity, contact, account, commercial and project data to manage enquiries, quotations, Orders, requirements, delivery, support, invoices, renewals, acceptance, complaints and enforcement.

If required information is not provided, we may be unable to verify an account, accept an Order, issue an invoice, release a Deliverable or comply with a legal obligation.

Customer-controlled data and processor services

Where a Business Customer determines why and how personal data in its system, application, database or project materials is processed and we handle that data only to supply contracted Services on documented instructions, the Business Customer is normally controller and we are processor.

The applicable Data Processing Addendum or contractual data-processing clauses govern instructions, confidentiality, security, subprocessors, international transfers, assistance, audit information, return and deletion.

We remain controller for our own account management, billing, fraud prevention, security, legal compliance and relationship administration, even where we act as processor for separate project data.

Payments and fraud prevention

Payments may be processed by Stripe or another provider identified at checkout. The provider may receive billing, transaction, device, location and fraud-prevention data and may act as processor, independent controller or both depending on the activity.

We do not ordinarily receive or store complete card numbers or card security codes. We may receive payment status, card brand, masked account details, last four digits, billing information, risk signals, refund information and transaction identifiers.

Recipients of personal data

1. (a)

   payment, banking, fraud-prevention and identity-verification providers;

2. (b)

   hosting, database, storage, authentication, email, communications, support, monitoring, analytics and security providers;

3. (c)

   employees, contractors and professional advisers who require access and are subject to appropriate duties;

4. (d)

   third-party platforms and vendors selected by the customer or required for an agreed integration;

5. (e)

   insurers, auditors, accountants, legal advisers, debt-recovery providers and corporate transaction counterparties;

6. (f)

   courts, regulators, tax authorities, law-enforcement bodies and public authorities where disclosure is lawful or required; and

7. (g)

   a purchaser, investor, lender or successor in connection with a bona fide financing, reorganisation, merger or sale, subject to appropriate safeguards.

Service providers and subprocessors

We select providers that are appropriate to the nature and risk of the processing and enter into contractual protections where data protection law requires them.

Where we act as processor, subprocessors are appointed in accordance with the applicable customer contract. A current subprocessor list or further information may be requested, subject to confidentiality and security restrictions.

International transfers

Personal data may be processed outside the United Kingdom where our providers, contractors or project infrastructure are located internationally.

Where a restricted transfer occurs, we use an applicable adequacy regulation, recognised contractual mechanism, binding corporate rules or another lawful transfer basis and apply supplementary measures where the circumstances require them.

Information about the relevant safeguard and how to obtain a copy may be requested from the privacy contact, subject to lawful redaction of confidential or security-sensitive material.

Retention principles

We retain personal data only for as long as reasonably necessary for the purpose for which it was obtained, including delivery, support, security, accounting, tax, audit, insurance, regulatory compliance and legal claims.

Retention is determined by the nature and sensitivity of the data, the amount and context of processing, the risk of harm, contractual commitments, limitation periods and legal requirements.

Indicative retention periods

1. (a)

   enquiry and prospect records: generally up to 24 months after the last meaningful contact;

2. (b)

   customer accounts: for the life of the account and a reasonable closure and recovery period;

3. (c)

   Orders, invoices, transaction and tax records: generally six years after the end of the relevant relationship or accounting period;

4. (d)

   project, delivery, acceptance and support records: generally six years where required to evidence performance or manage claims;

5. (e)

   unsuccessful recruitment records: generally up to 12 months unless a longer talent-pool period is expressly agreed;

6. (f)

   website access and request analytics logs: generally up to 35 days; technical and security logs may be retained for another proportionate risk-based period, or longer where required for an incident, fraud investigation or legal claim; and

7. (g)

   marketing suppression records: for as long as reasonably necessary to honour an opt-out and demonstrate compliance.

Security measures

We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.

Measures may include encryption in transit, authentication controls, role-based access, row-level security, restricted administrative privileges, private storage, signed links, logging, monitoring, backups, incident procedures and confidentiality obligations.

No internet service or security control can guarantee absolute security. Individuals should use unique credentials, enable available security controls and avoid sending unnecessary sensitive data.

Personal data breaches

We investigate suspected personal data breaches and take containment, recovery, risk-assessment and notification steps required by applicable law.

Where we act as processor, we notify the relevant controller without undue delay after becoming aware of a personal data breach affecting customer-controlled data, in accordance with the applicable contract.

Individual rights

1. (a)

   the right to be informed about processing;

2. (b)

   the right to request access to personal data;

3. (c)

   the right to request correction of inaccurate or incomplete data;

4. (d)

   the right to request erasure in circumstances prescribed by law;

5. (e)

   the right to request restriction of processing;

6. (f)

   the right to object to processing based on legitimate interests and to object to direct marketing at any time;

7. (g)

   the right to data portability where the statutory conditions apply;

8. (h)

   the right to withdraw consent without affecting earlier lawful processing; and

9. (i)

   rights relating to certain solely automated decisions producing legal or similarly significant effects.

Exercising rights

A rights request should be sent to privacy@involvecsolutions.com and should identify the individual, the relevant relationship or account and the right being exercised.

We may request information reasonably necessary to verify identity and authority. Rights are not absolute; exemptions, competing rights, legal duties and retention requirements may apply. We will respond within the period required by law and explain any refusal, restriction or lawful extension.

Direct marketing

Marketing communications are sent only where a lawful basis and the applicable electronic-marketing rules permit them. A recipient may unsubscribe using the communication's opt-out facility or by contacting us.

Service, security, billing, delivery, legal and account notices are not marketing and may continue where necessary notwithstanding a marketing opt-out.

We do not sell personal data to third parties for their independent marketing.

Cookies and similar technologies

We use cookies, local storage, scripts, tags and other storage or access technologies for authentication, security, checkout, preferences, performance and, where enabled, analytics or marketing.

The Cookie and Similar Technologies Notice explains the categories, legal controls and choices available. Technologies requiring consent are not intentionally activated before the required affirmative choice is recorded.

Automated processing

We may use automated signals to detect fraud, secure accounts, prioritise support, route work or assess transaction risk. We do not ordinarily make decisions based solely on automated processing that produce legal or similarly significant effects for an individual.

Payment, banking and verification providers may use their own automated risk systems under their respective terms and privacy notices.

Children

Our website and Services are directed to adults and organisations. We do not knowingly enter into contracts with children or intentionally collect children's personal data through ordinary checkout.

A person who believes that a child has provided personal data without appropriate authority should contact the privacy team so that the circumstances can be investigated.

Data-protection complaints

A person who believes that our processing infringes data protection law may submit a complaint electronically to privacy@involvecsolutions.com. The complaint should explain the relevant data, dates, account or transaction, alleged issue and requested outcome.

We will facilitate the complaint, acknowledge it within the period required by law, make appropriate enquiries without undue delay, provide proportionate progress information where an investigation remains open and communicate the outcome.

A complainant may also contact the UK Information Commissioner's Office or another competent supervisory authority. We ask that the matter first be raised with us where practical so that we have an opportunity to investigate.

Changes to this Notice

We may revise this Notice to reflect changes in law, processing, providers, systems or Services. The current version and effective date will be published on this page. Material changes may also be communicated through the website, account or email where appropriate.