About this policy
This privacy policy explains how NEVA TECH LTD, trading as Nevatech (“Nevatech”, “we”, “us”, “our”), collects, uses, shares and protects personal data, and what rights you have.
It applies to personal data about:
- visitors to our website, nevatech.co.uk (the “Website”);
- people who contact us or make an enquiry;
- prospective clients and their staff, including people we contact about our services;
- the staff and representatives of our clients, suppliers and business partners.
What this policy does not cover
- When we deliver services to a client (for example a compliance audit, penetration test or software build), we may handle personal data contained in that client’s systems or records. In that situation, we act on our client’s behalf as a processor, and our client is responsible for that data. That processing is governed by our contract with the client, not by this policy. If you are a customer or employee of one of our clients, please refer to that client’s privacy notice.
- This policy does not apply to third-party websites linked from the Website.
We have written this policy to comply with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (“PECR”), each as amended by the Data (Use and Access) Act 2025, and, where it applies to us, the EU General Data Protection Regulation (“EU GDPR”).
Who we are and how to contact us
Nevatech is the controller of the personal data described in this policy.
- Company name: NEVA TECH LTD
- Registered in England and Wales, company number 12004677
- Registered office: 170 Crescent Road, Barnet, EN4 9RS, London, United Kingdom
- Privacy contact: our contact form
We have not appointed a Data Protection Officer because we are not legally required to. Our data protection lead is responsible for data protection matters and can be reached at the privacy contact above.
Personal data we collect
The types of personal data we collect depend on how you interact with us.
| Category | Examples |
|---|---|
| Identity and contact data | Name, job title, employer, business email address, business telephone number, business address |
| Enquiry data | The content of your enquiry form submission, emails and other messages, and any information you choose to share about your business, project or requirements |
| Professional data | Company name, role, seniority, industry, company size, and professional profile information that is publicly available (for example on LinkedIn or your company website) |
| Relationship data | Records of our communications and meetings, proposals, contracts, and your marketing preferences |
| Financial and transaction data | Invoicing contact details, billing address, payment records and VAT details (we do not store full payment card details) |
| Technical data | Browser type and version, device type, operating system, screen resolution, approximate location (country or region), referring website, pages viewed and time on page |
| Usage and interaction data | How you navigate and interact with the Website, such as clicks, scrolling and form interactions; and, only where you have consented, session recordings (see Section 7) |
Special category data. We do not ask for, and you should not send us, special category data (such as information about health, ethnicity, religion, sexual orientation, political opinions or trade union membership) or criminal offence data.
Confidential and security information. Please do not send credentials, API keys, access tokens, source code, customer data or details of security incidents through our Website forms or by unencrypted email. If an engagement needs this information, we will agree a secure method of sharing it.
How we collect personal data
- Directly from you, when you complete our enquiry form, email or call us, meet us, attend an event, or enter into a contract with us.
- Automatically, when you use the Website, through our analytics tool (see Section 7).
- From publicly available sources, such as company websites, Companies House and equivalent business registers, professional networking sites (such as LinkedIn) and press coverage.
- From third parties, such as:
- business contact data and prospecting providers, which supply professional contact details (for example business email addresses) and company information;
- people who refer you to us, including clients, partners and certification bodies;
- your colleagues, where they introduce you to us or name you as a contact for a project.
If we collect your personal data from a source other than you, we will provide you with the information in this policy within a reasonable period, and at the latest within one month or when we first contact you.
How we use personal data and our lawful bases
We only use personal data where we have a lawful basis to do so.
| Purpose | Personal data used | Lawful basis |
|---|---|---|
| Responding to your enquiry and arranging calls or meetings | Identity and contact, enquiry, professional | Legitimate interests (responding to business enquiries and developing our business); or steps prior to entering a contract at your request |
| Preparing proposals, scoping work and entering into contracts | Identity and contact, enquiry, professional, relationship | Contract (where you are the contracting party); otherwise legitimate interests (contracting with your organisation) |
| Delivering services and managing the client relationship | Identity and contact, relationship | Contract or legitimate interests (performing our contract with your organisation) |
| Invoicing, payment collection and financial record keeping | Identity and contact, financial and transaction | Contract and legal obligation (tax and accounting law) |
| Identifying and contacting businesses that may benefit from our services (B2B prospecting) | Identity and contact, professional, relationship | Legitimate interests (promoting our services to relevant businesses) |
| Sending business news, insights and service updates | Identity and contact, relationship | Legitimate interests for corporate contacts, or consent where required by PECR (see Section 6) |
| Operating, securing and maintaining the Website, including preventing fraud and abuse | Technical, usage and interaction | Legitimate interests (keeping our Website secure and functional) |
| Understanding how the Website is used, so we can improve it | Technical, usage and interaction | Legitimate interests for basic statistical analytics without cookies; consent for analytics cookies and session recordings (see Section 7) |
| Handling complaints, rights requests and legal claims | Any relevant data | Legal obligation and legitimate interests (establishing, exercising or defending legal claims) |
| Complying with law, regulation and requests from authorities | Any relevant data | Legal obligation |
Legitimate interests. Where we rely on legitimate interests, we have considered whether our interests are overridden by your rights and interests, taking into account the nature of the data, your reasonable expectations and the safeguards we apply. You can ask us for more information about this balancing, and you have the right to object (see Section 12).
Automated tools. We use workflow automation and software tools, which may include AI-assisted tools, to help organise our records, research businesses and prioritise who we contact. These tools support human decision-making. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
If you do not provide personal data. You do not have to give us personal data, but if you do not, we may be unable to respond to your enquiry or provide services to your organisation.
Business marketing communications
- We market our services to businesses, not to consumers.
- Corporate contacts. Where you are an employee of a company, limited liability partnership or other corporate body, we may send you relevant information about our services at your business email address without prior consent, in line with PECR, relying on our legitimate interests under the UK GDPR.
- Sole traders and partnerships. PECR treats sole traders and most partnerships like individuals. We will only send electronic marketing to them where they have consented, or where they are an existing client who has not opted out and the marketing relates to similar services.
- EU contacts. Where we contact people in the EU, we follow the applicable local rules on electronic marketing, which may require prior consent.
- Your right to opt out. Every marketing email we send includes a simple way to unsubscribe. You can also opt out at any time through our contact form. We will stop sending you marketing promptly.
- When you opt out, we keep a minimal record (your email address and the date) on a suppression list so that we can make sure we do not contact you again.
- Opting out of marketing does not affect service-related messages we need to send if you are a client.
Cookies, analytics and similar technologies
Cookies are small text files placed on your device. Similar technologies include local storage, pixels and scripts. Under PECR we must tell you about these technologies and, unless an exemption applies, ask for your consent.
What we use
| Technology | Provider | Purpose | Consent needed? | Duration |
|---|---|---|---|---|
| Strictly necessary (remembering your cookie choice and protecting forms from spam) | Nevatech / PostHog / Cloudflare (Turnstile) | Remembering whether you accepted or rejected analytics cookies, and checking that form submissions come from a person, not an automated script | No (strictly necessary) | Up to 12 months |
| Privacy-friendly website analytics (cookieless mode) | PostHog (PostHog Cloud EU, Frankfurt) | Used if you click “Reject”: counting visits and measuring which pages are used, in aggregate, without storing anything on your device | No: no cookies or device storage are used | Not stored on your device |
| Analytics cookies | PostHog | Recognising returning visitors and understanding how people move through the Website, so we can improve it | Yes | Up to 12 months |
| Session recordings | PostHog | Reconstructing how visitors use pages (clicks, scrolls, mouse movement and text entered into our forms) so we can identify usability problems | Yes | Recordings retained for 30 days |
How it works
- Until you make a choice in our cookie banner, no analytics events are recorded and nothing is stored on your device. Your browser only fetches PostHog’s settings through our website; like any web request, this includes your IP address and browser type.
- If you click “Reject”, we use PostHog in a cookieless mode. In this mode, nothing is stored on or read from your device for analytics, and visits are counted using a temporary identifier generated on PostHog’s servers, which is reset daily and is not used to recognise you over time. We keep a record of your choice so we don’t ask again.
- Analytics cookies and session recordings are switched off by default. They are only switched on if you click “Accept” in our cookie banner, or turn them on in “Cookie settings”.
- Session recordings include the text you type into our forms. Please don’t type anything into a form that you wouldn’t want us to see.
- If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we treat it as a rejection and don’t show the banner. Analytics cookies and recordings stay off while the signal is on, including in “Cookie settings”.
- You can change your choice at any time using the “Cookie settings” link in the footer of the Website.
- We do not use advertising, retargeting or cross-site tracking cookies, and we do not sell or share analytics data for advertising purposes.
- PostHog acts as our processor under a data processing agreement and does not use our Website data for its own purposes. We have disabled the collection of full IP addresses.
Browser controls. Most browsers let you block or delete cookies. If you block strictly necessary cookies, parts of the Website may not work properly.
Who we share personal data with
We do not sell personal data. We share it only where necessary, with:
- Service providers acting as our processors, who handle personal data on our instructions and under contract, including providers of:
- website hosting and content delivery (Cloudflare);
- website analytics (PostHog);
- form handling (Cloudflare);
- email, calendar and document storage (Google Workspace and Zoho Mail);
- customer relationship management, email outreach and workflow automation;
- business contact data and enrichment;
- AI-assisted productivity and drafting tools;
- accounting, invoicing and payment processing;
- IT support and security.
- Specialist delivery partners and subcontractors who help us deliver services to our clients, where they need the contact details of client staff to do so. They are bound by written confidentiality and data protection obligations.
- Certification bodies and other independent third parties, where you or your organisation ask us to make an introduction or referral (for example, to an accredited ISO/IEC 27001 certification body).
- Professional advisers, such as lawyers, accountants, auditors and insurers, where necessary.
- Authorities, such as HM Revenue & Customs, law enforcement, regulators and courts, where we are required or permitted by law to do so.
- Buyers or investors, if we sell, transfer or merge all or part of our business. The recipient would be bound by this policy or an equivalent one.
International transfers
- We are based in the United Kingdom.
- Some of our service providers and partners are located in, or process data from, countries outside the UK, including the European Economic Area (EEA), the United States and Türkiye.
- Where personal data is transferred outside the UK, we make sure it is protected by one of the following safeguards:
- adequacy regulations: the destination has been recognised by the UK as providing an adequate level of protection (this includes EEA countries and, for organisations certified under the UK Extension to the EU-US Data Privacy Framework, the United States); or
- appropriate safeguards: we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.
- For people in the EEA: personal data can flow from the EEA to the UK because the European Commission has recognised the UK as providing adequate protection.
- You can request more information about the safeguards we use through our contact form.
How long we keep personal data
We keep personal data only for as long as we need it for the purposes described in this policy, including to meet legal, accounting and reporting requirements.
| Type of data | Retention period |
|---|---|
| Enquiries that do not lead to an engagement | 24 months from our last interaction |
| Prospect records used for B2B outreach | 24 months from our last meaningful interaction, or until you object, whichever is sooner |
| Marketing suppression list (if you opt out) | Kept for as long as we send marketing, so that we can honour your request |
| Client contact, contract and relationship records | Duration of the relationship plus 6 years, to meet tax and accounting obligations and for limitation periods for legal claims |
| Financial and invoicing records | 6 years from the end of the financial year to which they relate |
| Complaints and rights requests | 3 years from closure |
| Website analytics (event data) | 12 months |
| Session recordings (only with consent) | 30 days |
When personal data is no longer needed, we securely delete or anonymise it.
How we protect personal data
As a security and compliance consultancy, we take the protection of personal data seriously. Our measures include:
- encryption of data in transit and, where supported, at rest;
- multi-factor authentication and role-based access controls on our systems;
- access to personal data limited to people and providers who need it;
- due diligence on, and written contracts with, our service providers and partners;
- confidentiality obligations on everyone who works with us;
- regular review of our security controls; and
- a process for responding to personal data breaches, including notifying the Information Commissioner’s Office and affected individuals where required.
No method of transmission over the internet is completely secure, so we cannot guarantee the security of data you send to us electronically.
Your rights
Under data protection law, you have the following rights:
- Access: to ask for a copy of the personal data we hold about you and information about how we use it.
- Rectification: to ask us to correct inaccurate or incomplete personal data.
- Erasure: to ask us to delete your personal data in certain circumstances.
- Restriction: to ask us to limit how we use your personal data in certain circumstances.
- Objection: to object to our use of your personal data where we rely on legitimate interests. You have an absolute right to object to direct marketing, and we will stop if you do.
- Data portability: to receive personal data you have provided to us, in a structured, commonly used and machine-readable format, or to ask us to transfer it to someone else, where we rely on consent or contract and process it by automated means.
- Withdraw consent: where we rely on consent (for example for analytics cookies, session recordings, or marketing emails to sole traders and partnerships), to withdraw it at any time. This does not affect the lawfulness of our use of your data before you withdrew consent.
- Complain: to complain to us, and to complain to a supervisory authority (see Section 13).
How to exercise your rights
- Use our contact form or write to us at the address in Section 2.
- We may need to ask you for information to confirm your identity before we respond.
- We will respond without undue delay and in any event within one month of receiving your request (or, where we need to confirm your identity or need further information to locate your data, within one month of receiving that). We may extend this by up to two further months where a request is complex, and will tell you if we do.
- We do not usually charge a fee. We may charge a reasonable fee, or refuse to act, where a request is manifestly unfounded or excessive.
Complaints
Complaining to us
If you are unhappy with how we have handled your personal data, please tell us first so we can try to put it right.
- You can complain through our contact form, by post to the address in Section 2, or by any other way you contact us. You do not need to use any particular form or wording.
- We will acknowledge your complaint within 30 days of receiving it.
- We will investigate your complaint without undue delay, keep you informed of our progress, and tell you the outcome.
Complaining to a supervisory authority
You also have the right to complain to the UK’s data protection regulator:
- Information Commissioner’s Office (ICO)
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
If you are in the EEA, you may also complain to the data protection authority in the country where you live or work, or where you believe an infringement took place.
Children
The Website and our services are intended for businesses. They are not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
Changes to this policy
We may update this policy from time to time, for example to reflect changes to our services, our service providers or the law. The “Last updated” date at the top shows when it was last changed. Where changes are significant, we will take reasonable steps to let you know, for example by posting a notice on the Website.
Contact us
If you have any questions about this policy or how we handle personal data, please contact:
- Online: our contact form
- Post: Data Protection, NEVA TECH LTD, 170 Crescent Road, Barnet, EN4 9RS, London, United Kingdom