Privacy Policy

Welcome to our privacy notice and thank you for taking the time to read it. We hope it provides you with the information you are looking for, but if you need more, please reach out to us at info@provulo.com.

We understand how important privacy and the security of your personal data are to you. They are important to us too. We adopt a privacy by design approach in everything we do. This means we develop our business strategies, products, services, websites and applications with your privacy in mind.

This privacy notice aims to give you useful information about how we process your personal data. This privacy notice applies to you if you are:

a visitor to any of our websites;
a customer who has ordered or requested a product or service that we provide (including in the context of a trial);
an end-user of our products or services (including in the context of a trial);
an employee, customer, or supplier of our customers, where our customers use our products or services;
a vendor or the employee of a vendor that provides services to us; or
an individual whose personal data has been collected by us in line with Section 3 below, including for marketing purposes (“Prospects”).

Depending on where you are located, additional regional content may apply to you. Please consult Section 13 below to find supplemental information describing how we process personal data in your region.

We may update this privacy notice from time to time and will publish revised versions on our Website.

How to navigate this notice

Whilst we encourage you to read all of this privacy notice, we appreciate you may find some content more relevant to you. For easier navigation, we have split this privacy notice into sections. You can expand any section by clicking on it; that way, you can quickly find and explore the areas that are of most interest to you.

1. Definitions

There are some terms we use in this privacy notice to be concise, and this is what they mean :

Solutions means our software products, features, services, and applications, including in the context of a trial.

Websites means pdfx.co.uk, any linked pages and any other website controlled by provulo.

You or your means you (the person reading this) or the individual whose personal data is processed by us.

We, us, our, or provulo means provulo limited and its affiliate companies.

2. Our Data Protection process and how to contact us

For any privacy related requests contact us using the contact details provided in Section 13. If in doubt, please contact info@provulo.com.

provulo is registered with the Information Commissioner's Office in the United Kingdom, with registration number ZB452328.

We are committed to protecting your personal data and complying with data protection laws. We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration, disclosure or access. We are also committed to ensuring that your personal data is accurate and up to date. Please help us to achieve this by informing us of any changes to your personal data.

3. Are you providing us with personal data about someone else?

If you provide us with personal data about someone else, you are responsible for ensuring that you are permitted to share that personal data and comply with any applicable legal obligation. This may include explaining to that individual why you are collecting their personal data and what you are doing with it and obtaining their consent if relevant under applicable law. We also recommend that you direct them to read this privacy notice.

4. When do we collect personal data?

To the extent permitted under applicable law, we may collect personal data about you and any other individual either directly or indirectly, if that data is provided to us by another party.

We collect your personal data when :
You interact with us directly	This can be through our Websites, Solutions, forms (including where you only complete them partially, in which case we may use your personal data to contact you to remind you to complete any outstanding information and/or for marketing purposes), surveys, competitions, use social media, or contact us by phone, email, chatbots, fax or post.
You use our Websites and Solutions	We may collect your personal data using cookies or similar technologies (as described in our Cookie Policy).
You or your organisation provide(s) services to us	In this context, we may collect basic personal data about you (mainly professional contact details).
Third parties provide us with personal data about you	This can happen where : we work with a business partner that has an existing relationship with you ; someone who uses our Solutions, or has interacted with us in another way, has given your personal data to us in line with Section 3 above ; you use our Solutions, including services and features incorporated into those Solutions, which may require us to obtain your personal data from a third party from whom you have instructed us to obtain it ; you are an employee of a customer of ours, and your employer provides us with your contact details or other personal data in connection with your use of our Solutions ; personal data is provided to us by government agencies or credit reporting agencies ; personal data is provided to us by marketing / lead-generation companies, or information service providers (“Prospect data”) ; or you have a social media account, and that social media company provides us with access to certain personal data for marketing purposes.
In the context of corporate acquisitions	For example, where we acquire a business that had an existing relationship with you.
You participate in events organised by us	This happens where you attend seminars, learning, training or other events organised by provulo virtually or in person, or where you attend our premises for an event.

5. What personal data do we collect?

We collect the following categories of personal data :

Contact Information : name, address (business or personal), email address (business or personal), phone number (business or personal) ;
Billing and payment information : payment details, including amounts, frequency, date and time, location, the individual or business making or receiving the payment, transaction history, bank details, business accounts and taxation data, authorised user details, identification details or documents ;
Online usage, metadata and web information : information on the services you viewed and searched for, response times, errors, duration of access ; visit and page interaction (such as scrolling clicks and hovering the mouse over content), username, IP address, browsing time and history, passwords and logging data, device type, time zone, browser plug-in types and versions, social media profile photo or profile information, web log information, device identification number, device type, location information, connection information, operating system and platform ;
Communication preferences : marketing preferences, areas of interest, preferred contact method and details, correspondence relating to marketing, consent records, business information, such as name and number of employees ;
Organisation details: place of work, job title and organisation contact information ;
Physical access data : details of your visit to our premises, CCTV moving or still images and recordings, car registration data, event registration data, dietary requirements, access requirements ; images taken when attending provlu events ;
Voice and video recordings : where you contact us and speak to us, such as by telephone, video call, or other verbal communication platform.
Correspondence : where you contact us for any reason (for example, requests for technical or operational support, where you have a question, or where you exercise your data protection rights), we will collect personal data contained in this correspondence ;

6. Why do we process personal data?

This section describes the purposes for which provulo processes your personal data and the corresponding lawful basis for that processing.

The lawful basis is our legal justification to process your data for the purposes of data privacy laws applicable in the European Economic Area (“EEA”), the United Kingdom and South Africa. The “Lawful basis” column below is not relevant to you if you are located outside these regions.

A. To deliver our Solutions

Purpose	Category of individual	Lawful basis
Establishing you as a customer on our systems, providing you with any information or Solutions that you have requested or purchased and sending you updates or service-related communications about these Solutions.	Customers and/or their main contacts, Solutions and Websites users	Performance of our contract with you or our legitimate interests
Managing and administering your account, your billing and payments, and our relationship with you (for example, customer service and support activity, including troubleshooting or managing complaints).	Customers and/or their main contacts, Solutions and Websites users	Performance of our contract with you or our legitimate interests
	Customers and/or their main contacts, Solutions and Websites users	Performance of our contract with you or our legitimate interests relating to providing you with services
Create and administer your provulo/pdfx ID. If you create a provulo/pdfx ID to access our Solutions, it is attached and relates to you. If you use it to access your provulo/pdfx Solution, it will exist regardless of that Solution, and you may be able to use it with another of our Solutions. You will create your username which will be an email address of your choice. Data collected using your provulo/pdfx IDis used for audit, access, service improvement, and support purposes, but it is not available for any marketing, surveys or other outreach to you.	Customers and/or their main contact, Solutions users	Our legitimate interest relating to providing a service

B. To improve our Solutions and their security

Purpose	Category of individual	Lawful basis
Monitoring, measuring, improving, and protecting our content, Websites, Solutions, and providing you with an enhanced, personalised user experience.	Customers, Solutions and Websites users	Consent (if using cookies) or our legitimate interests
Undertaking internal testing of our Website, Solutions, systems and associated services to test and improve their security, provision and performance.	Customers, Solutions and Websites users	Our legitimate interests
Carry out research and development activities to improve our Solutions (including by seeking and obtaining your feedback) .	Customers and/or their main contacts, their vendors and customers (or their main contacts) Solutions and Websites users	Our legitimate interests
Carry out research and development activities to design and develop new Solutions.	Customers and/or their main contacts, their vendors and customers (or their main contacts) Solutions and Websites users	Our legitimate interests
Monitoring and carrying out statistical analysis and benchmarking regarding the use of our Websites, platforms, and Solutions, as permitted by applicable law. See section 7 “Profiling and automated decision making” below for more information.	Customers, Solutions and Websites users	Consent (if using cookies) or our legitimate interests
Maintaining, checking, and improving the security and integrity of our Websites, Solutions, systems, platforms, and communications (and detecting and preventing actual or potential threats to the same).	Customers, Solutions and Websites users	Our legitimate interests or our legal obligations

C. To communicate with you or provide marketing

Purpose	Category of individual	Lawful basis
Conducting surveys for customer research, benchmarking, improvement and marketing purposes, which may involve us sharing your personal data with trusted third parties who assist us with these activities.	Customers, Solutions and Websites users, Prospects	Consent (if for marketing purposes) or our legitimate interests
Providing you with any information as required to comply with our legal or regulatory obligations.	Customers and/or their main contact vendors/partners and/or their main contacts	Legal obligation
Sending newsletters to you.	Customers and/or their main contacts, Solutions and Websites users, Prospects	Our legitimate interests if you have requested the newsletter or your consent if not
Posting testimonials or reviews in relation to our Solutions which you have supplied to us.	Customers and/or their main contact, Solutions users	Consent
Sending you electronic direct marketing communications, analysing how you engage with our electronic marketing communications (including whether you open them and click through to access their contents).	Customers and/or their main contacts, Prospects, Solutions and Websites users	Consent
Organising and managing events or contacting you if you have attended a provulo event or an event partnered by provulo. We may share personal data about your attendance with trusted third parties. We, or a trusted third party, may also contact you after an event to get some feedback about the event to help us improve our future events.	Customers and/or their main contact, Prospects Solutions and Websites users	Consent or contract
Delivering joint content and services with third parties with which you have a separate relationship, for example, social media providers including LinkedIn or Instagram.	Customers and/or their main contact, Prospects Solutions and Websites users	Consent or our legitimate interests
Monitoring and carrying out statistical analysis and benchmarking regarding the use of our Websites, platforms, and Solutions, as permitted by applicable law. See section 7 “Profiling and automated decision making” below for more information.	Customers, Solutions and Websites users	Consent (if using cookies) or our legitimate interests

More information on our marketing activities

We may use your personal data to contact you with details about our business, our Solutions or other offers which we feel may be of interest to you or which you have asked for. We may also share your personal data with other companies in our Group and carefully selected third parties so that they (or we) may contact you with information about their products or services which we feel may be of interest to you. We or they may wish to contact you for this purpose by telephone, within a Solution, by post, SMS message or email, or other communication platform.

We will only contact you by email or SMS message in line with your marketing preferences. You can unsubscribe from email marketing using the links provided in the emails we send to you.

D. To operate our business

Purpose	Category of individual	Lawful basis
Performing due diligence reviews.	Customers and/or their main contacts, vendors/partners and/or their main contacts	Our legitimate interests or legal obligation
Detecting, preventing, investigating, reporting, or remediating any criminal, illegal or prohibited activities (including fraud and money laundering), or to otherwise protect our legal rights (including liaison with official bodies, regulators, and law enforcement agencies for these purposes).	Customers, Solutions and Websites users, vendors/partners and/or their main contacts	Our legitimate interests
Obtaining legal or other professional advice and establishing, defending, and enforcing our legal rights and obligations in connection with, any legal proceedings (including prospective legal proceedings).	Customers and/or their main contacts, vendors/ partners and/or their main contacts	Our legitimate interests
Managing, planning, and delivering our global business and marketing strategies (including collating management information and recording and reporting on our business development activities).	Customers, Solutions and Websites users	Our legitimate interests
Purchasing, maintaining, and claiming against our insurance policies.	Customers and/or their main contact, vendors partners and/or their main contacts	Our legitimate interests
Training our staff, supporting their learning, development, and performance.	Customers and/or their main contacts, vendors/partners and/or their main contacts	Our legitimate interests
Managing any proposed sale, purchase, restructuring, transfer or merging of any or all part(s) of our business or another business, including to respond to queries from the prospective buyer or merging organisation.	Customers and/or their main contacts, vendors/partners and/or their main contacts	Our legitimate interests
Managing, publicising, and participating in corporate social responsibility and Environmental Social and Governance (ESG) initiatives. For example, we may anonymise and/or aggregate your personal data to create reports or dashboards and share those with trusted third parties or on our Websites, to raise awareness on topics that are important to us, such as supporting the growth of small and medium businesses.	Customers and/or their main contacts, vendors/partners and/or their main contacts	Our legitimate interests
Comparing information for accuracy, to categorise it, and to verify it with our systems or third parties.	Customers, Solutions and Websites users	Our legitimate interests or legal obligation
Complying with any of our legal or regulatory obligations (including our responsibilities under codes of conduct and anti-bribery laws).	Customers and/or their main contacts, Solutions and Websites users, vendors/partners and/or their main contacts	Legal obligation
Complying with instructions, orders and requests from law enforcement agencies, regulatory bodies, supervisory authorities, any court or otherwise as required by law.	Customers and/or their main contacts, Solutions and Websites users, vendors/partners and/or their main contacts	Legal obligation
Monitoring and recording communications with you, including e-mails, webchats and phone and other voice or video conversations (after informing you of the monitoring and/or recording during that call and before the recording starts), for training purposes.	Customers and/or their main contacts, Solutions users	Consent
Protecting our assets, our customers, and their assets, and protecting our employees and other workers from unacceptable behaviour, fraudulent or other harmful communications or actions by using CCTV video surveillance, monitoring and recording in or around our premises.	Customers and/or their main contacts, vendors/partners and/or their main contacts	Our legitimate Interests
Enhancing personal data we collect from you with data we obtain from third parties that are entitled to share that data ; for example, data from credit agencies, search information providers or public sources (e.g., for customer due diligence purposes, or to improve accuracy of our records), but in each case as permitted by applicable law. We may also enhance personal data we collect from you with data which we already hold about you in our systems through your use of our Solutions or other interactions with us (including as a free trial) or by combining data where you use a multiple Solutions.	Customers and/or their main contacts, their vendors and customers (or their main contacts) Solutions and Websites users, vendors/partners and/or their main contacts	Our legitimate Interests

E. To carry out analytics and digital advertising

Purpose	Category of individual	Lawful basis
Delivering targeted advertising and marketing campaigns (which may include in-Solution messaging) or sharing information with which may be useful to you, based on your use of our Website, Solutions, or any other data we hold about you.	Customers and/or their main contacts, Solutions and Websites users	Consent or our legitimate interests
Providing you with location-based services, for example, targeted advertising and other personalised content, where we collect geo-location data.	Customers and/or their main contacts, Solutions and Websites users	Consent
Ensuring our advertisements match the potential interest of users, tracking the efficiency of ads and optimising the effectiveness of our campaigns. We use Conversion APIs provided by a 3rd party to do so. An API is a software intermediary allowing two applications to talk to each other, when using a conversion API, we allow our server to communicate with these third-party servers. Where you consent to “Targeting technologies” on our website, we collect information about your usage of our website from our server logs and share this information with these third parties for the abovementioned purposes. We also share what we call “offline” data, which is information we collected from our interactions with you that took place outside of our website and can help us understanding your entire experience with provulo. This data includes your hashed contact details, as well as information about your organisation and information about your interactions with provulo (e.g. whether you are interested in a product, which product it is, how interested you are).	Website users	Consent

7. Profiling and automated decision making

Profiling

Profiling activities consist of using personal data of individuals to predict their interests and likely behaviours. This is usually carried out using behavioural information and, amongst other uses, helps us to inform our decisions about marketing audiences. This allows us to send the right message to the right audience.

We may use personal data generated when you use our Solutions and Websites to improve them, and give you the best service and experience. This means that we may use personal data (including data collected using cookies and similar technologies) to evaluate and predict your personal preferences and interests. Please note that this is subject to your consent where required by applicable law.

We may conduct profiling activities to :

support you and personalise the communications we send in relation to our Solutions where permitted by applicable law and in line with your preferences ;
deliver advertising, marketing (including in-Solution messaging) or information which may be useful to you, based on your use of Solutions (considering your preferences as required) ; and
provide you with location-based services (for example location relevant content) where we collect geo-location data.

Please be aware that, in connection with the purposes above, we may use the personal data of your customers, suppliers, employees, and other individuals, whose personal data you input into our Websites or Solutions.

Automated decision-making

We do not conduct any automated decision-making with a significant or legal effect, or otherwise, about you or any individuals.

8. How long do we keep personal data for?

We retain personal data about you during and after termination of your relationship with us. This data is held and used for as long as permitted for legal, regulatory, fraud prevention and legitimate business purposes, in accordance with our internal provulo policies. For more information on the retention of personal data, please contact us at info@provulo.com

9. How is personal data shared?

Sometimes we may need to share your personal data with third parties. This will usually be because you have asked us to, we are required to by law, or because a third party integrates with our Solution or provides us or you with a service. You will find in the table below a list of third parties with which we may share your personal data and why.

Third parties	Reason
Our service providers and agents (including their sub-contractors) or third parties which process personal data on our behalf (e.g., internet service, cloud storage and platform providers, payment processing providers and those organisations we engage to help us send communications to you) ; third parties with which you request that we share personal data with for your own or their purposes.	Helping us to provide you with the Solutions and information you have requested or which we believe is of interest to you.
Partners, including system implementers, resellers, value-added resellers, independent software vendors and developers.	Allowing partners to provide you the Solutions, services, and information you have requested or which they believe is of interest to you.
Another company within our Group.	Helping us to provide you with the Solutions and information you have requested or which we believe is of interest to you, or in the context of a restructuring.
Third parties used to facilitate payment transactions, for example clearing houses, clearing systems, financial institutions, and transaction beneficiaries.	Helping us to ensure payment for Solutions.
Other parties who may also be controllers of the data we share with them, for example, academic or research organisations.	Research necessary for our own or another organisation’s legitimate interests (e.g., to deliver valuable insights to our customers or enable us to improve the service we offer you). In these circumstances, we will take additional steps to protect your personal data, for example pseudonymisation, or anonymisation and aggregation prior to sharing the data, to protect your privacy and the confidentiality of your data.
Third parties where you have a relationship with that third party, such as social media providers, partners, and other third parties with which we work and whose products or services we think will interest you in the operation of your business activities.	Marketing and targeting purposes.
Credit reference and fraud prevention agencies ; government bodies and departments, regulators and any other third party necessary to meet your or our legal, regulatory, and reporting obligations ; law enforcement agencies so that they may detect or prevent crime including fraud or prosecute offenders including statutory or regulatory reporting or the detection or prevention of unlawful acts ; any third party in the context of actual or threatened legal proceedings ; professional advisors and auditors for the purpose of seeking professional advice or to meet our audit responsibilities.	To comply with applicable laws and regulations and to protect our business.
Another organisation if we sell or buy (or negotiate to sell or buy) any business or assets, another organisation to whom we may transfer our agreement with you.	In the context of an acquisition, sale or restructure.

10. Do we use cookies and similar technologies?

More information can be found in our specific cookie policies relating to Websites and Solutions, but it is worth mentioning here that our Website and Solutions may contain technology that enables us to :

check specific information from your device or systems directly relevant to your use of our Websites and Solutions against our records to make sure they are being used in accordance with our agreements and to troubleshoot any problems you may be experiencing ;
obtain information relating to any technical errors or other issues with our Website, and Solutions ;
comply with our legal or regulatory obligations ;
collect information about how you use the functions and features of our Website and Solutions ; and
gather statistical information about the operating system and environment from which you access our Solutions including web traffic data.

The cookie policy for the pdfx.co.uk website can be found here.

If you follow a link which takes you away from our Website or Solutions, our privacy notice does not apply when you arrive at your new online destination, and we are not responsible for the handling of your personal data after you have left our Website or Solution. Please read the privacy information of the third party responsible for the new online location which you have linked to.

11. What data privacy rights do you have?

Data privacy rights differ from one region to another. Please consult the relevant part of Section 13 below dealing with data privacy rights to obtain more information on your local rights.

12. How is your personal data kept secure?

We will keep your personal data secure by applying appropriate technical and organisational measures against its unauthorised or unlawful access or use and against its accidental loss, destruction, or damage.

We will do our best to protect your personal data, but we cannot guarantee the security of your personal data while it is being transmitted to our Website or Solutions or to other websites, applications and services via an internet or similar connection. If we have given you (or you have chosen) a password to access certain areas of our Websites or Solutions, please keep this password safe, and when choosing your own password please ensure it is strong and do not use variations of previously used passwords, and with all passwords, do not write them down or leave them accessible to unauthorised persons.

If you believe your personal data has been compromised in connection with your use of a provulo Solutions or Websites or otherwise in connection with provulo, please contact us at info@provulo.com.

13. If you are based in the United Kingdom or the Republic of Ireland

Key data protection laws

The key data protection laws in the United Kingdom are the UK General Data Protection Regulation (“UK GDPR”), UK Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.

The key data protection laws in the Republic of Ireland are the General Data Protection Regulation, the Data Protection Act 2018 and the S.I. No. 336/2011 - European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011.

Controllers and processors

This privacy notice describes our processing of your personal data in our capacity as a “data controller” under applicable law in the UK and the Republic of Ireland. A data controller decides how and why your personal data is processed.

Where we process personal data on behalf of another individual, for example our customers, partners, or other parties, we do not decide how and why to process that personal data. In those instances, we are a “data processor” under applicable law rather than a data controller. Where we are a data processor of your personal data, we use it in accordance with the data controller’s instructions to us.

If we are a data processor of your personal data, then you should also read the relevant data controller’s privacy notice. Make sure that you familiarise yourself with the privacy notice of your own employer, accountant, business, or other organisation that you have a direct relationship with, and which may share your personal data with provulo.

European Union representative

European Union (“EU”) data protection laws require non-EU organisations to have a representative in the EU. The role of the EU representative is to be the point of contact for individuals and authorities for all EU member states.

provulo does not do business with any entities in the European Union, and therefore does not have an EU representative.

Your data protection rights

If you are based within the UK or the Republic of Ireland, you have the following data protection rights :

the right to be informed about the processing of your personal data ;
the right to obtain access to your personal data ;
the right to have your personal data rectified or erased, or to place restrictions on processing your personal data ;
the right to object to the processing of your personal data e.g., for direct marketing purposes or where the processing is based on our legitimate interests ;
the right to have any personal data you provided to us electronically returned to you in a structured, commonly used and machine-readable format, or sent directly to another company, where technically feasible (this is known as ‘data portability’) ;
where the processing of your personal data is based on your consent, the right to withdraw that consent subject to legal or contractual restrictions ;
the right to object to any decisions based solely on the automated processing of your personal data, including profiling ; and
the right to lodge a complaint with the data protection supervisory authority responsible for data protection matters in your location. For the UK, this is the Information Commissioner’s Office (ICO). For the Republic of Ireland, this is the Data Protection Commissioner (DPC).

Please note that in some circumstances the exercise of the above rights may be limited by legal restrictions and exemptions. If relevant, we will explain this when responding to a request to exercise data protection rights.

If you think we hold any personal data about you which is incorrect or if there are any changes to your personal data, please let us know so that we can keep our records accurate and up to date.

If you wish to exercise your data protection rights as an individual, please contact us at info@provulo.com.

If you do not want us to use your personal data for purposes set out in our privacy notice, we may not be able to provide you with access to all or parts of our Website or Solutions.

International transfer of personal data

Personal data in EU member states and the UK is protected by data protection laws, but other countries do not necessarily protect your personal data in the same way. You can find a list of countries that the European Commission considers provide an equivalent level of data protection to that which exists within the European Economic Area (EEA) (“Adequate countries”) here.

Our Website and some of our Solutions, or parts of them, may be hosted outside the EEA or UK, which means that we may transfer personal data to third countries which do not have an EU or UK adequacy determination in some circumstances. In addition, we may use service providers located outside the EEA or UK to help us provide our Websites, Solutions or other services to you and this means that we may transfer your personal data to these regions.

We take steps to ensure that where your personal data is transferred outside of the EEA or the UK, appropriate measures and controls are in place to protect that data in accordance with applicable data protection laws. provulo has an internal Personal Data Protection governance policy and related procedures designed to protect personal data in accordance with EU, EU member state and UK data protection laws. In each case, such transfers are made in accordance with applicable data protection laws and may be based on the use of (i) the European Commission’s Standard Contractual Clauses for transfers of personal data outside the EEA, or (ii) the UK’s International Data Transfer Agreement and/or the European Commission’s Standard Contractual Clauses and/or the UK Addendum for transfers of personal data outside the UK.

For more information on international transfer of personal data, please contact info@provulo.com.

How can you contact us ?

If you have any question about this privacy notice, or wish to exercise your data privacy rights as an individual, you can contact us by sending an email to info@provulo.com or by postal mail at Provulo Limited, The Old School House West Street, Southwick, Fareham, Hampshire, United Kingdom, PO17 6EA.