Privacy notice.

What this notice covers — and what it does not

This notice is about the enquiry form on this website: the details you type in when you ask us about a pilot, and what we do with them afterwards.

It is not about evidence held inside the EvidenceVault platform. Where an organisation uses EvidenceVault, that organisation is the data controller for everything it stores, and we act on its instructions under a separate written agreement. We cannot read the contents of what it holds — the encryption keys are the customer's. Nothing in this notice gives us any right over that material.

Who we are

The data controller is Cloud22 Solutions Ltd, registered in England and Wales, company number 03916300, of Welwyn, Hertfordshire, United Kingdom. EvidenceVault is our service.

For anything in this notice, including any of the requests below, write to info@evidencevault.uk. Security matters can go to security@evidencevault.uk.

What we collect

Only what the form asks for, plus three technical details recorded automatically:

Please do not put case details, personal data about other people, or anything sensitive in the free-text box. It is there to tell us what is prompting the conversation — a full archive, slow retrievals, a retention review, a budget cycle. We do not need, and would rather not receive, anything operational at this stage.

Why we have it, and what allows us to keep it

To answer you. Our lawful basis is legitimate interests: you asked us a question about our service and we need your details to reply and to prepare something useful. We think that is plainly what you expect, which is the test that basis has to meet.

To contact you again about EvidenceVault, if — and only if — you ticked the box. That is consent, and you can withdraw it whenever you like.

To keep the form from being abused. The time, IP address and browser string are recorded so that we can identify automated or malicious submissions. Legitimate interests again, and they are used for nothing else.

Who else sees it

Nobody outside our own team. We do not sell enquiry data, we do not share it with other customers, and we do not pass it to advertisers or data brokers.

It is stored in Microsoft Azure, in the UK South region, and Microsoft acts as our processor. Nothing leaves the United Kingdom.

This website sets no analytics or tracking cookies. There is no Google Analytics, no advertising pixel and no third-party tracker on these pages, so there is nothing for you to consent to or refuse.

How long we keep it

Two years from the last time your enquiry record is updated, after which it is deleted automatically by the database rather than by someone remembering. Two years because a public-sector procurement can move slowly, and because a period that never ends is not a retention policy.

If you ask us to delete it sooner, we will — see below. If you withdraw marketing consent, we stop contacting you immediately; that is separate from deleting the enquiry itself, and you can ask for both.

Your rights

You can ask us to do any of the following, free of charge, and we will respond within one month:

Email info@evidencevault.uk and say what you want. We will not ask you to justify it.

If you are unhappy with how we have handled your data

Tell us first, if you are willing to — info@evidencevault.uk — because most things are quicker to fix directly.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not need our permission and you do not have to come to us first.

Changes to this notice

If we change what we collect or what we do with it, we will change this page and move the date at the top. We will not quietly widen the uses of something you have already given us.