Advica AI Solutions Ltd – Privacy Policy

Last Updated: 2 November 2026

1. Introduction & Data Controller Details

Advica AI Solutions Ltd ("we", "us", or "our") is committed to protecting personal data and adhering strictly to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, process, store, and protect personal data collected through our corporate website (https://advicaaisolutions.co.uk), project inquiries, Discovery Sprints, commercial scoping, and vendor/client communications.

(Where Advica AI Solutions Ltd processes personal data on behalf of clients within bespoke software systems, we act strictly as a Data Processor governed by a separate Master Services Agreement and Data Processing Addendum).

2. Personal Data We Collect

We collect only the personal information required to deliver our commercial services and respond to inquiries:

• Contact & Business Identity: Name, corporate email address, business phone number, job title, and employer/company name.
• Commercial & Project Requirements: Information submitted via consultation forms, project scoping notes, operational specifications, and Discovery Sprint briefs.
• Accounting & Billing Information: Corporate bank details, billing addresses, VAT registration numbers, and invoice histories. (Note: Commercial asset finance introductions are conducted directly with independent finance providers; we do not process or store payment card data).
• Technical & Usage Logs: IP addresses, browser types, device identifiers, and server access logs gathered during visits to our website.

3. Lawful Bases for Processing

Under Article 6 of the UK GDPR, we process personal data under the following legal bases:

4. Data Sharing & Sub-Processors

We do not sell, trade, or rent personal data. We disclose personal data only to authorized third parties under strict confidentiality and contractual terms:

• Engineering & Delivery Partners: We coordinate with vetted engineering delivery partners to execute software development. Partner access to technical project data is provisioned strictly on a "need-to-know" basis under signed non-disclosure and data protection agreements.
• Core Cloud Infrastructure: Providers supplying our operational business stack, including Google Workspace for corporate email and secure document collaboration.
• Independent Financing Providers: Where you request introduction to commercial technology leasing partners, company contact details are shared strictly with your explicit consent for underwriting.
• Statutory & Legal Advisers: Certified accountants, legal advisers, and UK regulatory bodies where legally required.

5. International Data Transfers

Where engineering delivery, technical support, or cloud hosting involves accessing or transferring personal data outside the UK or the European Economic Area (EEA)—including to partner engineering pods in third countries—we ensure statutory protections are in place:

• Use of the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs); and
• Contractual obligations ensuring that offshore personnel process data in compliance with standards equivalent to the UK GDPR.

6. Information Security Measures

We protect personal data through technical and operational security controls:

• Multi-Factor Authentication (MFA): Enforced across all internal company accounts, cloud services, and email portals.
• Role-Based Access Control (RBAC): Internal access to client files and project specifications is limited strictly to personnel with a direct commercial or technical requirement.
• Encryption Protocols: All web traffic and digital communications use Transport Layer Security (TLS 1.3). Digital assets and documents at rest are protected by AES-256 standard encryption.
• Endpoint & Boundary Defences: Workstations running on active, supported operating systems protected by automatic patching, endpoint firewalls, and active anti-malware defences.

7. Data Retention Schedule

We retain personal data only for as long as required to fulfil the original purpose of collection or satisfy UK legal requirements:

• Client Invoices & Accounting Records: Retained for six (6) full financial years following the date of the transaction to satisfy HMRC corporate record-keeping requirements.
• Discovery Sprint Documentation: Retained on active systems for ninety (90) days after formal delivery and sign-off, after which files are archived or purged.
• Unconverted Sales Inquiries: Retained for a maximum of twenty-four (24) months from the date of last contact before secure deletion.
• Server Access & Security Logs: Automatically overwritten or purged after thirty (30) days.

8. Automated Decision-Making & AI Profiling

We do not use automated decision-making systems or algorithmic profiling that produce legal or similarly significant effects regarding any individual.

9. Your Statutory Rights Under UK GDPR

You hold the following rights regarding the personal data we process:

• Right of Access: Request a copy of the personal data held about you (Subject Access Request).
• Right to Rectification: Request correction of inaccurate, incomplete, or out-of-date records.
• Right to Erasure: Request the deletion of your personal data where retention is no longer legally justified.
• Right to Restriction: Request temporary restriction of data processing while a dispute or verification is resolved.
• Right to Object: Object to processing based on legitimate interests or direct marketing.
• Right to Data Portability: Request transfer of your data in a structured, commonly used, machine-readable format.

To exercise these rights, email us at office@advicaaisolutions.co.uk. We handle verified requests within one calendar month without fee.

10. How to Complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK supervisory authority: