PRIVATIO Privacy Notice
Draft v0.1 – subject to legal review.
Controller: [OPERATOR LEGAL NAME], [ADDRESS], [CONTACT EMAIL]. [COUNSEL: data protection representative/DPO if required.]
What we process and why
| Data | Purpose | Legal basis [COUNSEL] |
|---|---|---|
| Account data (name, email, password hash, language) | providing the account | contract |
| Application data (country, interests, budget band, organisation, authority) | assessing applications | contract / legitimate interests |
| Identity, sanctions and PEP checks; supporting documents | legal obligations and risk management | legal obligation / legitimate interests |
| Listing, case and document access logs | security, accountability, dispute resolution | legitimate interests |
| Contacts submitted by introducers | evaluating the proposed introduction | as documented by the introducer (consent or legitimate interests) |
| Marketing emails | only with separate, optional consent | consent |
Recipients
Processors for hosting, storage, email and (where used) identity verification, listed in our processor register [LIST]; counterparties in a case only to the extent you approve or the case requires.
International transfers
We prefer EU data residency. Where data leaves the EEA/UK we use appropriate safeguards [COUNSEL].
Retention
See retention schedule [OPERATIONS.md]; financial records are kept for statutory periods.
Your rights
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, complaint to a supervisory authority.
Security
Encryption in transit and at rest, role-based access with audit logging. Administrators can technically access stored data under strict controls; we do not claim end-to-end encryption.