Privacy Policy

AARVANTA LTD ("AARVANTA", "Company", "we", "our" or "us") is committed to protecting the privacy, confidentiality and security of personal data entrusted to us.

This Privacy Policy explains how personal data is collected, used, stored, disclosed and otherwise processed when individuals access or use the AARVANTA platform, websites, software applications, products and services, including Business OS available through os.aarvanta.co ("Platform").

We recognise our obligations under applicable data protection legislation and have implemented appropriate technical, organisational and administrative measures to safeguard personal data against unauthorised access, unlawful processing, accidental loss, destruction or damage.

This Privacy Policy applies to all individuals who access or interact with the Platform, including visitors, customers, account holders, authorised users, business clients, partners, prospective customers, affiliates and any individual whose personal data is processed through our services.

Where additional privacy notices apply to a specific product, feature or service, those notices supplement this Privacy Policy and prevail only to the extent of any inconsistency.

By accessing or using the Platform, you acknowledge that your personal data will be processed in accordance with this Privacy Policy.

The data controller responsible for processing personal data under this Privacy Policy is:

AARVANTA LTD

Company Number: 17217532

Registered Office:

195–197 Wood Street

London

E17 3NU

United Kingdom

Email:

admin@aarvanta.co

Unless expressly stated otherwise, AARVANTA LTD acts as the Data Controller for personal data collected through the Platform.

Where customers upload or process personal data belonging to their own clients, employees or third parties through Business OS, AARVANTA generally acts as a Data Processor and processes such information only in accordance with the customer's documented instructions and applicable law.

This Privacy Policy applies regardless of whether access occurs through desktop computers, laptops, tablets, mobile devices or any other internet-enabled device.

For the purposes of this Privacy Policy:

Applicable Data Protection Laws means all laws governing the processing of personal data, including but not limited to the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), together with any legislation replacing or amending them.

Business Customer means any organisation, company, partnership, sole trader or other legal entity using the Platform.

Customer Data means all information uploaded, imported, generated or stored within Business OS by or on behalf of customers.

Data Controller has the meaning given under the UK GDPR and EU GDPR.

Data Processor has the meaning given under the UK GDPR and EU GDPR.

Personal Data means any information relating to an identified or identifiable natural person.

Processing includes collection, recording, storage, organisation, structuring, adaptation, retrieval, consultation, disclosure, transmission, restriction, deletion and destruction of personal data.

Platform means Business OS together with all related products, services, APIs, software, websites and applications operated by AARVANTA LTD.

User means any individual accessing or using the Platform.

The Platform is intended solely for individuals who are at least 18 years of age.

By creating an account or using the Platform, you confirm that you are at least 18 years old and possess the legal capacity to enter into binding agreements under applicable law.

The Platform is not directed towards children.

We do not knowingly collect or process personal data relating to anyone under the age of 18.

If we become aware that personal data relating to a child has been collected without lawful authority, we will take reasonable steps to delete such information promptly.

Parents or legal guardians who believe that a child has provided personal data should contact us immediately.

Depending upon your interaction with the Platform, we may collect and process the following categories of information.

Financial Information

Where purchases are made through the Platform, payment processing is provided by Stripe. We do not store complete payment card details on our systems.

All payment card information is collected and processed directly by Stripe in accordance with its own privacy and security standards.

Customer Business Data

Business OS allows customers to upload and process information necessary for operating their businesses.

Such information remains under the control of the customer.

Where AARVANTA processes Customer Business Data, it does so solely for the purpose of providing the contracted services and in accordance with customer instructions.

The Platform uses cookies and similar technologies to distinguish users, improve functionality, maintain security, analyse usage patterns, remember user preferences and enhance the overall user experience.

Cookies are small text files placed on your device when you visit the Platform. Certain cookies are essential for the operation of the Platform and cannot be disabled without affecting core functionality.

Where required by applicable law, non-essential cookies will only be placed on your device after obtaining your consent through our cookie consent mechanism.

You may withdraw or modify your cookie preferences at any time through our Cookie Settings or by adjusting your browser settings.

Disabling certain cookies may affect the availability or functionality of specific features of the Platform.

The categories of cookies we use include, but are not limited to:

These cookies cannot be disabled because they are necessary for providing the services requested by the user.

Analytics information is generally aggregated and used to improve our products and services.

Marketing Cookies

Marketing cookies are only used where you have provided your explicit consent.

AARVANTA does not sell personal information to advertisers.

Whenever you access or use the Platform, certain information is collected automatically for operational, security and analytical purposes.

This information assists us in maintaining platform stability, detecting fraudulent activity, preventing unauthorised access, improving performance and fulfilling our legal obligations.

You are responsible for ensuring that all information you provide is accurate, complete and kept up to date.

Where you upload personal data relating to another individual, you confirm that you have the legal authority to do so and that such processing complies with applicable data protection laws.

Business OS enables customers to upload, create, import, store, organise, process and manage business information.

Ownership of Customer Uploaded Data remains with the respective customer.

AARVANTA does not acquire ownership rights over Customer Uploaded Data by virtue of providing the Platform.

All personnel with authorised access are subject to strict confidentiality obligations.

Business OS includes artificial intelligence features designed to automate business processes and assist customers in carrying out business activities.

When customers choose to use AI-powered functionality, information submitted by the customer may be processed through AI technologies solely for the purpose of delivering the requested functionality.

AI processing is initiated only in response to user actions or customer-configured automations.

AARVANTA does not intentionally use Customer Uploaded Data to train proprietary artificial intelligence models unless the customer has provided explicit prior consent or such processing is otherwise permitted by applicable law and contractual agreement.

Customers remain responsible for reviewing AI-generated outputs before relying upon or distributing them.

Artificial intelligence systems may occasionally generate inaccurate, incomplete or unexpected outputs. Users should exercise independent judgment and verify important information before making business, financial, legal or operational decisions based upon AI-generated content.

We process personal data only where there is a lawful basis to do so and only for legitimate business purposes.

We will not process personal data for purposes incompatible with those described in this Privacy Policy unless required or permitted by applicable law.

Where UK GDPR or EU GDPR applies, AARVANTA processes personal data on one or more of the following lawful bases:

Performance of a Contract

Processing necessary to provide the Platform, manage user accounts, fulfil subscriptions, process payments and deliver contracted services.

Before relying upon legitimate interests, we assess and balance our interests against the rights and freedoms of affected individuals.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

Legal Obligation

Processing necessary to comply with applicable legal and regulatory obligations, including taxation, accounting, anti-fraud measures, court orders, law enforcement requests and other statutory requirements.

Vital Interests

Where necessary, personal data may be processed to protect the vital interests of an individual or another natural person.

AARVANTA does not sell, rent, lease or otherwise trade personal data to third parties for their independent marketing purposes.

Personal data is disclosed only where necessary to operate the Platform, fulfil contractual obligations, comply with legal requirements or protect legitimate business interests.

Every third party receiving personal data is required to process such information in accordance with contractual confidentiality obligations and applicable data protection legislation.

Third parties are not authorised to use personal data for their own commercial purposes unless they act as an independent data controller and have their own lawful basis for processing.

To provide the Platform efficiently and securely, AARVANTA engages carefully selected third-party service providers.

These providers perform services on our behalf and are granted access only to the extent necessary to perform those services.

Current categories of service providers include:

Cloud Infrastructure

Cloud hosting, servers, networking, storage, backups and disaster recovery.

Authentication Services

Secure user authentication, identity verification, session management and access control.

Payment Processing

Subscription billing, payment authorisation, invoicing, refunds and financial transaction management.

Customer Support

Support ticket management, troubleshooting, technical investigations and customer assistance.

Analytics

Platform performance analysis, system monitoring, operational reporting and service improvement.

Artificial Intelligence Services

Where customers choose to use AI-powered features, information necessary to fulfil the requested functionality may be securely processed through authorised AI technologies acting on behalf of AARVANTA.

We seek to ensure that providers handling AI-related processing implement appropriate security measures and contractual safeguards consistent with applicable data protection laws.

Business OS is hosted using enterprise-grade cloud infrastructure designed to provide resilience, scalability and security.

Our hosting environment may include cloud infrastructure operated through Amazon Web Services (AWS) together with supporting deployment infrastructure operated through Vercel.

Infrastructure providers are selected based upon recognised industry security standards and their ability to support secure, reliable and highly available cloud services.

Where data is transferred outside the United Kingdom or European Economic Area, appropriate legal safeguards are implemented as described in this Privacy Policy.

Business OS uses Firebase Authentication to provide secure account authentication and identity management.

Passwords are never stored in plain text.

Authentication credentials are protected using industry-recognised encryption and security practices.

Users are responsible for maintaining the confidentiality of their login credentials.

You must immediately notify AARVANTA if you become aware of any suspected unauthorised access to your account.

Subscription payments and other financial transactions are processed securely through Stripe.

AARVANTA does not store complete payment card numbers, card verification values (CVV), PINs or equivalent payment authentication information on its own systems.

Stripe is responsible for processing payment information in accordance with applicable payment industry standards, including the Payment Card Industry Data Security Standard (PCI DSS).

Payment information is processed solely for the purpose of providing subscribed services, fulfilling contractual obligations, preventing fraud and complying with financial reporting requirements.

As a global technology platform, certain personal data may be processed outside the United Kingdom or European Economic Area.

Where international transfers occur, AARVANTA implements appropriate safeguards designed to ensure that transferred personal data receives an equivalent level of protection required under applicable data protection legislation.

International transfers are limited to what is necessary for providing the Platform, maintaining infrastructure, processing payments, authenticating users, delivering customer support and operating requested services.

Protecting personal data is fundamental to the operation of Business OS.

No method of electronic transmission or storage can be guaranteed to be completely secure. While AARVANTA employs reasonable and appropriate safeguards, absolute security cannot be guaranteed.

Users are responsible for protecting their own account credentials and devices used to access the Platform.

AARVANTA maintains procedures for identifying, investigating, managing and responding to actual or suspected security incidents.

We continually review and improve our security practices to reduce the likelihood and impact of future incidents.

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, contractual, regulatory, accounting and operational requirements.

When personal data is no longer required, it will be securely deleted, anonymised or irreversibly destroyed using methods appropriate to the nature of the information.

Customer-uploaded data is retained in accordance with the customer's subscription, account settings, contractual arrangements and applicable legal obligations.

Subject to applicable law, you may exercise the rights described in this section in relation to your personal data.

These rights are not absolute and may be subject to legal exemptions, restrictions or conditions under applicable legislation.

Where AARVANTA acts solely as a Data Processor on behalf of a customer, requests relating to Customer Uploaded Data should ordinarily be directed to the relevant customer acting as the Data Controller. Where appropriate, AARVANTA will assist its customers in responding to such requests in accordance with applicable law and contractual obligations.

You have the right to request confirmation as to whether AARVANTA processes your personal data.

Requests that are manifestly unfounded, excessive or repetitive may be refused or may be subject to a reasonable administrative fee where permitted by applicable law.

You have the right to request that inaccurate or incomplete personal data be corrected without undue delay.

You are responsible for ensuring that information maintained within your account remains accurate and current.

Certain account information may be updated directly through your account settings. Where information cannot be amended through the Platform, you may submit a request using the contact details provided in this Privacy Policy.

Deletion of your account may result in the permanent removal of associated data, subject to any applicable retention obligations.

Where processing has been restricted, personal data may continue to be stored but will generally not be processed except where authorised by law or with your consent.

Where processing is based upon consent or contractual necessity and carried out by automated means, you may request a copy of your personal data in a structured, commonly used and machine-readable format.

Where technically feasible, and where permitted by law, you may also request that such information be transmitted directly to another data controller.

You have the right to object to processing based upon legitimate interests where your particular circumstances justify such an objection.

Where processing is carried out for direct marketing purposes, you may object at any time.

Upon receipt of a valid objection relating to direct marketing, processing for that purpose will cease without undue delay.

Business OS incorporates artificial intelligence and automated technologies designed to assist users in carrying out business processes.

These technologies support customer-directed activities such as workflow automation, content generation, document analysis, customer communications and operational efficiencies.

Unless expressly stated otherwise, AARVANTA does not make decisions producing legal effects or similarly significant consequences concerning individuals solely by automated means without appropriate human involvement where required by applicable law.

Where automated processing is used, appropriate safeguards are implemented in accordance with applicable legislation.

Users remain responsible for reviewing and validating AI-generated outputs before relying upon them for business, legal, financial or operational decisions.

Marketing communications will only be sent where an appropriate lawful basis exists.

Withdrawal of marketing consent does not affect service-related communications necessary for account administration, security, billing or contractual performance.

The Platform may contain links to websites, applications or services operated by third parties.

AARVANTA does not control and is not responsible for the privacy practices, security measures or content of third-party services.

Access to third-party websites is undertaken at your own discretion and is governed by the privacy policies and terms applicable to those services.

Users are encouraged to review the privacy documentation of any third-party service before providing personal information.

In the event of a proposed or completed merger, acquisition, investment, restructuring, financing, sale of assets or other corporate transaction, personal data may be disclosed or transferred where reasonably necessary for evaluating, negotiating or completing such transaction.

Any successor organisation receiving personal data will remain subject to obligations consistent with this Privacy Policy and applicable law unless affected individuals are otherwise notified.

Any such disclosure will be limited to the extent reasonably necessary and permitted by applicable law.

Where material changes are made, appropriate notice will be provided through the Platform, by email or through other reasonable means where required by law.

The "Last Updated" date appearing at the beginning of this Privacy Policy indicates the date on which the most recent revisions became effective.

Continued use of the Platform following the effective date of any revised Privacy Policy constitutes acceptance of the updated policy to the extent permitted by applicable law.

Questions, requests or concerns relating to this Privacy Policy or the processing of personal data may be directed to:

AARVANTA LTD

Company Number: 17217532

Registered Office:

195–197 Wood Street

London

E17 3NU

United Kingdom

Email: admin@aarvanta.co

Where submitting a data protection request, sufficient information should be provided to enable AARVANTA to verify your identity and locate the relevant information.

We may request additional information where reasonably necessary to verify the identity of the individual making the request before responding.

If you believe that your personal data has been processed in breach of applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.

If you are located in the United Kingdom, the competent supervisory authority is the Information Commissioner's Office (ICO).

You may also have the right to lodge a complaint with the supervisory authority in the Member State of the European Union where you reside, work or where the alleged infringement occurred, where applicable.

Nothing in this Privacy Policy affects any statutory rights or remedies available under applicable law.

This Privacy Policy shall be governed by and construed in accordance with the laws of England and Wales.

Any dispute arising from or relating to this Privacy Policy, the processing of personal data or the use of the Platform shall be subject to the exclusive jurisdiction of the courts of England and Wales, unless mandatory provisions of applicable law provide otherwise.

This Privacy Policy constitutes the complete privacy notice governing the collection, use, disclosure, storage and protection of personal data processed by AARVANTA LTD in connection with Business OS and the website located at os.aarvanta.co.

Where additional product-specific privacy notices are published, those notices supplement this Privacy Policy only to the extent applicable to the relevant product or service.

If any provision of this Privacy Policy is determined by a court or competent authority to be invalid, unlawful or unenforceable, the remaining provisions shall continue in full force and effect.