Privacy Policy

This Privacy Policy explains how Prova AI Governance Ltd, trading as Prova-AI (“we”, “us” or “our”), collects, uses, shares and protects personal data. We are a company registered in England and Wales (company number 17391555) with our registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

We act in two different roles, and this policy is clear about which applies:

• As a controller of personal data about visitors to our website, people who contact us or book a call, our clients’ and prospects’ business contacts, suppliers and partners. We decide why and how that data is used. Sections 2 to 8 and 10 to 14 cover this.
• As a processor of personal data contained in the files and documents that a client asks us to review. Our client decides why that data is used, and we process it only on their documented instructions. Section 9 covers this.

We are an ordinary UK limited company. We are not a law firm or a regulated adviser, and our reports are evidence and analysis, not legal advice.

We collect only what we need. The table below sets out the main categories, with examples and where the data comes from.

Our website does not ask you to create an account and does not collect payment card details. Please do not send us special category data (such as health information) or criminal offence data through our website or by email unless we have asked for it as part of an agreed engagement. Our services are for businesses and professionals, and we do not knowingly collect data from anyone under 18.

UK data protection law requires us to have a lawful basis for each use of personal data. The table below sets out our purposes and the basis we rely on.

Where we rely on legitimate interests, we have weighed them against your rights and expectations. We keep that assessment under review, and you can ask us about it. We send direct marketing to business contacts only in line with the Privacy and Electronic Communications Regulations 2003 (PECR) and will always honour an opt-out.

At the date of this policy our website does not use advertising cookies, and we do not run website analytics that track you across sites. The website may use or load the following:

• Strictly necessary technologies, if any, that are needed to make the site work. These do not need consent.
• Google Fonts. Our pages load typefaces from Google’s servers, which means your IP address and browser details are sent to Google when the page loads.
• Our booking page (Cal.com). When you open or use the booking widget, Cal.com may set cookies or use similar technologies as described in its own privacy policy.

We do not sell personal data. We share it only where there is a good reason, and only with:

• Service providers that host our website, run our email and documents, manage bookings, process payments, and provide accounting and IT services. They process data on our behalf under written terms.
• Legal counsel, auditors, insurers and other professional advisers who need it to advise us or protect our legal position, and who are bound by confidentiality.
• Delivery partners, where we use another firm or platform to help deliver an engagement. We tell the client first and put suitable written terms in place.
• Authorities and regulators, courts or other parties where the law requires it or to protect our legal rights.
• A buyer or successor, if our business or its assets are sold or reorganised. They would be bound to use the data only as set out in this policy.

Our main providers include Vercel (website hosting), Cloudflare (domain and network services), Google (email, calendar, documents and fonts) and Cal.com (bookings). We may change providers over time. We can tell you who currently processes your data if you ask.

Some of our providers are based outside the UK, including in the United States, or use sub-processors there. Where personal data is transferred outside the UK we make sure there is a lawful transfer mechanism in place. That means one of the following:

• the destination is covered by UK adequacy regulations (including, for certified organisations, the UK Extension to the EU–US Data Privacy Framework); or
• the transfer is covered by the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where required.

You can ask us for details of the safeguards in place by contacting contact@prova-ai.uk.

We keep personal data only as long as we need it for the purposes above. The periods below are our standard approach. We may keep data for longer where the law requires or where it is needed for a legal claim.

We use technical and organisational measures that are appropriate to the risk. These include encryption of data in transit, access limited to people who need it, strong authentication on our systems, separation of client work, due diligence on our suppliers, and confidentiality obligations for everyone who works with us.

No system is completely secure. If a personal data breach is likely to put people’s rights at risk, we will report it to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it, and we will tell affected individuals or clients without undue delay where the law requires.

Our core service is the automated review of a client’s files against the rules that apply to them. Those files may contain personal data about the client’s own customers, staff and other individuals. For that data:

• Our client is the controller and we are the processor. We use the data only to deliver the agreed review and only on the client’s documented instructions.
• The terms are in writing. Our engagement documents include data processing terms that meet UK GDPR Article 28. They cover the subject matter and duration, the type of data, security, confidentiality, the use of sub-processors, assistance with individuals’ rights and with breaches, and the return or deletion of data when the engagement ends.
• Automation and people. Software checks the files against the agreed rules, and anything unusual or uncertain is escalated to an authorised person for a decision. We do not make decisions about individuals that are based solely on automated processing and that have legal or similarly significant effects on them.
• No other use. We do not use client files for our own marketing and we do not sell them.

If your personal data appears in a file we have reviewed for a client and you want to exercise your rights, please contact that client first. If you contact us, we will pass your request to the relevant client without delay.

Under UK data protection law you have the following rights over personal data we hold as a controller:

• Access to a copy of your personal data and information about how we use it.
• Rectification of data that is inaccurate or incomplete.
• Erasure of your data in certain circumstances.
• Restriction of how we use your data in certain circumstances.
• Portability of data you gave us, in a structured, commonly used format, where we process it by automated means on the basis of consent or contract.
• Objection to our use of your data where we rely on legitimate interests. You have an absolute right to object to direct marketing.
• Withdrawal of consent at any time, where we rely on consent.
• Not to be subject to solely automated decisions that have legal or similarly significant effects on you.

To exercise any right, email contact@prova-ai.uk. We may need to confirm your identity first. We aim to respond within one month, and we do not normally charge a fee. If a request is complex or you have made several, we may extend that period by up to two further months and will tell you why.

If you have a concern about how we handle your personal data, please tell us first at contact@prova-ai.uk and we will try to resolve it quickly. You also have the right to complain to the UK regulator at any time:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint

Our website and emails may link to other websites, such as professional networks and our partners’ sites. We do not control them and are not responsible for their privacy practices. Please read their policies before you give them personal data.

We may update this policy from time to time, for example when we change providers or add a feature. The effective date at the top of this page shows when it was last changed. If we make a material change that affects how we use your data, we will take reasonable steps to tell you, for example by email where we have your address.

For any privacy question or request, contact us at contact@prova-ai.uk, or write to us at Prova AI Governance Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We have not appointed a Data Protection Officer because we are not required to, and privacy queries are handled by our directors.

Our Terms of Service set out the terms that apply to the use of our website and to our services.