Effective date: 28 July 2026
1. ABOUT THIS PRIVACY NOTICE
This Privacy Notice explains how INNAVISTA LTD collects, uses, stores and protects personal data when you:
• visit innavista.com (the “Site”);
• contact us through the Site, by email or by telephone;
• enquire about our services;
• communicate or otherwise interact with us in a business context.
This Notice also explains your rights under applicable data protection law.
We process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations 2003 (“PECR”).
2. WHO WE ARE
INNAVISTA LTD is the controller responsible for the personal data described in this Privacy Notice.
Company: INNAVISTA LTD
Company number: 17318687
Registered in: England and Wales
Registered office: 66 Paul Street, London, England, EC2A 4NA
Email: hello@innavista.com
Website: https://innavista.com
References in this Notice to “Innavista”, “we”, “us” or “our” mean INNAVISTA LTD.
3. PERSONAL DATA WE COLLECT
The personal data we collect depends on how you interact with us.
3.1 INFORMATION YOU PROVIDE DIRECTLY
When you complete a contact or enquiry form, contact us by email or telephone, or otherwise communicate with us, we may collect:
• your full name;
• your work email address;
• your telephone number, if provided;
• your company or organisation name;
• your job title or professional role, if provided;
• the service you are interested in;
• information about your project, business requirements or proposed engagement;
• the contents of your correspondence with us;
• any other information you choose to provide.
Please do not provide special category data, such as information about health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or information about sexual orientation, unless it is strictly necessary and we have expressly requested it.
3.2 INFORMATION COLLECTED AUTOMATICALLY
When you visit the Site, certain technical information may be collected automatically, including:
• IP address;
• browser type and version;
• device type and operating system;
• general location derived from the IP address;
• pages visited and actions taken on the Site;
• referring website or source;
• date and time of access;
• cookie and consent preferences;
• technical, security and diagnostic information.
Some of this information is necessary to deliver the Site securely. Optional analytics information is collected only where you have provided the required consent.
3.3 INFORMATION FROM BUSINESS CONTACTS
If you communicate with us on behalf of a company or organisation, we may process your business contact details and information about your role, authority and relationship with that organisation.
3.4 INFORMATION FROM THIRD PARTIES
We may receive limited personal data from:
• the company or organisation you represent;
• professional advisers or business partners involved in an engagement;
• publicly available professional sources, such as company websites or professional directories;
• service providers supporting the security and operation of the Site.
We do not purchase consumer marketing databases.
4. HOW AND WHY WE USE PERSONAL DATA
We use personal data only where we have a lawful basis for doing so.
4.1 RESPONDING TO ENQUIRIES
We use your contact details and enquiry information to:
• respond to your questions;
• understand your requirements;
• arrange an initial consultation;
• prepare a proposal, quotation or scope of work;
• communicate about a potential engagement.
Our lawful basis is taking steps at your request before entering into a contract and, where you are acting on behalf of an organisation, our legitimate interest in responding to business enquiries and developing professional relationships.
4.2 PROVIDING AND MANAGING SERVICES
Where an enquiry develops into a business relationship, we may use personal data to:
• provide agreed services;
• manage projects and deliverables;
• communicate with clients, representatives and contractors;
• administer contracts, invoices and payments;
• provide maintenance or support;
• manage the business relationship.
Our lawful basis is performance of a contract, taking steps before entering into a contract, compliance with legal obligations and our legitimate interests in managing our services and business relationships.
4.3 OPERATING AND SECURING THE SITE
We may process technical information to:
• provide and maintain the Site;
• protect the Site, our systems and users;
• prevent spam, fraud, misuse and unauthorised access;
• investigate technical or security incidents;
• diagnose faults and improve reliability.
Our lawful basis is our legitimate interest in operating a secure and reliable website and, where applicable, compliance with legal obligations.
4.4 WEBSITE ANALYTICS
If you accept analytics cookies, we use Google Analytics to understand how visitors use the Site, including which pages are visited, how visitors reach the Site and how the Site performs.
Analytics information helps us improve the Site, its content and user experience.
Our lawful basis is your consent. Analytics technology is not activated before the required consent has been provided.
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
4.5 LEGAL, REGULATORY AND BUSINESS ADMINISTRATION
We may use personal data to:
• maintain appropriate business and accounting records;
• comply with legal, tax, regulatory or reporting obligations;
• respond to lawful requests from courts, regulators or public authorities;
• establish, exercise or defend legal claims;
• obtain professional legal, accounting, compliance or insurance advice;
• manage corporate transactions or business restructuring.
Our lawful basis is compliance with legal obligations and our legitimate interests in protecting and administering our business.
5. WHEN YOU ARE REQUIRED TO PROVIDE PERSONAL DATA
Fields marked as required in our forms are necessary for us to understand and respond to your enquiry.
You are not legally required to submit an enquiry. However, if you do not provide the required contact and project information, we may be unable to respond or assess your request.
6. COOKIES AND SIMILAR TECHNOLOGIES
The Site uses cookies and similar technologies, including browser storage.
6.1 STRICTLY NECESSARY TECHNOLOGIES
Strictly necessary technologies are used to:
• deliver and secure the Site;
• prevent spam and abusive form submissions;
• maintain essential functionality;
• record your cookie preference.
These technologies are necessary for the Site to operate and do not require consent where the applicable legal exemption applies.
The Site stores a consent preference identified as cc_consent_v1 in browser storage. It records whether analytics has been accepted or rejected and remains until it is cleared, replaced or reset following an update to the consent mechanism.
6.2 ANALYTICS COOKIES
Google Analytics cookies are used only after you select the option to accept analytics.
Depending on Google Analytics configuration, these may include:
• _ga;
• _ga_50QZRV8NYL;
• other strictly related Google Analytics identifiers.
These cookies help distinguish visits and produce statistical information about use of the Site. They are not used by Innavista for targeted advertising.
Google Analytics cookies may remain on your device for up to two years unless you delete them earlier. Event-level and user-level analytics data is retained for no longer than the period configured in our Google Analytics account.
IP anonymisation and available privacy controls are used where supported.
You can reject analytics through the consent banner. If you previously accepted analytics, you can withdraw consent by clearing the Site’s cookies and browser storage and selecting “Reject” when the consent banner is displayed again.
You can also control or delete cookies through your browser settings.
6.3 NO ADVERTISING COOKIES
We do not currently use Google Ads, Meta/Facebook Pixel, LinkedIn advertising cookies or other behavioural advertising technologies on the Site.
If this changes, we will update this Privacy Notice and obtain consent where required before activating such technologies.
7. WHO RECEIVES PERSONAL DATA
We may share personal data with carefully selected service providers where this is necessary to operate the Site or conduct our business.
Current categories of recipients may include:
• Framer, which provides website hosting, form functionality, security and related technical services;
• Google Analytics, only where analytics consent has been provided;
• Proton, which supports our business email communications;
• IT, cloud, security and technical support providers;
• professional advisers, including lawyers, accountants, auditors, insurers and compliance advisers;
• contractors or consultants working on an authorised project where access is necessary;
• courts, regulators, law-enforcement bodies, tax authorities or other public authorities where disclosure is legally required;
• a purchaser, investor or successor in connection with a genuine sale, investment, merger, restructuring or transfer of our business or assets.
Service providers are permitted to process personal data only for authorised purposes and are expected to protect it appropriately.
We do not sell personal data.
We do not share personal data with third parties for their independent behavioural advertising.
8. INTERNATIONAL TRANSFERS
Some service providers may process personal data outside the United Kingdom.
Where personal data is transferred to a country that is not covered by UK adequacy regulations, we use an appropriate transfer mechanism where required, such as:
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission Standard Contractual Clauses;
• another safeguard recognised under the UK GDPR;
• or an applicable exception permitted by law in limited circumstances.
Where required, we assess whether additional contractual, organisational or technical safeguards are necessary.
You may contact us at hello@innavista.com if you would like further information about the safeguards used for relevant international transfers.
9. HOW LONG WE RETAIN PERSONAL DATA
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, regulatory and dispute-resolution requirements.
Our usual retention periods are:
• Enquiries that do not become client engagements: up to 24 months after the last meaningful communication;
• Client and contractual records: for the duration of the relationship and normally six years after the relationship or relevant contract ends;
• Accounting, invoicing and transaction records: for the period required by applicable tax and company law, normally six years;
• Website security and diagnostic information: for as long as reasonably necessary to protect the Site and investigate incidents, normally no longer than 12 months unless a longer period is justified;
• Google Analytics event-level and user-level data: no longer than the configured analytics retention period;
• Google Analytics cookies: up to two years unless deleted earlier;
• Cookie consent records: for as long as reasonably necessary to demonstrate compliance;
• Information relevant to a complaint, dispute or legal claim: until the matter is resolved and any applicable limitation period has expired.
We may retain anonymised or aggregated statistical information for longer where it can no longer reasonably be linked to an identifiable person.
When personal data is no longer required, it is deleted, anonymised or securely destroyed.
10. HOW WE PROTECT PERSONAL DATA
We use appropriate technical and organisational measures designed to protect personal data against:
• unauthorised access;
• accidental loss;
• misuse or disclosure;
• alteration;
• destruction.
These measures may include encrypted communications, access controls, secure hosting, role-based access, authentication, backups, security monitoring and contractual confidentiality obligations.
Access to personal data is limited to individuals and service providers who require it for legitimate business purposes.
No internet transmission or storage system can be guaranteed to be completely secure. If we become aware of a personal data breach, we will assess and manage it in accordance with applicable law.
11. YOUR DATA PROTECTION RIGHTS
Depending on the circumstances, you may have the right to:
• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain personal data in a structured, commonly used and machine-readable format;
• request that personal data be transferred to another organisation where applicable;
• withdraw consent at any time where processing is based on consent;
• complain to a data protection supervisory authority.
These rights are not absolute and may be subject to legal conditions or exemptions.
To exercise your rights, contact us at:
hello@innavista.com
We may request information necessary to verify your identity and protect personal data from unauthorised disclosure. We normally respond within one month, although the law allows additional time in certain complex circumstances.
12. YOUR RIGHT TO OBJECT
You have the right to object at any time to processing based on our legitimate interests where your particular situation gives you grounds to do so.
We will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required to establish, exercise or defend legal claims.
Where personal data is used for direct marketing, you may object at any time and we will stop using it for that purpose.
13. AUTOMATED DECISION-MAKING
We do not use personal data collected through the Site to make decisions that produce legal or similarly significant effects solely through automated processing.
14. CHILDREN’S PERSONAL DATA
The Site and our services are intended for businesses and professional users. They are not directed at children.
We do not knowingly collect personal data from children under the age of 18 through the Site. If you believe a child has provided personal data to us, please contact hello@innavista.com so that we can investigate and, where appropriate, delete it.
15. EXTERNAL LINKS
The Site may contain links to third-party websites or services.
We are not responsible for the privacy practices of third parties. We recommend reviewing the applicable privacy notice before providing personal data to another website or service.
16. COMPLAINTS
We would appreciate the opportunity to address any privacy concern directly. You can contact us at:
hello@innavista.com
You also have the right to complain to the UK Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom
Website: https://ico.org.uk
Telephone: 0303 123 1113
If you are located outside the United Kingdom, you may also have the right to contact the data protection authority in your country of residence or work.
17. CHANGES TO THIS PRIVACY NOTICE
We may update this Privacy Notice to reflect changes to our services, technologies, service providers, legal obligations or data-processing activities.
The current version will always be published on the Site. Where changes are material, we may provide an additional notice where appropriate.
The effective date shown at the beginning of this Notice indicates when it was last updated.
18. CONTACT US
If you have questions about this Privacy Notice, our use of personal data or your data protection rights, please contact:
INNAVISTA LTD
66 Paul Street
London, England
EC2A 4NA
United Kingdom
Email: hello@innavista.com
Website: https://innavista.com