Privacy Policy

1. Introduction and Data Controller Identity

This Privacy Policy governs the collection, processing, and protection of personal data by ainavi.co.uk ("we", "us", or "our"). We are committed to protecting your privacy in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018 (DPA 2018)
• Data (Use and Access) Act 2025 (DUAA)
• Privacy and Electronic Communications Regulations 2003 (PECR)
• EU AI Act 2024/1689 (Regulation EU 2024/1689) – applicable obligations
• ICO Guidance on AI and Data Protection (updated under DUAA 2025)

Data Controller:

Note: If you process personal data as a business, you are likely required to register with the ICO. Please ensure your registration is current at ico.org.uk.

2. Definitions

• Personal Data: Any information relating to an identified or identifiable individual (e.g. name, ID number, location data, online identifiers).
• Special Category Data: Sensitive data including racial/ethnic origin, health data, biometric data, etc., subject to heightened protection under UK GDPR Article 9.
• Processing: Any operation performed on personal data (collection, recording, storage, use, disclosure, deletion).
• Data Controller: The entity determining purposes and means of processing — that is us.
• Data Processor: A third party processing data strictly on our behalf.
• Automated Decision-Making (ADM): Processing that produces decisions based solely on automated means, including profiling.
• AI System: A machine-based system using AI techniques that can generate outputs such as predictions, recommendations, or decisions, as defined in EU AI Act Article 3.

3. Data We Collect

3.1 Data You Provide Directly

We collect information when you:

• Register an account (username, contact details — passwords are stored in hashed form only)
• Complete forms (contact requests, surveys, applications)
• Make purchases (billing address; payment details are processed via secure third-party gateways — we do not store card data)
• Subscribe to newsletters (email preferences, consent records)
• Interact with AI features (prompts, queries, feedback you submit)
• Participate in interactive features (comments, reviews)

3.2 Data Collected Automatically

• Technical Data: IP address, browser type and version, device characteristics, operating system
• Usage Data: Pages visited, time spent, navigation paths, clickstream data, referring URLs
• Cookie Data: As described in Part 3 (Cookie Policy) of this document
• Location Data: Approximate geographic location derived from IP address only — we do not collect precise GPS data
• AI Interaction Logs: Where you use AI-powered features, we may log interactions to ensure safety, quality, and legal compliance

3.3 Data From Third Parties

We may receive data from analytics providers (Google Analytics), advertising networks (Google Ads, Meta Pixel — only with your consent), payment processors (Stripe, PayPal), and social media platforms (only when you choose to connect them). All third-party data sharing is governed by contracts including appropriate data processing agreements.

4. Lawful Bases and Processing Purposes

We process your data under the following UK GDPR Article 6 lawful bases:

Where we rely on legitimate interests, we have conducted a Legitimate Interests Assessment (LIA) and determined that our interests do not override your fundamental rights. You have the right to object to processing on this basis at any time.

Special Category Data: We do not intentionally collect special category data. If you choose to share such data, we will seek explicit consent (UK GDPR Article 9(2)(a)) before processing.

5. AI-Specific Data Processing Disclosures

In compliance with the EU AI Act and ICO AI Guidance, we disclose the following about our use of AI:

5.1 AI Systems We Use

Where we use AI systems that process your data, we will identify these clearly in the relevant section of our Website. Our AI features are classified under the EU AI Act risk framework. We do not currently operate any High-Risk AI Systems as defined in Annex III of the EU AI Act without implementing the full compliance requirements applicable to those systems.

5.2 Automated Decision-Making

Where any automated decision-making (including profiling) produces legal or similarly significant effects on you, we will:

• Inform you clearly that such processing is taking place
• Explain the logic, significance, and likely consequences
• Provide you with the right to request human review of the decision
• Allow you to contest the decision and express your point of view

These rights are provided under UK GDPR Article 22 and as updated by the Data (Use and Access) Act 2025, which modified some exemptions to automated decision-making rules. We will not make decisions solely by automated means that have significant effects on you in areas such as creditworthiness, employment, or access to services without meaningful human oversight.

5.3 AI Training Data

We will not use your personal data to train AI or machine learning models without your explicit, separately obtained consent. If we intend to use any data for AI training purposes, we will inform you and obtain your consent in advance.

5.4 AI-Generated Outputs and Accuracy

AI-generated content or recommendations presented on this Website may contain inaccuracies. We take steps to monitor output quality and correct errors, but we cannot guarantee the accuracy of AI outputs. You should treat AI-generated content as a starting point, not a definitive answer, and independently verify important information.

6. Data Sharing and International Transfers

6.1 Categories of Recipients

• IT Service Providers: Hosting companies, cloud storage providers (under data processing agreements)
• Marketing Platforms: Email service providers (e.g. Mailchimp) — only with your consent for marketing
• Payment Processors: Stripe, PayPal (we do not store card details; these processors are PCI-DSS compliant)
• Analytics Providers: Google Analytics (data shared only where consent is given for performance cookies)
• AI Service Providers: Third-party AI APIs or platforms we use to deliver features — listed in our AI Transparency Notice (Part 4)
• Professional Advisors: Accountants, lawyers (under confidentiality obligations)
• Law Enforcement / Regulators: Where required by law, court order, or regulatory direction

6.2 International Transfers

Where data is transferred outside the UK or EU/EEA, we implement appropriate safeguards including:

• UK Adequacy Regulations — for transfers to countries with an adequacy decision
• Standard Contractual Clauses (SCCs) — for other transfers
• Transfer Risk Assessments (TRAs) — conducted where required by ICO guidance
• Binding Corporate Rules (BCRs) — where applicable for group transfers

You may request a copy of the safeguards we use for international transfers by contacting admin@ainavi.co.uk.

7. Data Retention

At the end of each retention period, personal data is securely deleted or anonymised. We review retention schedules annually.

8. Your Rights Under UK GDPR and DUAA 2025

You have the following rights. To exercise any of them, contact us at admin@ainavi.co.uk. We will respond within 30 calendar days (extendable by up to two further months for complex requests, with notice given):

To exercise your rights, submit a request to admin@ainavi.co.uk with proof of identity and details of your request. There is no charge for most requests. We may decline requests that are manifestly unfounded or excessive.

9. Security Measures

We implement appropriate technical and organisational security measures including:

• Technical: Encryption in transit (TLS 1.3), encryption at rest for sensitive data, firewalls, regular security assessments
• Organisational: Staff training, role-based access controls, data minimisation, need-to-know policies
• Procedural: Incident response plan, regular backups, Data Protection Impact Assessments (DPIAs) for high-risk processing
• AI-Specific: Output monitoring, human oversight mechanisms for AI systems, regular bias audits where applicable

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

10. Children's Data Protection

We do not knowingly collect personal data from children under 13 without verifiable parental or guardian consent. Where our services are directed at or likely to be accessed by children, we apply the ICO's Children's Code (Age Appropriate Design Code) standards. If you believe we have collected data about a child without appropriate consent, please contact us immediately at admin@ainavi.co.uk.

11. Data Protection Impact Assessments (DPIAs)

In line with UK GDPR Article 35 and ICO guidance, we conduct DPIAs before introducing new processing activities likely to result in high risk to individuals — including the deployment of new AI features, large-scale data processing, or systematic profiling. Records of our DPIAs are maintained and made available to the ICO on request.

12. Policy Updates

We will post policy changes on this page with a new "Last Updated" date. For material changes affecting your rights, we will notify users via email where we hold your contact details. Previous versions are archived and available on request.

13. Contact and Complaints

For data protection queries or to exercise your rights:

EU/EEA residents may also contact the relevant data protection authority in their Member State.