This policy explains how Augustova Limited collects, uses, shares and protects personal data, and the rights available to you under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Augustova Limited is a company registered in England and Wales under company number 17216706. Our registered office is Office 1856, 60 Tottenham Court Road, London W1T 2EW. We are registered with the Information Commissioner’s Office under registration reference ZC152144.
For the purposes of this policy, Augustova Limited is the data controller. We are not required to appoint a statutory Data Protection Officer and have not done so. Data protection enquiries are handled by our management team and should be sent to info@augustova.co.uk.
2. What this policy covers
This policy applies to personal data we handle as a controller. That includes visitors to this website, people who contact us, prospective and existing clients, partners, suppliers, and people who approach us about working with us.
It does not cover personal data we process on behalf of our clients when delivering services. In those circumstances the client is the controller and we act as their processor under a separate written agreement, as described in section 13. Our products, Gorizzume and Onrolo, operate under their own privacy policies published on their own websites.
3. Personal data we collect
- Enquiry and contact details. When you submit our contact form or email us: your name, email address, the organisation you represent, the nature of your enquiry, any budget and timescale you indicate, and anything else you choose to include in your message.
- Correspondence. Records of communications between us, including emails, messages, and notes of meetings and calls.
- Client and supplier relationship data. Business contact details for the individuals we deal with at client, prospect, partner and supplier organisations, together with contractual and billing records.
- Technical and usage data. Standard server and security logs generated when any website is accessed, including IP address, browser and device type, referring page and pages viewed. Section 6 explains how our analytics work.
- Recruitment data. If you approach us about working with us, the information contained in your application and any accompanying documents.
We do not knowingly collect special category data, criminal offence data, or personal data relating to children through this website. Please do not send us such information unless we have specifically asked for it.
4. Where we obtain personal data
Most of the personal data we hold is provided directly by you. We may also obtain business contact details from public sources such as company websites, professional networks, published registers and industry directories, where we have a legitimate interest in contacting an organisation about services relevant to its business.
5. Why we use personal data, and our lawful basis
- To respond to your enquiry and discuss a possible engagement, partnership or investment. Lawful basis: taking steps at your request prior to entering a contract, and our legitimate interest in responding to people who contact us.
- To provide services and manage our contracts. Lawful basis: performance of a contract, and our legitimate interest in administering our business relationships.
- To send occasional updates about our work to business contacts who have engaged with us. Lawful basis: our legitimate interest in marketing our services to relevant organisations. You can opt out at any time and every message contains a means of doing so.
- To keep our website and systems secure and prevent abuse. Lawful basis: our legitimate interest in operating a safe and reliable service.
- To understand how our website is used in aggregate. Lawful basis: our legitimate interest in improving our website. See section 6.
- To comply with our legal and regulatory obligations, including accounting, tax and record keeping duties. Lawful basis: compliance with a legal obligation.
- To establish, exercise or defend legal claims. Lawful basis: our legitimate interest in protecting our position, and compliance with legal obligations.
Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests, rights and freedoms, and concluded that they are not. You may object to processing carried out on this basis at any time, as described in section 11.
6. Cookies and analytics
We do not use advertising cookies, tracking cookies, or cross-site tracking of any kind on this website. We do not sell or share personal data for advertising purposes.
We use Vercel Web Analytics to understand aggregate website usage, such as which pages are viewed and which sites refer visitors to us. This service is designed to operate without cookies and without storing identifiers on your device. It does not build a profile of you and does not follow you across other websites. Because it does not store or access information on your device for that purpose, it does not require consent under the Privacy and Electronic Communications Regulations.
Our hosting provider may set strictly necessary cookies required to deliver and secure the website, which are exempt from the consent requirement. If we introduce any non-essential cookies in future we will implement a consent mechanism before doing so and update this policy.
7. Who we share personal data with
We do not sell personal data. We share it only where necessary, and only with the following categories of recipient.
- Service providers acting as our processors, including our website hosting and analytics provider and our transactional email provider. Each is bound by a written contract requiring appropriate security and restricting use of the data to our instructions.
- Professional advisers, such as accountants, insurers and lawyers, where reasonably necessary.
- Regulators, law enforcement and public authorities, where we are required to disclose information by law.
- A purchaser or successor, in the event of a sale, merger or reorganisation of our business, subject to appropriate protections.
8. International transfers
Some of our service providers process data outside the United Kingdom. Where personal data is transferred outside the UK we ensure an appropriate safeguard is in place. That will normally be UK adequacy regulations covering the destination country, or the International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, supported by a transfer risk assessment where required. You may request further information about the safeguards applied by contacting us.
9. How long we keep personal data
- Enquiries that do not lead to an engagement: up to 24 months from our last meaningful contact, after which they are deleted.
- Client and supplier records: for the duration of the relationship and for six years after the end of the financial year in which it ended, to meet contractual, accounting and limitation period requirements.
- Accounting and tax records: six years, as required by law.
- Marketing preferences and opt-out records: retained for as long as necessary to ensure we continue to honour your preference.
- Unsuccessful approaches about working with us: up to 12 months, unless you ask us to delete them sooner.
- Server and security logs: short retention periods set by our hosting provider, typically not exceeding 30 days.
Where data is no longer needed it is deleted or irreversibly anonymised. Anonymised aggregate statistics may be retained indefinitely, as they no longer identify anyone.
10. How we protect personal data
We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls limiting access to those who need it, multi-factor authentication on our administrative systems, logging of administrative actions, supplier due diligence, and periodic review of our security arrangements. No system can be guaranteed completely secure. We will notify affected individuals and the Information Commissioner’s Office where we are legally required to do so following a personal data breach.
11. Your rights
Under UK data protection law you have the right to:
- be informed about how your personal data is used, which is the purpose of this policy;
- request access to a copy of the personal data we hold about you;
- request that inaccurate or incomplete data is corrected;
- request erasure of your data in certain circumstances;
- request that we restrict processing in certain circumstances;
- object to processing based on our legitimate interests, and to object at any time to processing for direct marketing, which we will always honour;
- receive certain data in a portable format, where processing is based on consent or contract and carried out by automated means;
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email info@augustova.co.uk. We will respond within one month. If your request is complex, or if you make several requests, we may extend this by up to two further months and will tell you if we do. There is no fee unless a request is manifestly unfounded or excessive. We may ask you for information to verify your identity.
12. Automated decision-making
We do not make decisions producing legal or similarly significant effects concerning you based solely on automated processing, and we do not carry out profiling of website visitors.
13. When we act as a processor
When we build or operate software for a client we generally process personal data on that client’s instructions as their processor. In those circumstances the client is the controller and its own privacy notice applies to the individuals concerned. We enter into a written data processing agreement with each client covering the subject matter, duration, nature and purpose of processing, the categories of personal data and data subjects, security measures, use of sub-processors, assistance with data subject rights, breach notification, and the return or deletion of data at the end of the engagement. A copy of our standard data processing agreement is available on request.
14. Changes to this policy
We may update this policy to reflect changes in our practices or in the law. The date at the top of this page shows when it was last revised. Where a change is significant we will take reasonable steps to bring it to the attention of those affected.
15. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at info@augustova.co.ukso we have the opportunity to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.
16. Contact
Augustova Limited, company number 17216706, registered in England and Wales. ICO registration ZC152144. Registered office and address for correspondence: Office 1856, 60 Tottenham Court Road, London W1T 2EW, United Kingdom. Email info@augustova.co.uk.