Privacy Notice

1. Who we are

Caventis Ltd ("Caventis", "we", "us", "our") is a UK-based procurement and cost reduction consultancy and is the data controller for personal data processed through this website.

• Registered address: [PLACEHOLDER — add registered office address]
• Company number: [PLACEHOLDER — add Companies House number]
• ICO registration number: [PLACEHOLDER — add ICO reference if registered]
• Email: hello@caventis.co
• Phone: +44 20 3488 1532
• Data Protection Officer / privacy contact: [PLACEHOLDER — appoint or state "not required under Article 37 UK GDPR"]

2. What we collect and why

The website processes three categories of personal data.

a. Enquiry data (contact form)

When you submit the contact form we collect your name, company, email address, phone number, message and the page you submitted from. We use this solely to respond to your enquiry and to keep a record of the exchange.

• Lawful basis: Article 6(1)(b) UK GDPR (steps to enter into a contract at your request) and, where you are not yet a prospective client, Article 6(1)(f) (our legitimate interest in responding to unsolicited enquiries).

b. Technical & security data

On form submission we store a salted hash of your IP address and your browser user agent. We do not retain the raw IP address. This is used only to detect abuse and diagnose delivery failures.

• Lawful basis: Article 6(1)(f) UK GDPR (legitimate interest in the security and integrity of our systems).

c. Analytics and marketing (consent only)

If you accept the relevant categories in our cookie banner, we load Google Analytics 4 (Analytics category) and HubSpot and Apollo.io (Marketing category). These services set cookies and collect identifiers, page views, referrers, device and browser data, and — in the case of HubSpot and Apollo — attempt to identify the organisation you are visiting from. Full list in our Cookies Policy.

• Lawful basis: Article 6(1)(a) UK GDPR (consent) and Regulation 6 PECR.

3. Third-party recipients (processors and joint controllers)

The following third parties receive personal data on our behalf:

We do not sell personal data. We do not use it for automated decision-making with legal or similarly significant effects.

4. International transfers

Where data is transferred outside the UK/EEA (Resend, Google, HubSpot, Apollo) the transfer is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

5. Retention

• Enquiries: [PLACEHOLDER — confirm retention period, e.g. up to 24 months from last contact].
• Consent records: [PLACEHOLDER — confirm retention period, typically 12–24 months to demonstrate compliance].
• Analytics data: retained according to the provider's default configuration [PLACEHOLDER — confirm chosen GA4 retention setting].
• Contractual and accounting records: retained for the period required by UK tax and company law (typically 6 years).

6. Your rights under UK GDPR

You have the right to:

• be informed about how your data is used (this notice);
• request access to the personal data we hold about you;
• request rectification of inaccurate data;
• request erasure ("right to be forgotten");
• request restriction of processing;
• object to processing based on legitimate interests;
• request portability of data you have provided to us;
• withdraw consent at any time (using the cookie preferences panel or by emailing us).

To exercise any of these rights, email hello@caventis.co. We will respond within one month.

7. Complaints to the ICO

If you are unhappy with how we have handled your personal data you have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

We would appreciate the chance to address your concerns first.

8. Changes to this notice

We may update this notice from time to time. Material changes will be reflected by updating the "last updated" date at the top.