LEGAL

CVOR Privacy Policy

1. Introduction

CVOR Technologies Ltd (“CVOR”, “we”, “our”, or “us”) is committed to protecting the privacy, confidentiality, integrity, and security of the personal data entrusted to us.

This Privacy Policy explains how we collect, use, disclose, store, protect, retain, and otherwise process personal data when you use the CVOR platform, our websites, applications, services, and related features.

Our goal is to provide clear and transparent information about our processing activities so that individuals and organisations understand:

• what information we process;
• why we process it;
• the legal basis on which we process it;
• who controls that processing;
• when information may be shared;
• how long information is retained;
• what rights individuals have under applicable data protection laws; and
• how to exercise those rights.

We recognise that the CVOR platform is used in several different contexts. Depending on how our services are used, CVOR may process personal data as a data controller, a data processor acting on behalf of an enterprise customer, or, in limited circumstances, both.

Accordingly, some sections of this Privacy Policy apply only to particular services or categories of users. Where this is the case, we explain those distinctions throughout this Policy.

This Privacy Policy should be read together with any applicable Terms of Service, enterprise agreements, Data Processing Agreements (“DPAs”), and other contractual documents governing your use of the platform.

2. Scope

This Privacy Policy applies to personal data processed through:

• the CVOR website;
• the CVOR Enterprise Platform;
• the CVOR Individual Platform and Personal Vault;
• CVOR mobile applications, including CVOR Guard where available;
• public document submission and request portals;
• enterprise onboarding and administration;
• customer support services;
• privacy and compliance workflows;
• communications relating to our services; and
• any other products or services that reference this Privacy Policy.

This Privacy Policy applies to personal data relating to:

• website visitors;
• prospective customers;
• enterprise customers;
• enterprise users and administrators;
• individual account holders;
• mobile application users;
• recipients of document requests;
• public submitters;
• support contacts;
• authorised representatives of organisations; and
• other individuals whose personal data is processed through the operation of the platform.

This Privacy Policy does not apply to third-party websites, applications, or services that are not operated by CVOR, even where those services integrate with the platform or are accessed through it. Those services are governed by their own privacy notices and terms.

3. Definitions

For the purposes of this Privacy Policy:

Account means a registered user account used to access one or more CVOR services.

Enterprise Customer means an organisation that subscribes to or otherwise uses the CVOR Enterprise Platform.

Enterprise User means an individual authorised by an Enterprise Customer to access its workspace.

Individual User means a person who creates and manages their own CVOR personal account and Personal Vault.

Personal Vault means the secure area of the platform in which an Individual User may store and manage documents, subject to applicable sharing and retention controls.

Mobile Application means a CVOR mobile application made available for iOS or Android, including CVOR Guard where available.

Organisation Workspace means the tenant-specific environment used by an Enterprise Customer to manage document workflows, users, programmes, governance settings, and related activities.

Programme means a logical grouping of document collection or operational workflows created by an Enterprise Customer.

Subject means the individual whose documents or personal information are being requested, uploaded, managed, or reviewed through the platform.

Document Request means a request created by an Enterprise Customer inviting a Subject to provide one or more documents.

Public Intake means a token-scoped workflow allowing authorised external individuals to submit documents without requiring full platform registration where permitted by the Enterprise Customer.

Personal Data has the meaning given under the UK GDPR, EU GDPR, or other applicable data protection legislation.

Processing means any operation performed on Personal Data, including collection, recording, organisation, storage, use, disclosure, transmission, restriction, deletion, or destruction.

Controller, Processor, Data Subject, Special Category Data, and other data protection terms have the meanings given by applicable data protection legislation unless otherwise stated.

4. Our Role Under Data Protection Law

The role that CVOR plays when processing Personal Data depends on how the platform is being used.

In some situations, CVOR determines the purposes and means of processing Personal Data and acts as a Controller.

In other situations, CVOR processes Personal Data solely on behalf of an Enterprise Customer and acts as a Processor.

Some processing activities involve both roles simultaneously, where different categories of Personal Data are processed for different purposes.

Understanding these distinctions is important because they determine who is responsible for privacy decisions, how individuals exercise their rights, and which contractual arrangements apply.

4.1 When CVOR Acts as a Controller

CVOR acts as a Controller where we determine why and how Personal Data is processed for our own legitimate business purposes.

This generally includes processing necessary to:

• operate and administer the CVOR platform;
• create and manage user accounts;
• authenticate users and maintain account security;
• manage identity verification and multi-factor authentication;
• provide customer support;
• administer subscriptions, billing, and commercial relationships;
• detect, investigate, and prevent fraud, abuse, or security incidents;
• maintain audit records relating to our own platform operations;
• comply with applicable legal and regulatory obligations;
• communicate service-related information;
• improve the reliability, performance, accessibility, and security of our services; and
• protect the rights, property, and security of CVOR, our customers, and other users.

Where CVOR acts as a Controller, we are responsible for ensuring that Personal Data is processed lawfully, fairly, and transparently in accordance with applicable data protection legislation.

4.2 When CVOR Acts as a Processor

For most Enterprise Workspace activities, CVOR acts as a Processor on behalf of the Enterprise Customer.

Enterprise Customers determine:

• why Personal Data is collected;
• which individuals are included in their workspace;
• which documents are requested;
• which document categories are collected;
• who is granted access to information within their organisation;
• how long Enterprise-controlled information should be retained, subject to platform controls; and
• the lawful basis relied upon for their own processing activities.

In these circumstances, CVOR provides and operates the technical platform through which Enterprise Customers manage their document workflows.

Unless required by law or authorised by the applicable customer agreement, CVOR does not determine the purposes for which Enterprise-controlled Personal Data is processed.

Where CVOR acts as a Processor, we process Personal Data only in accordance with documented instructions from the Enterprise Customer, applicable contractual arrangements, and applicable law.

4.3 Enterprise Customers as Controllers

Enterprise Customers are generally the Controllers of Personal Data that they collect, upload, receive, review, share, retain, or otherwise manage through their Organisation Workspace.

This includes decisions relating to:

• document collection;
• recruitment, onboarding, employment, compliance, or customer due diligence activities;
• verification processes;
• internal access permissions;
• retention policies;
• disclosures to third parties; and
• compliance with applicable legal obligations.

Individuals who provide information to an Enterprise Customer should ordinarily refer to that organisation’s own Privacy Notice for information about why their Personal Data is being collected and how it will be used.

4.4 Individual Accounts and Personal Vaults

Where an Individual User creates and manages their own CVOR account and Personal Vault independently of an Enterprise Customer, CVOR generally acts as the Controller for processing necessary to provide those services.

This includes processing required to:

• create and maintain the account;
• authenticate the user;
• secure access to the platform;
• store user preferences;
• operate Personal Vault functionality;
• facilitate document sharing initiated by the Individual User;
• provide support;
• maintain audit records relating to platform security and operation; and
• comply with applicable legal obligations.

Although Individual Users determine which documents they choose to upload or delete from their Personal Vault, CVOR remains responsible for the platform processing necessary to operate those services.

4.5 Public Document Submission and Request Portals

Enterprise Customers may invite individuals to submit documents through secure request links or public intake workflows.

In these circumstances:

• the Enterprise Customer determines why documents are requested;
• the Enterprise Customer determines which document categories are required;
• CVOR provides and operates the technical platform through which submissions are made; and
• CVOR processes Personal Data as necessary to authenticate requests, secure uploads, maintain audit records, and deliver the requested services.

Where Personal Data is processed solely to operate the platform on behalf of the Enterprise Customer, CVOR generally acts as a Processor.

4.6 Support, Security, Compliance, and Operational Processing

Certain processing activities are carried out by CVOR independently of any Enterprise Customer instructions because they are necessary to operate, secure, maintain, or improve the platform.

These activities may include:

• account security;
• fraud detection;
• abuse prevention;
• authentication services;
• platform monitoring;
• system diagnostics;
• operational logging;
• security investigations;
• privileged access governance;
• incident management;
• compliance with legal obligations;
• responding to lawful requests from public authorities; and
• maintaining evidence required to demonstrate compliance with applicable laws.

For these activities, CVOR generally acts as an independent Controller.

Where support requests require access to Enterprise-controlled information, CVOR will only access such information where necessary to provide requested support, fulfil contractual obligations, comply with applicable law, or protect the security and integrity of the platform.

4.7 Mixed Processing Activities

Some platform features involve both Controller and Processor activities.

For example:

• an Enterprise Customer may control documents uploaded into its workspace;
• CVOR simultaneously processes authentication information, security logs, audit records, and operational telemetry required to operate the platform.

These processing activities serve different purposes and are governed by different legal responsibilities.

Accordingly, the same interaction with the platform may involve CVOR acting as a Processor for one category of Personal Data while acting as a Controller for another.

4.8 Data Processing Agreements

Where CVOR processes Personal Data on behalf of an Enterprise Customer as a Processor, the processing relationship is governed by the applicable customer agreement and, where required, a Data Processing Agreement (“DPA”).

The DPA supplements this Privacy Policy by setting out the contractual obligations that apply between CVOR and the Enterprise Customer in relation to Processor activities.

Nothing in this Privacy Policy limits or replaces any contractual obligations contained within an applicable DPA or other enterprise agreement.

5. Our Privacy Principles

CVOR is designed around the principle that privacy should be built into the operation of the platform rather than added as an afterthought.

We apply privacy and security considerations throughout the design, development, operation, and improvement of our services.

Our approach is guided by the following principles.

5.1 Transparency

We aim to provide clear information about how Personal Data is processed, including:

• what information is collected;
• why it is processed;
• who is responsible for that processing;
• when information may be shared;
• how long information is retained; and
• how individuals can exercise their rights.

Where different processing activities involve different responsibilities, we explain those distinctions rather than applying a single generic description.

5.2 Purpose Limitation

We process Personal Data only for identified and legitimate purposes.

For Enterprise Customers, Personal Data contained within Organisation Workspaces is generally processed according to the instructions and purposes established by the Enterprise Customer.

For CVOR-controlled processing activities, we limit processing to purposes necessary to operate, secure, maintain, improve, and support our services.

We do not use Personal Data for unrelated purposes without appropriate legal justification or transparency.

5.3 Data Minimisation

We aim to collect and process only the Personal Data necessary for the relevant purpose.

The information required depends on how CVOR is being used.

For example:

• account creation requires information necessary to establish and secure an account;
• Enterprise Workspaces may contain documents and information determined by the Enterprise Customer;
• support activities may require limited access to information necessary to resolve a request.

We avoid collecting information that is not required for the operation of the platform or the delivery of requested services.

5.4 Accuracy

We take reasonable steps to ensure that Personal Data processed by CVOR is accurate and kept up to date where we are responsible for maintaining that information.

Where Enterprise Customers control Personal Data submitted through their Organisation Workspaces, they are generally responsible for ensuring that information they provide or manage is accurate and appropriate for their purposes.

5.5 Storage Limitation

We retain Personal Data only for as long as necessary for the purposes for which it was collected, to meet contractual obligations, to comply with legal requirements, or to protect legitimate interests.

Retention periods depend on:

• the type of information;
• the purpose of processing;
• contractual obligations;
• customer configuration;
• legal requirements; and
• security or audit requirements.

Further information is provided in the Data Retention and Deletion section of this Privacy Policy.

5.6 Security and Confidentiality

We apply appropriate technical and organisational measures designed to protect Personal Data against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• disclosure;
• destruction; and
• other unlawful processing.

Security measures are designed according to the nature of the processing, the sensitivity of information involved, and the risks associated with the services provided.

Further information about security controls is described in our security documentation and applicable enterprise agreements.

5.7 Privacy by Design and Default

CVOR considers privacy throughout the lifecycle of its services, including:

• product design;
• feature development;
• infrastructure decisions;
• access controls;
• data flows;
• operational processes; and
• changes to existing functionality.

Where possible, the platform is designed to support privacy-preserving practices, including:

• controlled access to documents;
• auditability of important actions;
• permission-based sharing;
• configurable workflows;
• separation of customer environments; and
• minimisation of unnecessary data exposure.

5.8 Accountability

CVOR maintains processes intended to demonstrate compliance with applicable data protection obligations.

These may include:

• maintaining records of processing activities;
• documenting privacy decisions;
• reviewing security controls;
• managing supplier relationships;
• responding to privacy requests;
• managing incidents; and
• maintaining appropriate contractual documentation.

5.9 Responsible Use of Automation and AI

Where CVOR provides AI-assisted functionality, we aim to ensure that automation is used responsibly, transparently, and with appropriate human oversight.

Further information about AI-assisted processing is provided in the Artificial Intelligence and Automated Processing section of this Privacy Policy.

5.10 Continuous Improvement

Privacy requirements evolve as technology, regulations, and customer expectations change.

CVOR periodically reviews its privacy practices, documentation, and operational controls to ensure they remain appropriate for the services we provide.

6. Categories of Personal Data We Process

The categories of Personal Data processed by CVOR depend on how our services are used and the relationship an individual has with the platform.

Some information is provided directly by users, while other information is generated through use of the platform or received from Enterprise Customers acting as Controllers.

The categories below describe the types of Personal Data that may be processed through the operation of our services.

6.1 Website Visitors

When you visit our website, we may process information necessary to operate, secure, and improve the website.

Depending on how the website is used, this may include:

• IP address;
• browser and device information;
• operating system;
• language and regional preferences;
• pages viewed;
• referring website information;
• session identifiers;
• security and diagnostic logs;
• cookie identifiers where applicable; and
• information submitted through website forms.

The specific information processed depends on your interaction with the website and your browser settings.

6.2 Prospective Customers and Business Contacts

If you contact CVOR or request information about our services, we may process information such as:

• name;
• organisation;
• job title;
• business email address;
• telephone number;
• country or region;
• correspondence;
• meeting notes;
• product enquiries;
• procurement communications; and
• other information you choose to provide.

This information is used to respond to enquiries, evaluate potential business relationships, provide requested information, and manage commercial communications.

6.3 Account Information

When an account is created, CVOR processes information necessary to establish and manage that account.

Depending on the services used, this may include:

• name;
• email address;
• account identifier;
• authentication credentials;
• password hashes or equivalent authentication artefacts;
• multi-factor authentication configuration;
• organisation memberships;
• account status;
• language and regional preferences;
• notification preferences;
• profile information; and
• account creation and modification timestamps.

We do not intentionally collect more account information than is necessary to operate the services provided.

6.4 Enterprise Workspace Information

Enterprise Customers determine the information processed within their Organisation Workspaces.

Depending on how the platform is configured, Enterprise Workspace information may include:

• names of users;
• organisational roles;
• department or team information;
• document requests;
• workflow information;
• programme participation;
• permissions;
• access records;
• audit events;
• comments;
• internal notes;
• document metadata; and
• other information entered by authorised Enterprise Users.

CVOR processes this information on behalf of the Enterprise Customer where acting as a Processor.

6.5 Documents and Associated Metadata

The platform enables Enterprise Customers and Individual Users to store, request, receive, review, organise, and share documents.

Documents uploaded to the platform may contain any category of Personal Data chosen by the user or requested by an Enterprise Customer.

Depending on the intended use of the platform, documents may include:

• identity documents;
• licences;
• certifications;
• contracts;
• forms;
• declarations;
• correspondence;
• compliance records;
• financial documents;
• employment-related documents; and
• other files uploaded by authorised users.

CVOR does not require or prescribe the content of documents uploaded by Enterprise Customers beyond the technical requirements necessary to provide the service.

Document metadata may include:

• file names;
• file size;
• document type;
• upload timestamps;
• version history;
• sharing status;
• retention information;
• verification status;
• request identifiers; and
• other operational metadata generated by the platform.

6.6 Public Upload and Request Information

Where an Enterprise Customer sends a secure document request or enables public document submission, CVOR may process information including:

• recipient identifiers;
• request tokens;
• upload session information;
• submitted documents;
• document metadata;
• submission timestamps;
• verification events;
• delivery status;
• IP address where required for security;
• browser information; and
• security logs associated with the submission.

The purpose of this processing is to facilitate secure document submission and delivery on behalf of the Enterprise Customer.

6.7 Personal Vault Information

Individual Users may choose to store information within their Personal Vault.

Depending on how the Personal Vault is used, this may include:

• uploaded documents;
• folders and organisation structures;
• sharing permissions;
• document labels;
• retention preferences;
• vault settings;
• activity history; and
• user-generated metadata.

The content of a Personal Vault is determined by the Individual User.

6.8 Authentication and Security Information

To protect the security and integrity of the platform, CVOR processes information relating to authentication and platform security.

This may include:

• login attempts;
• successful authentications;
• failed authentication events;
• multi-factor authentication events;
• session identifiers;
• device identifiers where applicable;
• IP addresses;
• browser characteristics;
• security alerts;
• access logs;
• privileged access events;
• administrative actions; and
• security investigation records.

This information is processed to protect users, Enterprise Customers, and the platform against unauthorised access, misuse, fraud, and other security risks.

6.9 Support Information

When users contact CVOR for assistance, we may process:

• contact details;
• support requests;
• correspondence;
• diagnostic information;
• screenshots or attachments voluntarily provided;
• support history;
• troubleshooting records;
• issue resolution notes; and
• customer satisfaction feedback.

Where support activities require access to Enterprise-controlled information, such access is limited to what is reasonably necessary to investigate and resolve the reported issue.

6.10 Billing and Commercial Information

Where applicable, CVOR may process information necessary to manage subscriptions and commercial relationships.

This may include:

• billing contacts;
• invoices;
• payment references;
• subscription information;
• app store entitlement or purchase status information;
• transaction records;
• tax information where required by law; and
• communications relating to commercial services.

Where purchases or subscriptions are made through an app store, billing information is collected and processed by the relevant provider, such as Apple App Store or Google Play. CVOR does not intentionally store full payment card details where payment processing is performed by an authorised third-party payment provider.

6.11 Communications

We process communications exchanged with users and customers, including:

• emails;
• support correspondence;
• service notifications;
• product announcements;
• security notifications;
• legal notices;
• feedback;
• survey responses; and
• other communications relating to the operation of our services.

6.12 Automatically Generated Operational Data

The operation of the platform generates technical information necessary for reliability, security, auditing, and service improvement.

This may include:

• audit logs;
• event records;
• workflow events;
• system diagnostics;
• application logs;
• performance metrics;
• error reports;
• API activity;
• configuration changes;
• operational telemetry; and
• other technical information generated during use of the platform.

This information is used to maintain the security, availability, integrity, and reliability of the services.

6.13 Mobile Technical Data

Where you use a Mobile Application, CVOR or its service providers, such as Firebase Crashlytics or Google Analytics for Firebase where configured, may process limited technical information necessary to operate, secure, diagnose, and improve the app.

This may include:

• device type and model;
• operating system and app version;
• crash logs and error reports;
• performance and stability diagnostics;
• installation, update, and app-store metadata;
• push notification tokens or delivery status where notifications are enabled; and
• other technical information generated by the app or device operating system.

Mobile diagnostic data is not intended to include document contents, advertising identifiers, or behavioural advertising profiles.

6.14 Local Device Data

Some Mobile Application features are designed to process content locally on your device.

Depending on the features used, local device data may include documents, images, file names, labels, watermark text, recipient references, app settings, cached files, locally generated outputs, and local authentication or session material.

CVOR does not intentionally receive or store locally processed mobile content unless you choose to share, upload, export, synchronise, or connect that content through a CVOR service or a third-party service.

6.15 Special Category Personal Data

Enterprise Customers or Individual Users may choose to upload documents containing Special Category Personal Data or other sensitive information.

CVOR does not intentionally require the submission of Special Category Personal Data unless necessary for the specific service being used or instructed by the applicable Enterprise Customer.

Where Special Category Personal Data is processed through the platform, it is processed in accordance with applicable data protection legislation, contractual arrangements, and appropriate technical and organisational safeguards.

6.16 Information We Do Not Intentionally Collect

CVOR does not intentionally collect Personal Data beyond what is reasonably necessary to provide its services.

Where users choose to upload information beyond what is required for their intended use of the platform, they remain responsible for ensuring they have the appropriate authority or legal basis to do so.

Enterprise Customers remain responsible for determining which categories of Personal Data they collect through their Organisation Workspaces and for ensuring that such collection complies with applicable law.

7. How We Use Personal Data

The way in which Personal Data is used depends on the services being provided, the relationship between the parties, and whether CVOR is acting as a Controller or as a Processor on behalf of an Enterprise Customer.

Where CVOR acts as a Controller, we rely on one or more lawful bases under applicable data protection legislation.

Where CVOR acts as a Processor, the relevant Enterprise Customer determines the lawful basis for its processing activities and CVOR processes Personal Data in accordance with documented instructions, applicable agreements, and applicable law.

7.1 Operating the Platform

We process Personal Data to provide, maintain, and operate the CVOR platform.

This includes processing necessary to:

• create and manage accounts;
• authenticate users;
• establish secure sessions;
• manage user preferences;
• deliver requested services;
• operate Organisation Workspaces;
• provide Personal Vault functionality;
• facilitate document requests and submissions;
• maintain platform availability; and
• administer customer subscriptions.

CVOR Role: Controller (platform operations) and Processor (Enterprise Workspace services).

Lawful Basis (Controller Activities):

• Performance of a contract.
• Legitimate interests in operating and maintaining the platform.

7.2 Identity, Authentication and Access Control

We process Personal Data to verify user identities, authenticate users, manage access permissions, protect accounts, and prevent unauthorised access.

This processing may include:

• account authentication;
• password verification;
• multi-factor authentication;
• session management;
• access control;
• login history;
• security monitoring; and
• privileged access governance.

For Mobile Applications, authentication may also involve device-level authentication, mobile session state, push notification tokens where enabled, and optional third-party sign-in such as Google OAuth where supported and authorised by the user.

CVOR Role: Controller.

Lawful Basis:

• Performance of a contract.
• Legitimate interests in protecting users, Enterprise Customers, and the security of our services.

7.3 Enterprise Document Workflows

CVOR provides Enterprise Customers with services that enable them to request, receive, manage, review, organise, retain, and share documents.

Enterprise Customers determine:

• why documents are collected;
• which information is requested;
• which individuals are affected;
• who may access the information; and
• how the information is used within their organisation.

CVOR processes this information solely to provide the requested services.

CVOR Role: Processor.

Lawful Basis:

Determined by the applicable Enterprise Customer acting as Controller.

7.4 Personal Vault Services

Where an Individual User creates and manages a Personal Vault, CVOR processes Personal Data to provide secure storage, organisation, sharing, and management functionality.

This processing includes:

• document storage;
• document organisation;
• sharing functionality;
• activity history;
• retention management;
• synchronisation between authorised devices; and
• related platform services.

CVOR Role: Controller.

Lawful Basis:

• Performance of a contract.

7.5 Customer Support

We process Personal Data to:

• respond to enquiries;
• investigate reported issues;
• diagnose technical problems;
• resolve support requests;
• communicate with customers; and
• improve support services.

Support activities are designed to minimise access to customer information.

Where access to Enterprise-controlled information is required, access is limited to what is reasonably necessary to resolve the reported issue.

CVOR Role: Generally Controller.

Where support involves Enterprise-controlled information, CVOR may also process Personal Data as a Processor.

Lawful Basis:

• Performance of a contract.
• Legitimate interests in providing effective customer support.

7.6 Security and Fraud Prevention

CVOR processes Personal Data to protect the security, confidentiality, integrity, and availability of the platform.

This includes processing necessary to:

• detect unauthorised access;
• investigate suspicious activity;
• identify security incidents;
• prevent fraud;
• monitor privileged access;
• maintain audit records;
• investigate abuse;
• protect customer environments; and
• maintain the resilience of our services.

CVOR Role: Controller.

Lawful Basis:

• Legitimate interests.
• Compliance with legal obligations where applicable.

7.7 Communications

We process Personal Data to communicate with users and customers regarding:

• service updates;
• operational notifications;
• security alerts;
• account administration;
• support requests;
• contractual matters;
• legal notices; and
• changes to our services.

Where permitted by law, we may also communicate information relating to our products or services.

Individuals may be able to manage certain communication preferences through their account settings or by following unsubscribe instructions where applicable.

CVOR Role: Controller.

Lawful Basis:

• Performance of a contract.
• Legitimate interests.
• Consent where required by applicable law.

7.8 Billing and Commercial Administration

We process Personal Data to:

• administer subscriptions;
• issue invoices;
• maintain financial records;
• process payments through authorised providers;
• manage taxation obligations; and
• maintain commercial relationships.

CVOR Role: Controller.

Lawful Basis:

• Performance of a contract.
• Compliance with legal obligations.

7.9 Legal and Regulatory Compliance

We may process Personal Data where necessary to:

• comply with applicable legislation;
• satisfy regulatory obligations;
• respond to lawful requests from competent authorities;
• establish, exercise, or defend legal claims;
• investigate suspected unlawful activity; and
• fulfil contractual obligations.

CVOR Role: Controller.

Lawful Basis:

• Compliance with legal obligations.
• Legitimate interests where appropriate.

7.10 Product Improvement

CVOR may process limited operational and technical information to:

• improve platform performance;
• identify defects;
• enhance accessibility;
• improve reliability;
• evaluate feature usage;
• develop new functionality; and
• improve the overall user experience.

Where practical, we seek to minimise the Personal Data used for these purposes.

We do not use Enterprise-controlled document content for product development except where expressly authorised or otherwise permitted by applicable agreements and law.

CVOR Role: Controller.

Lawful Basis:

• Legitimate interests.

7.11 Artificial Intelligence Features

Where AI-assisted functionality is available and enabled, CVOR may process limited Personal Data necessary to provide that functionality.

The current AI processing model, safeguards, limitations, and role allocation are described in the Artificial Intelligence and Automated Processing section of this Privacy Policy.

CVOR Role:

Depends on the service being provided and whether the AI-assisted processing relates to Enterprise-controlled information or CVOR-controlled platform activity.

7.12 Other Compatible Purposes

Where permitted by applicable law, CVOR may process Personal Data for purposes compatible with those described in this Privacy Policy, provided that such processing remains lawful, proportionate, and consistent with the expectations of the individuals concerned.

Where required by law, we will provide additional notice before processing Personal Data for materially different purposes.

8. Enterprise Workspaces

Enterprise Workspaces enable organisations to securely collect, receive, manage, review, retain, and share documents and related information for their own business purposes.

This section highlights points that are specific to Enterprise Workspaces. General information about CVOR’s role, categories of Personal Data, purposes, retention, security, sharing, and rights is provided elsewhere in this Privacy Policy.

8.1 Enterprise Customers Control Their Workspace

Each Enterprise Workspace is managed by the relevant Enterprise Customer.

Enterprise Customers determine matters including:

• the purposes for which Personal Data is collected;
• the categories of individuals whose information is processed;
• the types of documents requested;
• the workflows implemented within the workspace;
• user roles and permissions;
• document retention policies;
• sharing decisions; and
• compliance with their own legal and regulatory obligations.

Enterprise Customers are responsible for ensuring that their use of the platform complies with applicable law.

8.2 CVOR Provides the Platform

CVOR provides and operates the technical infrastructure required to deliver Enterprise Workspace services, including account access, document workflow, audit, security, support, and platform administration functionality.

Where these services are provided on behalf of an Enterprise Customer, CVOR generally acts as a Processor.

8.3 Instructions from Enterprise Customers

CVOR processes Enterprise-controlled Personal Data in accordance with:

• documented customer instructions;
• applicable customer agreements;
• applicable Data Processing Agreements;
• platform configuration selected by the Enterprise Customer; and
• applicable law.

CVOR does not determine the business purpose for which Enterprise-controlled documents are collected or managed unless expressly described elsewhere in this Privacy Policy.

8.4 Document Requests

Enterprise Customers may request documents from individuals using workflows provided through the platform.

The Enterprise Customer determines:

• why documents are requested;
• which documents are requested;
• who receives the request;
• how submitted information is reviewed; and
• how the information is subsequently used.

CVOR provides the technical mechanisms through which these requests are created, delivered, managed, and fulfilled.

8.5 Access Within the Organisation

Enterprise Customers are responsible for managing access to information contained within their Organisation Workspace.

CVOR provides role-based access controls and administrative capabilities. The Enterprise Customer determines which authorised users should have access, which roles they should hold, and how those permissions should be managed within its organisation.

8.6 Customer Responsibilities

Enterprise Customers remain responsible for:

• determining the lawful basis for their processing;
• providing any required privacy information to individuals;
• responding to data subject rights requests relating to Enterprise-controlled Personal Data;
• ensuring appropriate authority exists before requesting documents;
• configuring the platform appropriately for their operational needs; and
• complying with applicable legal and regulatory obligations.

Where CVOR receives a request relating to Enterprise-controlled Personal Data, we may redirect the request to the relevant Enterprise Customer where appropriate.

8.7 Support and Administrative Access

CVOR seeks to minimise access to Enterprise-controlled Personal Data.

Where support or maintenance activities require access to Enterprise-controlled information, access is limited to what is reasonably necessary for the specific purpose and is subject to appropriate technical, organisational, and governance controls.

Support and administrative access may be logged and monitored to support accountability and platform security.

8.8 Enterprise Agreements

The relationship between CVOR and an Enterprise Customer is also governed by the applicable contractual documentation, which may include:

• the applicable Terms of Service;
• Master Services Agreement (where applicable);
• Data Processing Agreement;
• Service Level Agreement;
• Order Forms; and
• other agreed contractual documents.

Where there is a conflict between this Privacy Policy and an applicable Data Processing Agreement regarding Processor obligations, the relevant contractual provisions will govern the Processor relationship to the extent permitted by applicable law.

9. Individual Accounts and Personal Vaults

Individual Accounts and Personal Vaults allow individuals to securely manage, organise, store, and share their own information using services provided directly by CVOR.

Unlike Enterprise Workspaces, where an Enterprise Customer generally determines the purposes of processing, Personal Vault services are provided directly by CVOR to the Individual User.

This section highlights points that are specific to Individual Accounts and Personal Vaults. General information about CVOR’s role, categories of Personal Data, purposes, retention, security, sharing, and rights is provided elsewhere in this Privacy Policy.

9.1 CVOR Provides the Personal Vault

Individuals may create a CVOR account to access Personal Vault services and other features made available through the platform.

CVOR generally acts as the Controller for Individual Account and Personal Vault processing. This includes platform processing required to provide account access, vault functionality, sharing controls, support, security, and service communications.

9.2 User-Controlled Content

Individuals decide which documents and information they choose to upload to their Personal Vault.

Users should avoid uploading information that is not necessary for their intended purposes.

Where documents contain Personal Data relating to other individuals, users are responsible for ensuring that they have an appropriate legal basis or authority to upload and share that information.

CVOR does not routinely review or determine the business purpose of documents uploaded by Individual Users.

9.3 Sharing Documents

The platform may enable Individual Users to share documents with third parties using features provided by CVOR.

Individuals remain responsible for determining who they share information with and whether they are authorised to disclose that information.

CVOR provides the technical functionality required to facilitate secure sharing but does not determine the purpose for which recipients use information shared by an Individual User.

9.4 Account Closure and Deletion

Individuals may request closure of their CVOR account in accordance with the functionality provided by the platform.

Further information is provided in the Data Retention and Deletion section of this Privacy Policy.

9.5 Individual Responsibilities

Individuals using Personal Vault services are responsible for:

• maintaining the confidentiality of their account credentials;
• using the platform in accordance with the applicable Terms of Service;
• ensuring that uploaded information is lawful;
• ensuring they have authority to upload or share Personal Data relating to others;
• reviewing documents before sharing them with third parties; and
• notifying CVOR promptly if they believe their account has been compromised.

9.6 Relationship with Enterprise Workspaces

An Individual User may also interact with Enterprise Workspaces, for example by responding to a document request or receiving an invitation from an Enterprise Customer.

Where this occurs, different processing activities may apply simultaneously.

For example:

• CVOR may process account and authentication information as a Controller;
• the Enterprise Customer may determine the purpose for which requested documents are collected as a Controller; and
• CVOR may process submitted documents as a Processor on behalf of the Enterprise Customer.

The applicable processing relationship depends on the specific activity being performed.

Individuals who interact with an Enterprise Workspace should also review the Privacy Notice provided by the relevant Enterprise Customer where appropriate.

10. Public Document Submission and Request Portals

CVOR enables Enterprise Customers to request information and documents from individuals through secure document request workflows and public submission portals.

These services are designed to facilitate the secure exchange of information between Enterprise Customers and external individuals without requiring unrestricted access to an Enterprise Workspace.

This section highlights points that are specific to public submission and request workflows. General information about categories of Personal Data, purposes, retention, security, sharing, and rights is provided elsewhere in this Privacy Policy.

10.1 Purpose of Public Submission Services

Enterprise Customers may use CVOR to:

• request documents from identified individuals;
• collect supporting information;
• receive completed forms;
• manage verification workflows;
• request replacement documents;
• support onboarding processes;
• support compliance activities; and
• facilitate other authorised document collection processes.

The Enterprise Customer determines the purpose for which information is requested.

CVOR provides and operates the technical platform through which requests are delivered and responses are securely submitted.

10.2 Information Processed During Submission

The categories of information processed depend on the workflow configured by the Enterprise Customer and the information voluntarily submitted by the individual. This may include recipient details, request identifiers, secure access tokens, uploaded documents, metadata, submission timestamps, browser or IP information used for security, and operational security logs.

10.3 Controller and Processor Responsibilities

For Personal Data submitted in response to an Enterprise Customer’s request:

• the Enterprise Customer generally acts as the Controller;
• CVOR generally acts as the Processor for documents and information processed on behalf of the Enterprise Customer; and
• CVOR acts as the Controller for platform operations such as authentication, security monitoring, fraud prevention, audit logging, and service administration.

Individuals responding to a document request should also review the Privacy Notice provided by the relevant Enterprise Customer, which explains why the requested information is being collected.

10.4 Secure Access

Document requests may be delivered using mechanisms designed to reduce the risk of unauthorised access.

Depending on the functionality deployed, this may include unique request identifiers, cryptographically generated access tokens, authenticated user sessions, request expiry controls, configurable access restrictions, verification requirements, and audit logging.

10.5 Submission Without a Full Account

Some document requests may permit individuals to submit information without creating a permanent CVOR account.

Where this functionality is available, CVOR processes the information necessary to authenticate the request, receive the submission, protect the service, deliver information to the relevant Enterprise Customer, maintain audit records, and fulfil applicable legal obligations.

Where an individual subsequently creates a CVOR account, additional processing described elsewhere in this Privacy Policy may apply.

10.6 Verification and Workflow Management

Enterprise Customers may configure workflows requiring:

• review of submitted documents;
• requests for additional information;
• document replacement;
• approval or rejection decisions;
• workflow progression; or
• completion notifications.

CVOR provides the technical functionality supporting these workflows.

Unless otherwise stated, CVOR does not determine the business decisions made by Enterprise Customers using information submitted through the platform.

10.7 Communications

Individuals may receive communications relating to a document request, including invitations, reminders, submission confirmations, requests for additional information, workflow updates, and completion notifications.

These communications are generally necessary to operate the requested workflow and are not intended to constitute marketing communications.

10.8 Security Monitoring

To protect both Enterprise Customers and individuals submitting information, CVOR may monitor public submission services for fraud, automated abuse, suspicious authentication activity, unauthorised access attempts, platform misuse, and other activity that may threaten the security or availability of the service.

Information processed for these purposes is generally processed by CVOR as a Controller in support of its legitimate interests in maintaining the security, integrity, and resilience of the platform.

10.9 Retention of Submitted Information

Documents and information submitted through public request workflows are generally retained according to the relevant Enterprise Customer’s retention decisions, applicable contractual requirements, platform configuration, legal obligations, and operational requirements.

Further information is provided in the Data Retention and Deletion section of this Privacy Policy.

10.10 Individual Rights

Where Personal Data submitted through a public document request is controlled by an Enterprise Customer, requests to access, correct, erase, restrict, or otherwise exercise data protection rights should ordinarily be directed to the relevant Enterprise Customer.

Where CVOR receives such a request directly, we may respond where we are responsible as a Controller, assist the Enterprise Customer where we act as a Processor, or redirect the request to the relevant Enterprise Customer where appropriate.

This approach helps ensure that requests are handled by the organisation responsible for determining the purposes and means of processing the submitted information.

11. Artificial Intelligence and Automated Processing

CVOR may provide Artificial Intelligence (“AI”)-assisted functionality as part of the services offered through the platform.

This section explains how AI-assisted features may process Personal Data, the safeguards that apply, and the choices available to users and Enterprise Customers.

Where AI functionality is not enabled, this section may not apply to your use of the platform.

11.1 Our Approach to AI

CVOR’s approach to AI is guided by transparency, security, accountability, human oversight, privacy by design, and responsible processing of Personal Data.

AI features are intended to assist users in performing tasks more efficiently. Unless explicitly stated otherwise, AI-generated outputs are designed to support human decision-making rather than replace it.

Users and Enterprise Customers remain responsible for reviewing information generated using AI features before relying upon it.

11.2 AI Features

In the current platform model, AI-assisted functionality is intended to support controlled workflow assistance, status checks, navigation, dry-run previews, and user-confirmed actions where enabled.

AI does not replace human review or determine legal, employment, compliance, financial, medical, identity, or eligibility outcomes.

11.3 Personal Data Processed by AI Features

Where AI functionality is used, processing may involve user prompts, workflow metadata, request or subject status information, system instructions necessary to provide the requested service, and related operational records.

CVOR seeks to limit the Personal Data processed by AI systems to that reasonably necessary for the requested functionality.

Uploaded document contents are not sent to an external model provider by default in the current implementation.

11.4 Enterprise AI Processing

Enterprise Customers determine whether and how AI functionality is used within their Organisation Workspaces where such configuration options are made available.

Where CVOR processes Enterprise-controlled Personal Data using AI functionality on behalf of an Enterprise Customer, CVOR generally acts as a Processor unless otherwise stated.

11.5 Individual Account AI Processing

Where Individual Users choose to use AI-assisted functionality within their Personal Vault or account, CVOR generally acts as the Controller for the processing necessary to provide those services.

AI features are provided only for the purposes described within the platform and this Privacy Policy.

11.6 Human Oversight

AI-generated outputs may contain inaccuracies, omissions, or results that require human review.

Users should review AI-generated content before making significant decisions, sharing information, relying on generated summaries, acting on recommendations, or using AI-generated information for regulatory, contractual, employment, financial, legal, medical, or other important purposes.

Where Enterprise Customers use AI-assisted functionality within their own business processes, they remain responsible for determining the appropriateness of relying upon AI-generated outputs.

11.7 AI Service Providers

The current launch position is that no external model provider is used by default for uploaded document content.

If CVOR introduces an external AI provider in the future, relevant provider information, processing locations, contractual safeguards, and customer controls will be disclosed through the Subprocessor Register, enterprise contractual documentation, customer documentation, or other transparency materials published by CVOR.

11.8 Training of AI Models

CVOR does not intentionally use Enterprise-controlled Personal Data to train general-purpose AI models.

Any future change to this position would require appropriate transparency, contractual controls, and a lawful basis under applicable data protection legislation.

11.9 Automated Decision-Making

CVOR does not intentionally use solely automated decision-making that produces legal or similarly significant effects on individuals.

Where such processing is introduced in the future, CVOR will provide additional information regarding:

• the nature of the processing;
• its purpose;
• the logic involved where required by law;
• its significance and potential consequences; and
• the rights available to affected individuals.

11.10 Security of AI Processing

AI-assisted processing is subject to security controls designed to protect Personal Data throughout the processing lifecycle.

Depending on the implementation, these controls may include authenticated access, encrypted communications, access controls, audit logging, processing restrictions, provider due diligence where relevant, and governance processes appropriate to the risks presented by AI-assisted functionality.

11.11 Future AI Capabilities

AI technology continues to evolve rapidly.

CVOR may introduce new AI-assisted functionality over time to improve productivity, document operations, and user experience.

Where new AI capabilities materially change how Personal Data is processed, CVOR will update this Privacy Policy and, where required by applicable law, provide additional notice before those changes take effect.

12. Sharing Personal Data

We share Personal Data only where necessary to provide our services, comply with legal obligations, protect the security and integrity of the platform, fulfil contractual commitments, or where instructed by the relevant Controller.

The recipients of Personal Data depend on how the platform is being used and whether CVOR is acting as a Controller or a Processor.

12.1 Enterprise Customers

Where CVOR processes Personal Data on behalf of an Enterprise Customer, submitted information is made available to that Enterprise Customer in accordance with the services requested.

Enterprise Customers determine:

• who within their organisation may access submitted information;
• how that information is used;
• how long it is retained;
• whether it is shared with third parties; and
• the lawful basis for their processing activities.

CVOR does not determine these business decisions when acting as a Processor.

12.2 Sharing Initiated by Users

Depending on the functionality available, users may choose to share information with other individuals or organisations.

Examples include:

• sharing documents from a Personal Vault;
• responding to an Enterprise document request;
• inviting collaborators;
• providing information through secure submission workflows; or
• granting access to authorised recipients.

Users remain responsible for ensuring they are authorised to share Personal Data with the recipients they select.

12.3 Service Providers

CVOR engages service providers to support the operation, maintenance, security, and administration of the platform.

Where service providers process Personal Data on behalf of CVOR, they do so under appropriate contractual obligations designed to protect Personal Data.

Further information about service providers and subprocessors is provided in the Service Providers and Subprocessors section of this Privacy Policy.

12.4 Professional Advisers

CVOR may disclose Personal Data where reasonably necessary to obtain professional advice or services from organisations such as:

• legal advisers;
• accountants;
• auditors;
• insurers; and
• other professional advisers acting under duties of confidentiality.

12.5 Regulators and Public Authorities

CVOR may disclose Personal Data where required to:

• comply with applicable law;
• respond to lawful requests;
• comply with court orders;
• satisfy regulatory obligations;
• protect legal rights;
• investigate unlawful activity; or
• protect the safety, security, or rights of individuals.

Where legally permitted and appropriate, CVOR may challenge or limit requests that we consider disproportionate or unlawful.

12.6 Corporate Transactions

If CVOR is involved in a merger, acquisition, investment, restructuring, financing, sale of assets, or similar corporate transaction, Personal Data may be disclosed where reasonably necessary to facilitate that transaction.

Appropriate confidentiality obligations and applicable legal requirements will continue to apply throughout such transactions.

Where required by applicable law, affected individuals will be notified of material changes relating to the processing of their Personal Data.

12.7 No Sale of Personal Data

CVOR does not sell Personal Data.

We do not disclose Personal Data to data brokers for independent commercial exploitation.

Where applicable law defines “sale” or “sharing” differently, CVOR will comply with the requirements of that legislation.

12.8 Disclosure Principles

Before sharing Personal Data, CVOR seeks to ensure that disclosures are:

• lawful;
• proportionate;
• necessary for the intended purpose;
• appropriately documented where required; and
• protected by suitable contractual, organisational, or technical safeguards.

13. Service Providers and Subprocessors

CVOR relies on a limited number of carefully selected service providers to operate, maintain, secure, and improve the platform.

These organisations may process Personal Data on CVOR’s behalf in accordance with applicable contractual arrangements.

13.1 Categories of Service Providers

Depending on the services provided, CVOR may engage providers supporting cloud hosting, infrastructure, storage, authentication, email delivery, payment processing, app distribution, app-store billing, crash diagnostics, customer communications, monitoring, logging, security, backup, analytics, customer support, and other operational functions.

CVOR services and Mobile Applications may also include third-party SDKs and open-source libraries used for app functionality, diagnostics, authentication, billing, or platform integration. Open-source components are governed by their applicable licences.

13.2 Due Diligence

Before engaging service providers that process Personal Data, CVOR seeks to evaluate matters including:

• security practices;
• contractual commitments;
• privacy practices;
• reliability;
• regulatory compliance where appropriate; and
• suitability for the intended processing.

13.3 Contractual Safeguards

Where required by applicable law, CVOR enters into contractual arrangements designed to ensure that service providers:

• process Personal Data only on documented instructions;
• implement appropriate security measures;
• maintain confidentiality;
• assist with applicable legal obligations where appropriate;
• permit required audits or assurance activities where applicable; and
• return or delete Personal Data when appropriate.

13.4 Subprocessor Transparency

CVOR uses infrastructure, hosting, and technical service providers to maintain the platform.

Where CVOR acts as a Processor, Enterprise Customers may request information about relevant subprocessors or consult the CVOR Subprocessor Register where available.

Subprocessor notice and objection rights are governed by the applicable customer agreement or Data Processing Agreement.

13.5 Changes to Service Providers

CVOR may add, replace, or remove service providers as the platform evolves.

Where contractual commitments require advance notice of material subprocessor changes, CVOR will provide such notice in accordance with the applicable customer agreement or Data Processing Agreement.

14. International Transfers

CVOR seeks to process Personal Data within jurisdictions appropriate for the services provided and in accordance with applicable data protection legislation.

Some service providers or infrastructure supporting the platform may process Personal Data outside the United Kingdom or European Economic Area.

Where Personal Data is transferred internationally, CVOR seeks to ensure that appropriate safeguards are in place.

14.1 Why International Transfers May Occur

International transfers may occur where necessary to provide cloud infrastructure, secure hosting, authentication, email delivery, app distribution, crash diagnostics, customer support, backup services, or other operational functions.

The specific locations involved depend upon the service providers engaged and the configuration of the platform.

14.2 Transfer Safeguards

Where required, CVOR relies on appropriate transfer mechanisms, which may include:

• adequacy regulations or adequacy decisions;
• Standard Contractual Clauses (SCCs);
• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the EU SCCs;
• legally recognised certification mechanisms; or
• other safeguards permitted under applicable law.

The safeguards used depend on the nature of the transfer and the jurisdictions involved.

14.3 Enterprise Processing

Where CVOR acts as a Processor, international transfers of Enterprise-controlled Personal Data are governed by the applicable customer agreement and Data Processing Agreement.

Enterprise Customers may request additional information regarding relevant transfer mechanisms where appropriate.

14.4 Additional Safeguards

Where appropriate, CVOR may supplement legal transfer mechanisms with additional organisational and technical safeguards, including:

• encryption;
• access controls;
• contractual restrictions;
• monitoring;
• security governance; and
• data minimisation.

14.5 Transparency

CVOR aims to provide Enterprise Customers with reasonable transparency regarding the jurisdictions in which relevant service providers process Personal Data.

15. Security of Personal Data

Protecting Personal Data is a fundamental component of the design, operation, and governance of the CVOR platform.

CVOR implements technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, and other forms of unlawful processing.

The measures implemented are designed having regard to the nature of the services provided, the sensitivity of the information processed, the risks presented by the processing, and applicable legal obligations.

15.1 Security by Design

Security considerations are incorporated throughout the lifecycle of the platform, including:

• system architecture;
• software development;
• infrastructure deployment;
• feature design;
• operational processes;
• supplier selection;
• change management; and
• ongoing maintenance.

Where appropriate, CVOR seeks to implement privacy and security controls at the earliest practical stage of product development.

15.2 Access Controls

Access to Personal Data is restricted according to operational requirements and authorised responsibilities.

Depending on the service, access controls may include:

• user authentication;
• role-based permissions;
• least privilege principles;
• privileged access controls;
• session management;
• multi-factor authentication;
• administrative approval processes; and
• periodic access reviews.

CVOR seeks to limit access to Personal Data to individuals who require it to perform authorised responsibilities.

15.3 Encryption and Data Protection

CVOR seeks to protect Personal Data during transmission and storage using appropriate technical safeguards.

Depending on the services provided, these safeguards may include:

• encrypted communications;
• encryption of stored data where appropriate;
• secure key management practices;
• integrity protection mechanisms; and
• secure backup processes.

Refer to the security & governance section

15.4 Monitoring and Audit

CVOR maintains monitoring and audit capabilities intended to:

• detect security events;
• investigate suspected misuse;
• support incident response;
• maintain operational accountability;
• investigate platform issues; and
• demonstrate compliance with applicable obligations.

Audit records are retained in accordance with operational and legal requirements.

15.5 Privileged Access

Administrative access to production systems containing Personal Data is restricted and governed through documented operational controls.

Where privileged access is required, CVOR seeks to ensure that such access is:

• authorised;
• limited to the required purpose;
• appropriately monitored;
• recorded where appropriate; and
• periodically reviewed.

15.6 Security Testing

CVOR periodically reviews and evaluates the effectiveness of its security measures.

Depending on operational requirements, this may include:

• vulnerability management;
• security reviews;
• infrastructure assessments;
• software testing;
• supplier assessments; and
• other assurance activities.

The nature and frequency of security assessments depend upon the services provided and the risks presented.

15.7 Incident Management

CVOR maintains processes intended to identify, investigate, manage, and respond to security incidents affecting the platform.

Where a Personal Data Breach occurs, CVOR will respond in accordance with applicable legal obligations, contractual commitments, and internal incident management procedures.

Where required by law, affected customers, regulators, or individuals will be notified.

15.8 Shared Responsibility

Security is a shared responsibility.

Enterprise Customers and Individual Users also play an important role by:

• protecting account credentials;
• enabling available security features;
• managing access permissions appropriately;
• maintaining accurate contact information;
• reviewing user permissions; and
• reporting suspected security issues promptly.

CVOR cannot prevent unauthorised disclosure resulting from credentials being shared, compromised, or otherwise misused outside the platform.

15.9 Continuous Improvement

Security threats evolve over time.

CVOR periodically reviews and improves its security controls, operational practices, supplier arrangements, and governance processes to maintain an appropriate level of protection for the services provided.

16. Data Retention and Deletion

CVOR retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, provide the requested services, comply with legal obligations, protect the security and integrity of the platform, resolve disputes, enforce contractual rights, or establish, exercise, or defend legal claims.

Retention periods vary depending on:

• the category of Personal Data;
• the services being used;
• whether CVOR is acting as a Controller or Processor;
• customer configuration;
• contractual commitments;
• legal and regulatory obligations; and
• operational or security requirements.

Where Personal Data is no longer required, CVOR seeks to securely delete, anonymise, or otherwise render the information irreversibly inaccessible in accordance with applicable legal requirements and operational processes.

16.1 Enterprise-Controlled Information

Enterprise Customers determine how long documents and other Enterprise-controlled Personal Data should be retained within their Organisation Workspace, subject to the functionality available within the platform.

Where CVOR acts as a Processor:

• the Enterprise Customer determines applicable retention requirements;
• CVOR processes retention and deletion instructions in accordance with the applicable agreement and platform capabilities; and
• deletion may be subject to technical, operational, backup, legal, or security constraints described in this Privacy Policy.

Where an Enterprise Customer terminates its use of the platform, deletion or return of Enterprise-controlled Personal Data will be governed by the applicable customer agreement and Data Processing Agreement.

16.2 Personal Vault Information

Documents stored within an Individual User’s Personal Vault are generally retained until:

• deleted by the Individual User;
• the account is closed;
• retention settings require deletion;
• applicable legal obligations require continued retention; or
• another lawful basis permits continued processing.

Deletion requested by an Individual User may not result in immediate removal from all systems where temporary retention is necessary for ongoing processing, platform security, disaster recovery, legal compliance, or legal claims.

16.3 Account Information

CVOR retains account information for as long as necessary to maintain active accounts, provide requested services, authenticate users, protect against fraud, administer subscriptions, resolve disputes, comply with legal obligations, and maintain platform security.

Following account closure, certain information may continue to be retained where necessary for these purposes.

16.4 Audit Records

CVOR maintains audit records to support security monitoring, operational accountability, customer reporting, incident investigation, regulatory compliance, fraud prevention, and platform governance.

Audit records may be retained independently of customer document retention where necessary to fulfil these purposes.

Where possible, audit records are designed to minimise unnecessary Personal Data while maintaining evidential value.

16.5 Security Logs

Security-related information may be retained for longer than operational records where necessary to investigate incidents, detect fraudulent activity, identify malicious behaviour, protect the platform, comply with legal obligations, or establish, exercise, or defend legal claims.

The categories of security information retained depend on the services provided and the risks being managed.

16.6 Support Records

Support enquiries and associated records may be retained to resolve ongoing issues, maintain service history, comply with contractual obligations, improve support operations, or establish, exercise, or defend legal claims.

Support records are periodically reviewed and retained only where continued retention remains appropriate.

16.7 AI Processing Records

Where AI-assisted functionality is used, certain operational information may be retained to provide the requested functionality, investigate technical issues, protect platform security, and comply with applicable contractual or legal obligations.

CVOR seeks to minimise retention of AI-related Personal Data where practical.

16.8 Backups and Disaster Recovery

To support business continuity and disaster recovery, CVOR maintains backup processes designed to protect against accidental loss or system failure.

Personal Data contained within backup systems may continue to exist for a limited period after deletion from active systems.

Backup data is not ordinarily restored except where necessary to recover from system failure, investigate significant incidents, maintain service continuity, or fulfil other legitimate operational purposes.

Where backup data is restored, CVOR seeks to ensure that applicable deletion requests continue to be honoured as part of the restoration process where appropriate.

16.9 Legal Holds

CVOR may suspend deletion where necessary to comply with applicable law, preserve evidence, respond to litigation, comply with regulatory investigations, establish, exercise, or defend legal claims, or comply with lawful instructions from competent authorities.

Where deletion is suspended due to a legal hold, the affected information will continue to be protected in accordance with this Privacy Policy.

16.10 Anonymisation

Where appropriate, CVOR may irreversibly anonymise information so that it can no longer reasonably be used to identify an individual.

Information that has been anonymised is no longer considered Personal Data under applicable data protection legislation and may be retained for purposes such as statistical reporting, service improvement, security analysis, operational planning, and product development.

CVOR seeks to ensure that anonymisation processes are designed to prevent reasonable re-identification of individuals.

16.11 Processor Deletion Obligations

Where CVOR acts as a Processor, deletion of Enterprise-controlled Personal Data is performed in accordance with:

• documented customer instructions;
• the applicable Data Processing Agreement;
• applicable contractual obligations; and
• applicable legal requirements.

CVOR may retain limited information independently where necessary to comply with legal obligations or protect the security and integrity of the platform.

16.12 Periodic Review

CVOR periodically reviews its retention practices to ensure that Personal Data is not retained longer than necessary for the purposes described in this Privacy Policy.

Retention schedules may be updated from time to time to reflect:

• changes to applicable law;
• operational requirements;
• platform functionality;
• customer requirements; and
• security considerations.

Where material changes affect how Personal Data is retained, this Privacy Policy will be updated accordingly.

17. Your Privacy Rights

Depending on your location and the applicable data protection legislation, you may have certain rights regarding the Personal Data processed about you.

The rights available depend upon:

• the applicable legislation;
• the role in which CVOR processes your Personal Data;
• the nature of the processing; and
• any legal exemptions that may apply.

17.1 Your Rights

Subject to applicable law, you may have the right to:

• request access to your Personal Data;
• request correction of inaccurate or incomplete Personal Data;
• request deletion of Personal Data;
• request restriction of processing;
• object to certain processing activities;
• request portability of Personal Data where applicable;
• withdraw consent where processing is based upon consent; and
• not be subject to certain solely automated decisions producing legal or similarly significant effects.

The availability of these rights depends upon the circumstances of the processing.

17.2 Enterprise-Controlled Information

Where Personal Data is processed on behalf of an Enterprise Customer, that Enterprise Customer is generally responsible for responding to requests relating to:

• access;
• correction;
• deletion;
• restriction;
• objection; and
• portability.

If CVOR receives such a request directly, we may:

• forward the request to the relevant Enterprise Customer;
• assist the Enterprise Customer where required by applicable law or contract; or
• respond directly where CVOR is responsible as a Controller.

17.3 Exercising Your Rights

Requests relating to Personal Data may be submitted using the contact details provided at the end of this Privacy Policy.

To protect Personal Data, CVOR may request additional information to verify the identity of the individual making the request before responding.

Verification procedures are designed to reduce the risk of unauthorised disclosure.

17.4 Response Times

CVOR aims to respond to privacy requests within the timeframes required by applicable law.

Where requests are particularly complex or numerous, the response period may be extended where permitted by law.

Where an extension is necessary, we will explain the reasons where required.

17.5 Complaints

If you believe your Personal Data has been processed in a manner that does not comply with applicable law, we encourage you to contact us first so that we have an opportunity to investigate and resolve the matter.

You also have the right to lodge a complaint with the competent supervisory authority in the jurisdiction applicable to your circumstances.

18. Cookies and Similar Technologies

The CVOR website and certain platform services may use cookies and similar technologies to:

• provide essential functionality;
• maintain secure sessions;
• remember user preferences;
• improve website performance;
• analyse service usage where applicable; and
• support security measures.

Where required by applicable law, CVOR will request consent before placing non-essential cookies or similar technologies on your device.

Individuals may also manage certain cookie preferences through browser settings or other mechanisms provided by the platform.

19. Mobile Applications and Device Processing

This section applies where you use a CVOR Mobile Application, including CVOR Guard where available. It highlights mobile-specific processing that may occur on your device, through the app, through the relevant app store, or through mobile diagnostic services.

19.1 Mobile Applications

CVOR Mobile Applications may provide document utilities, watermarking, PDF or image tools, job matching, local vault-style functionality, sharing tools, authentication features, service notifications, and related app functionality.

Some mobile features are designed to process user-selected content locally on the device where possible. Other features may involve CVOR platform services, app store services, diagnostic providers, or third-party services that the user chooses to use or connect.

19.2 Local Device Processing

Documents, images, file names, labels, watermark text, recipient references, app settings, locally generated outputs, and similar content may be processed locally on your device.

CVOR does not intentionally receive or store locally processed mobile documents unless you choose to share, upload, export, synchronise, or connect that content through a CVOR service or a third-party service.

Once content leaves your device through sharing, export, upload, messaging, cloud storage, or another third-party service, the recipient or service provider may process it under its own terms and privacy notice.

19.3 Device Permissions

Mobile Applications may request device permissions needed to provide app functionality. Depending on the features used, these may include access to camera, photos, files, local storage, notifications, biometric or device authentication, and network connectivity.

Device permissions are controlled by your device operating system. You can usually grant, deny, or withdraw permissions through your device settings, although some app features may not work without the relevant permission.

19.4 Mobile Technical Data and Crash Diagnostics

CVOR may use mobile diagnostic services, such as Firebase Crashlytics or Google Analytics for Firebase where configured, to understand app stability, diagnose crashes, and improve performance.

Mobile diagnostics may include crash logs, app version, device type or model, operating system version, performance events, error metadata, and aggregated app stability information. Diagnostic processing is not intended to collect document contents.

Where analytics or diagnostics tools are configured for the Mobile Application, CVOR does not authorise them for behavioural advertising or cross-app profiling. Specific provider processing is governed by the relevant provider’s terms and privacy documentation.

19.5 Push Notifications

Where enabled, Mobile Applications may use push notifications for service, account, workflow, security, app-status, or similar operational messages.

Push notification delivery may involve your device operating system, Apple, Google, and related mobile platform services. You can usually manage notification permissions through your device or app settings.

19.6 Mobile Authentication and Connected Services

Mobile Applications may support account login, session management, device-level authentication, biometric or passcode-based device controls where enabled by the operating system, and optional third-party sign-in such as Google OAuth where supported.

Where you connect a third-party service, authentication and data exchange may occur directly between your device and that service. CVOR does not control the privacy practices of third-party services you choose to connect, and those services are governed by their own terms and privacy notices.

19.7 Local Caching and Storage

Mobile Applications may store local settings, cached files, session state, entitlement indicators, OAuth or authentication material, notification preferences, and other app data needed to operate the mobile app.

Uninstalling the app or clearing app data may remove local app data from your device, subject to the behaviour of your operating system, app store account, backups, and any third-party services you have used. Data already shared, uploaded, exported, or stored with third parties may need to be managed through those services.

19.8 App Store Billing

Where purchases or subscriptions are made through Apple App Store, Google Play, or another app store, billing and payment information is processed by the relevant app-store provider.

CVOR does not intentionally store full payment credentials processed by app-store providers. CVOR may receive or maintain limited entitlement, subscription, purchase-status, or receipt-related information needed to enable purchased features, prevent abuse, manage support, or comply with legal and accounting obligations.

Further information is provided in the Billing and Commercial Information section of this Privacy Policy.

19.9 Third-Party Components

Mobile Applications may include third-party SDKs, platform services, and open-source libraries used for app functionality, diagnostics, authentication, billing, storage, notifications, or integration with operating-system features.

Further information about service providers and subprocessors is provided in the Service Providers and Subprocessors section of this Privacy Policy. Open-source components are governed by their applicable licences.

20. Children’s Privacy

CVOR’s services are not directed toward children and are intended for use by individuals who are legally able to use the services or who are authorised to do so by an Enterprise Customer.

CVOR does not knowingly collect Personal Data directly from children where prohibited by applicable law.

If CVOR becomes aware that Personal Data has been collected in circumstances that require deletion under applicable law, we will take reasonable steps to investigate and, where appropriate, delete the relevant information.

Parents, guardians, or other individuals with concerns regarding Personal Data relating to a child may contact CVOR using the contact details provided in this Privacy Policy.

21. Changes to this Privacy Policy

CVOR may update this Privacy Policy from time to time to reflect:

• changes to our services;
• changes to applicable law;
• new functionality;
• changes to service providers;
• operational improvements; or
• changes to our privacy practices.

Where changes materially affect how Personal Data is processed, CVOR will provide appropriate notice where required by applicable law.

The “Last Updated” date at the beginning of this Privacy Policy identifies the most recent revision.

Where appropriate, previous versions may be retained for reference.

22. Contact Us

Questions, requests, or concerns relating to this Privacy Policy or the processing of Personal Data may be directed to CVOR.

Registered Address – 128 City Road, London, EC1V 2NX

Contact email – support@cvor.io

Data Protection Officer Details:

Contact Person – Data Protection Officer

Contact Email – privacy@cvor.io

Individuals also have the right to contact the competent supervisory authority in their jurisdiction where they believe applicable data protection legislation has not been complied with.

Appendix A – Processing Context Summary