Everything you need to know about how Datavacy collects, uses, and protects your personal data — and how we honour your rights under UK GDPR.
This Privacy Policy explains how Datavacy Ltd collects, uses, shares, and protects your personal data when you access our website, platform, and related services. Last updated: September 2026.
| Company | Datavacy Ltd |
|---|---|
| Company Number | 17152498 |
| Registered Office | 6 Knights Road, Oxford, OX4 6DF |
| ICO Registration | ZC137164 (expires 29 April 2027) |
| UK Trade Mark | UK00004373201, Class 42 |
| leon.morgan@datavacy.co.uk |
Datavacy Ltd acts as data controller for personal data processed under this Policy. Where customers store their own data in the platform, we act as data processor governed by our Data Processing Agreement.
Full name, email address, telephone number, business name and details, account credentials, billing address, and support communications.
IP address, device identifiers, browser type and version, pages visited, usage and activity data, log files, and session data.
Payments are processed entirely by Stripe. We receive only transaction confirmations and billing details — no card numbers, CVVs, or payment credentials are stored by us.
The personal data your organisation enters into Datavacy (data register entries, consent records, SAR logs, breach logs) is processed by us as data processor on your behalf.
| Purpose | Lawful Basis | Article |
|---|---|---|
| Provide and manage the Service | Contract | 6(1)(b) |
| Process payments and invoicing | Contract | 6(1)(b) |
| Provide optional AI Compliance Assistant features (Pro plan) | Contract | 6(1)(b) |
| Improve and develop the Service | Legitimate Interests | 6(1)(f) |
| Ensure security and prevent fraud | Legitimate Interests | 6(1)(f) |
| Send service and account emails | Contract / Legitimate Interests | 6(1)(b)/(f) |
| Send marketing communications | Consent / Soft opt-in (PECR) | 6(1)(a) |
| Comply with legal obligations | Legal Obligation | 6(1)(c) |
| Category | Retention Period | Reason |
|---|---|---|
| Account and profile data | Contract duration + up to 6 years | Legitimate interests / legal claims |
| Financial and billing records | 6–7 years after transaction | HMRC legal requirement |
| Usage and analytics data | Up to 24 months | Service improvement |
| Support communications | Up to 3 years | Dispute resolution |
| Compliance data (as processor) | As directed by you (Controller) | Article 28 DPA obligation |
| AI Assistant findings and chat history | While your account is active; deleted on termination | Audit trail for your review decisions |
Pro plan customers can use the optional AI Compliance Assistant. It reviews the compliance records your organisation has entered (Data Register, Consents, SAR log and Breach Log), highlights possible gaps, and answers questions about your records. When you use it:
Findings and chat history are stored in your account (see Data Retention above) and are visible only to users in your organisation.
Request a copy of all personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Request deletion of your data where no legal basis remains.
Ask us to restrict processing while a dispute is resolved.
Receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests.
To exercise any of these rights, contact us at leon.morgan@datavacy.co.uk. We will respond within 30 calendar days. You also have the right to complain to the ICO at ico.org.uk or 0303 123 1113.
We use a small number of trusted sub-processors to deliver the Service. All are covered by appropriate safeguards for international data transfers under UK GDPR.
We use cookies to keep the Service working correctly. We do not use advertising, tracking or analytics cookies, and we do not share cookie data with third parties for marketing purposes.
| Cookie Type | Purpose | Consent Required? |
|---|---|---|
| Strictly Necessary | Login sessions, security tokens, CSRF protection | No — legally exempt |
| Functional | Remember your preferences and settings | Yes |
| Marketing | Not used — we run no ad tracking | N/A |
| Name | Type | Purpose | Duration |
|---|---|---|---|
| __clerk_db_jwt | Necessary | Secure authentication session | Session |
| session_id | Necessary | Platform session management | Session |
| dv_cookie_seen | Functional | Cookie banner preference | Persistent |
You can manage or block cookies through your browser settings. Blocking strictly necessary cookies will affect core functionality. To contact us about cookies: hello@datavacy.co.uk
This DPA forms part of the Terms of Service between Datavacy Ltd (Processor) and the customer entity using the Service (Controller). By using Datavacy, you agree to the terms of this DPA.
The Controller (you, the customer) determines the purposes and means of processing personal data entered into the platform. Datavacy Ltd acts as the Processor, processing that data solely on the Controller's documented instructions.
Where personal data is transferred to sub-processors outside the UK, we rely on UK International Data Transfer Agreements (IDTAs) or adequacy decisions as the lawful transfer mechanism.
By using Datavacy, you agree to these terms. If you are using Datavacy on behalf of an organisation, you confirm you have authority to bind that organisation to these terms.
Datavacy is a SaaS compliance tool provided by Datavacy Ltd (Company No. 17152498), registered in England and Wales at 6 Knights Road, Oxford, OX4 6DF.
New customers receive their first month free. No credit card is required to start. We will never automatically charge without your explicit consent at the end of the trial.
The Datavacy platform, brand, and all related materials are owned by Datavacy Ltd. UK Trade Mark UK00004373201 is registered in Class 42. You may not use our name, logo, or trade marks without written permission.
To the fullest extent permitted by law, Datavacy Ltd's total liability to you shall not exceed the fees paid by you in the 12 months preceding the claim. We are not liable for indirect or consequential losses.
These terms are governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.
Email: leon.morgan@datavacy.co.uk · Post: Datavacy Ltd, 6 Knights Road, Oxford, OX4 6DF
If you have any questions about how we handle your data or want to exercise your rights, we're here to help.