Effective date: 28th February 2025

1. Data we collect

We collect the minimum personal information necessary to provide our services in accordance with the UK GDPR.

Uploaded files are processed solely to complete the requested gap analysis. We do not store payment card data; PayPal processes payments on our behalf.

• Personal information: your name, email address, company information and any details you provide during communication.
• Uploaded files: documents and evidence supplied for analysis, which you can delete at any time through the Customer Portal.
• Payment information: retained only as required by law; card details are handled by PayPal.
• Usage data: IP address, browser type, access times and similar information to protect and improve our services.

2. How we use your data

Your data is used to deliver the gap analysis, support your account and meet legal obligations.

We may contact you regarding your order or respond to enquiries you submit.

• Service provision: To perform the gap analysis and deliver the results to you.
• Customer support: To help with questions or issues related to your order.
• Legal compliance: To comply with applicable laws and maintain required records.
• Communication: To keep you updated about your order and respond to enquiries.

3. Retention of data

Files from completed orders can be deleted by you at any time and are automatically deleted 365 days after completion if you do not remove them sooner.

Files from abandoned or incomplete orders are deleted within 24 hours.

Personal information is retained only for the minimum period required by law for legal and record-keeping purposes.

We do not retain any payment information other than the minimum amount required by law.

4. Data sharing and disclosure

We work with trusted processors who assist with analysis, storage and payment. They are contractually bound to protect your data and use it only as instructed.

Where possible we align processing locations with the country of the client's order, but this is not always feasible due to technological limitations.

We may disclose data if required by law or public authorities.

• OpenAI – generative AI services (United States). Privacy Policy: https://openai.com/en-GB/policies/eu-privacy-policy/
• Hoss Technology Inc. (trading as DocuPandas) – optical character recognition (United States). Privacy Policy: https://www.docupanda.io/legal/privacy-policy
• Google Cloud Services – servers, SQL databases and vector databases located in the United Kingdom and the Netherlands. Privacy Notice: https://cloud.google.com/terms/cloud-privacy-notice
• PayPal – payment processing. Privacy Policy: https://www.paypal.com/uk/legalhub/paypal/privacy-full

5. International data transfers

Your data may be transferred outside of the UK or EEA, including to the United States. We use approved safeguards such as standard contractual clauses to protect your information.

6. Data security

We implement layered security measures to safeguard your personal data.

• Encryption: Data is encrypted both in transit and at rest.
• Access controls: Access to personal data is restricted to authorised personnel only.
• Multi-factor authentication: MFA is enabled wherever available to secure system access.
• Network security: Firewalls and intrusion detection systems protect our infrastructure.
• Secure software development: We follow secure development best practices.
• Incident response: We maintain a plan to respond promptly to data security incidents.

7. Your rights

Under applicable law you may request access, rectification, deletion, restriction, portability or object to processing of your personal data.

To exercise these rights, contact our data protection officer at dataprotectionofficer@standard-v.com. We will respond within the time frames required by law.

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccuracies in your personal data.
• Erasure: Request deletion of your personal data, subject to legal obligations.
• Restriction: Ask us to limit how we process your personal data in certain circumstances.
• Portability: Receive your personal data in a structured, commonly used and machine-readable format.
• Objection: Object to certain types of processing of your personal data.

8. Cookies and tracking technologies

We may use cookies to enhance your experience. Refer to our Cookie Policy for details.

9. Changes to this policy

We will update this Privacy Policy when necessary and post the revised version with an updated effective date. Continuing to use our services signifies acceptance of the changes.

10. Contact us

Email privacy@standard-v.com or write to Standard V Ltd, Green Park Arlington, 5 Exeter Park Road, Bournemouth, BH2 5BD.

Company registration number: 16273802.

By using our services you acknowledge that you have read and understood this Privacy Policy and agree to be bound by it.