GDPR & Privacy Policy

1. Who We Are

Provalio ("we", "us", "our") is the data controller responsible for the personal data we collect and process through the Provalio platform and website. We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy or how we handle your data, please contact us at hello@provalio.co.uk.

2. What Data We Collect

We may collect and process the following categories of personal data:

3. How We Use Your Data

We use your personal data for the following purposes:

• To provide, operate and maintain the Provalio platform and services
• To authenticate your identity and manage your account
• To generate diagnostic reports, valuations and advisory outputs based on data you provide
• To respond to your enquiries and consultation requests
• To send service-related communications (e.g. invitation emails, account notifications)
• To monitor platform usage, detect fraud, and maintain security
• To comply with our legal and regulatory obligations
• To improve our platform and services (using aggregated, anonymised data where possible)

4. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Contract performance — processing necessary to provide the services you have requested or are contracted to receive
• Legitimate interests — to operate and improve our platform, detect fraud and maintain security
• Consent — where you have explicitly consented, such as when submitting a consultation request or accepting our terms at first login
• Legal obligation — where processing is required to comply with applicable laws

5. Data Sharing & Third Parties

We do not sell your personal data. We may share data with trusted third parties only in the following circumstances:

• Platform infrastructure providers — cloud hosting and database services that process data on our behalf under appropriate data processing agreements
• AI service providers — we use third-party AI APIs to generate reports and analysis. Data submitted to these services is governed by the provider's data processing terms and is not used to train AI models
• Companies House — we query publicly available Companies House data when you enter a registration number
• Legal and regulatory authorities — where required by law or court order

We require all third-party processors to implement appropriate technical and organisational security measures and process data only on our documented instructions.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting or reporting requirements.

• Account and platform data: retained for the duration of your access plus 7 years
• Consultation enquiry data: retained for 2 years from submission
• Audit and activity logs: retained for 2 years

You may request deletion of your data at any time (subject to legal retention obligations) by contacting us at hello@provalio.co.uk.

7. International Transfers

Some of our third-party service providers may be based outside the UK or European Economic Area (EEA). Where we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the Information Commissioner's Office (ICO) or equivalent mechanisms.

8. Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. These include encrypted data storage and transmission, role-based access controls, and regular security reviews.

However, no system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet.

9. Cookies

Our website and platform use cookies and similar technologies to operate, improve and secure our services. We use:

• Strictly necessary cookies — required for authentication and session management
• Functional cookies — to remember your preferences and settings
• Analytics cookies — to understand how the platform is used (aggregated, anonymised)

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may affect platform functionality.

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate or incomplete data
• Right to erasure — to request deletion of your data (subject to legal obligations)
• Right to restrict processing — to request we limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, to withdraw it at any time

To exercise any of these rights, please contact us at hello@provalio.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Changes to This Policy

We may update this Privacy & GDPR Policy from time to time. We will notify registered users of material changes and update the "Last updated" date at the top of this page. Continued use of our Services after changes are posted constitutes acceptance of the revised policy.

12. Contact Us

For any data protection queries, subject access requests, or to exercise your rights, please contact us: