Privacy Notice

1. Who we are

PRIVINOTCH Ltd ("PRIVINOTCH", "we", "us", "our") is a privacy, AI governance and strategic advisory consultancy, with separately registered entities in London, UK and Dubai, UAE. Each entity is the data controller for personal data it collects in the course of its own dealings with you, except where we're processing data on behalf of a client, as explained in Section 4.

UK entity: PRIVINOTCH Ltd, company number 15744839. Registered office: 128 City Road, London, United Kingdom, EC1V 2NX. ICO registration reference: ZB905003.

UAE entity: registered in the IFZA free zone, Dubai. IFZA licence number: 79085.

2. The personal data we collect

Most of the personal data we hold is given to us directly by you, or generated in the course of providing our services to you. The one exception is business contact information we use for our own B2B outreach, which we obtain from public sources or a reputable business data provider, as set out below. Depending on how you interact with us, this may include:

• Enquiries and forms. When you use our Contact form, our Circle request form, or otherwise get in touch, we collect what you enter: typically your name, email address, company or organisation, role, and the content of your message.
• Booking an intro call. Our "Book an intro call" link takes you to a third-party scheduling page, which collects what you enter there (such as your name, email address and chosen time) on our behalf.
• Client engagements. When we're engaged to work with you or your organisation, we process the personal data needed to deliver that engagement, typically the name, company name and email address of the people we work with on your side, and any further information reasonably needed to carry out the project.
• Direct correspondence. Anything you share with us by email, phone or in meetings.
• Business contact information for B2B outreach. Professional contact details (such as name, business email address, company name, job title and professional phone number) that are publicly available, for example from a company website or a professional networking platform, or sourced from a reputable business data provider who lawfully supplies contact details for business-to-business use. You can ask us to stop using your details for this purpose at any time by emailing info@privinotch.co.uk.

We do not collect special category data (such as health, religious or political information) unless it's explicitly required and lawfully justified for a specific engagement. We don't use cookies, analytics or advertising tracking on this website (see Section 5).

3. How your data reaches us

Our website forms submit securely to us directly. Beyond the website, we collect data through the normal course of an engagement: correspondence, meetings, and the documents and systems involved in delivering our services to you. The business contact details we use for our own outreach reach us from public sources or a business data provider, rather than from you directly.

4. Why we use your data

We use the information you give us to respond to your enquiry, prepare for a call or meeting you've booked, consider a request to join the Circle, deliver and manage our client engagements, contact you about our services or thought leadership where relevant to your organisation, and keep reasonable records of our correspondence.

Our legal basis under UK GDPR depends on the activity:

• Performance of a Contract: for client engagements and scoping conversations, including taking steps at your request before entering into a contract.
• Legitimate Interest: for responding to enquiries, running our business, and professional B2B outreach, balanced against your rights.
• Consent: where we ask you to opt in, for example to receive updates as a Circle member. You can withdraw this consent at any time.

In some cases, we process personal data on behalf of our clients, for example during risk assessments, audits or governance projects. In these situations we act as a data processor, not a controller, and only process that data under the client's instructions, in line with our contract with them and applicable data protection law. We do not use personal data for automated decision-making or profiling.

5. Cookies & tracking

We do not currently use cookies, analytics, advertising pixels or any other tracking technology on this website. The one external request our pages make is to Google Fonts, which loads our typefaces; this can disclose your IP address to Google as part of that request, but it does not set cookies or track you across other sites.

If we introduce analytics or tracking in future, we'll update this notice and ask for your consent first, where the law requires it.

6. Who we share your data with

Your data is stored securely using cloud-based systems that meet UK and EU data protection standards. We don't sell your personal data, and we don't share it with third parties for their own marketing. Depending on the circumstances, we may share it with categories of organisations such as:

• Cloud infrastructure and productivity providers we rely on to run our business, including email and document storage.
• Scheduling tools, if you book a call through our website.
• Sales and business development platforms we use to source and manage professional B2B outreach.
• Our professional advisers, such as accountants or legal counsel, where necessary.
• A regulator or other authority, where we're required to by law.

Where we're processing personal data on behalf of a client (see Section 4), we only share it as instructed by that client and in line with our obligations as a processor.

Where we share personal data with a provider outside the UK, EU or EEA, we ensure the appropriate transfer mechanisms are in place.

7. International transfers

Where we share personal data with a provider outside the UK, EU or EEA, we ensure the appropriate transfer mechanisms are in place, so your data stays protected to UK standards wherever it's processed.

8. How long we keep your data

We only retain personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal, regulatory and contractual requirements. Retention periods vary depending on the nature of the data and the purpose of processing, and are governed by our internal data retention schedules. You're welcome to request details of our retention schedules at any time by emailing info@privinotch.co.uk.

9. Your rights

Under UK GDPR, you have the right to:

• Ask what personal data we hold about you, and get a copy of it (access).
• Ask us to correct inaccurate or incomplete data (rectification).
• Ask us to delete your data, in certain circumstances (erasure).
• Ask us to restrict how we use your data (restriction).
• Object to us using your data for certain purposes (objection).
• Ask us to move your data to another organisation, where technically possible (portability).
• Withdraw consent at any time, where we're relying on it.

To exercise any of these rights, email us at info@privinotch.co.uk. If you're contacting us as a UK data subject, you also have the right to complain to the UK Information Commissioner's Office (ico.org.uk). Our Dubai entity is registered in the IFZA free zone, which sits under the UAE's federal data protection law (Federal Decree-Law No. 45 of 2021) rather than a free-zone-specific regime such as DIFC or ADGM. If you're contacting us as a UAE data subject, equivalent rights apply under that federal law, with oversight currently sitting with the UAE's Federal Authority for Artificial Intelligence and Data.

10. Changes to this notice

We review this notice as our services and website change. This version was last updated in September 2026. If we make significant changes, we'll update the date at the top of this page.

11. Contact us

If you have any questions about this notice, how we handle your data, or would like to exercise any of the rights described above, contact us at info@privinotch.co.uk. Our offices are in London, UK and Dubai, UAE.