Privacy notice

Who we are

Strovia is a product of Aptech Consultants Limited, company number 06294236, [registered address] (“we”, “us”). We are the controller of the personal data described in this notice. Contact us about privacy at [email protected].

This notice covers the Strovia website and its free demo tools. When a customer uses the Strovia platform, the customer decides what data is processed and we act as its processor under a data processing agreement; that agreement, not this notice, governs those data.

On the Strovia platform, message content (the files a customer uploads and the messages Strovia creates, sends or receives) is kept only until the job that uses it is finished, and never longer than 48 hours. It is then deleted. Only the job’s metadata stays as an audit record: IDs, SHA-256 checksums, sizes and the step trail. Customers can choose a shorter period, keep content in their own cloud storage, or run Strovia themselves.

What we collect

• When you contact us. The contact form does not send anything to a server: it opens an email in your own email program, addressed to us. If you send it, we receive what you entered (name, organisation, work email, role, the messages and scheme types you selected, and your message) and anything else you write.
• When you visit the website. Our hosting provider processes technical data needed to deliver and protect the site, such as your IP address, browser type and the pages requested, in its server logs. We do not use analytics, advertising or tracking tools, and we do not set cookies. Your answer to the cookie question is remembered in your own browser only (see Cookies).
• When you use the free validator. The file you check (or the sample you pick) is sent to our server in the EU, checked there, and deleted as soon as the result is sent back to you. It is held in memory only, never stored, and never written to our logs. To limit use to 20 checks an hour, your IP address is counted in memory for at most one hour and then forgotten; it is not logged. The log records only the time, the file’s size, whether it was valid and how many findings there were.

We do not need, and ask you not to send, data about individual pension scheme members. VB-PUO messages carry scheme- and cohort-level figures.

Why we use it, and on what basis

We do not use your data for automated decision-making or profiling, and we do not sell it.

Who we share it with

• Service providers acting for us: our website host (Render, which serves the site from a global content delivery network) and our email provider [name of email provider]. They may only use the data to provide their service to us.
• Professional advisers, such as lawyers and accountants, where needed.
• Authorities, where the law requires it.

We do not share your data for anyone else’s marketing.

International transfers

Some providers may process data outside the UK and the European Economic Area, for example in the United States. Where they do, the transfer is covered by UK or EU adequacy decisions or by appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

How long we keep it

• Enquiries and related correspondence: up to [24 months] after our last contact, unless we enter into a contract, in which case the contract’s retention terms apply.
• Server logs at our host: for the period set by the host [to confirm].

How we protect it

The website is served only over encrypted connections (HTTPS), with a strict security policy that blocks third-party scripts. Access to our mailbox and systems is limited to the people who need it [and protected with multi-factor authentication: to confirm].

Your rights

You can ask us for access to your personal data, and to correct, delete or restrict it, to object to how we use it, or to receive it in a portable format. Email [email protected]; we reply within one month.

You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or, if you are in the EU, to your local data protection authority, such as the Autoriteit Persoonsgegevens in the Netherlands. We would appreciate the chance to resolve your concern first.

Changes to this notice

We update this notice when our practices change and show the date at the top. Significant changes are announced on the website.