1. Who this notice applies to
This notice explains how Aveniqra handles personal information when you visit our website, contact us, create or use an account, receive business communications from us, or interact with the Aveniqra service.
For personal information we collect for our own business purposes — for example website enquiries, account administration, billing, security and our own B2B sales activity — Aveniqra acts as controller. When a customer sends personal information through an Aveniqra workflow and determines why that information is processed, Aveniqra ordinarily acts as processor on that customer’s documented instructions. The Data Processing Agreement applies to that processing.
The service-provider identity and contact details are published in our Legal Notice.
2. Information we collect
Account and identity information: name, business email, organisation, role, account identifiers, authentication events and organisation membership. Authentication is handled through Clerk; Aveniqra does not operate a separate password database.
Enquiry and sales information: information supplied through demo, contact or early-access forms; business contact information; company information; correspondence; qualification evidence; suppression and opt-out records; and publicly available professional information used for proportionate B2B prospect research.
Customer and pipeline data: files, records, mappings, integration metadata, canonical data, validation results, exceptions and delivery records submitted or generated to provide the Service.
Billing information: subscription, customer, invoice and payment-status identifiers received from our payment provider. Full payment-card details are handled by the payment provider rather than stored by Aveniqra.
Integration information: connected-provider identifiers, account names, granted scopes, connection state and operational metadata. Provider credentials and OAuth tokens are handled server-side and are not intentionally exposed in browser application state.
Technical and security information: IP address, device/browser information, request identifiers, authentication and security events, logs, fraud/abuse signals and service health data.
Legal and evidence records: document versions, document hashes, acceptance/approval records, audit events and evidence manifests used to preserve contractual, security and operational accountability.
3. Where information comes from
We collect information directly from you and your organisation, from systems you connect to Aveniqra, from service providers acting on our behalf, and from publicly available business sources where appropriate. For B2B prospecting we may also receive business-contact or company information from sales-data providers such as Apollo. Public availability does not remove our obligation to use personal information lawfully and proportionately.
4. Purposes and lawful bases
Service delivery and account administration: to create accounts, provide requested features, process customer workflows, maintain integrations, support users and perform our contractual obligations. We generally rely on contract and legitimate interests, and where necessary legal obligation.
Security, abuse prevention and reliability: to authenticate users, investigate incidents, prevent misuse, protect tenants, maintain logs, recover from failures and defend legal claims. We generally rely on legitimate interests and, where applicable, legal obligation.
Billing and financial administration: to administer subscriptions, payments, tax and accounting records. We generally rely on contract and legal obligation.
B2B sales and relationship management: to identify and contact relevant business prospects, respond to enquiries, manage opportunities, maintain suppression lists and measure sales activity. Where UK GDPR applies we generally rely on legitimate interests unless consent is required or chosen. We assess whether the activity is necessary, proportionate and reasonably expected and honour objections and opt-outs.
Product improvement: to understand reliability, failures and feature usage and improve the Service. We use data minimisation and generally rely on legitimate interests. Customer pipeline content is not used to train general AI models unless this is expressly agreed.
Consent: where we rely on consent — for example for optional non-essential cookies or a specific marketing permission — consent can be withdrawn at any time without affecting processing already carried out lawfully.
5. Direct marketing and your right to object
Our B2B outreach is intended for relevant business contacts. We maintain suppression records and provide a valid way to opt out. We do not intentionally treat sole traders and ordinary partnerships as if they were corporate subscribers where different electronic-marketing rules apply.
You have the right to object at any time to processing of your personal information for direct marketing. If you object or unsubscribe, we may retain the minimum information necessary on a suppression list so that we can respect that choice rather than contact you again.
7. International transfers
Some providers may process information outside the United Kingdom. Where a restricted transfer occurs, we use an applicable lawful transfer mechanism and carry out the checks required for the transfer and recipient, which may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard. Information about the safeguards relevant to a particular customer deployment can be provided during procurement.
8. Retention
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide the Service, maintain security and auditability, comply with legal/accounting obligations, resolve disputes and enforce agreements.
Operational customer content is retained according to the applicable customer configuration and agreement. Security and audit evidence may be retained for longer where necessary to preserve integrity or establish legal claims. Suppression records may be retained for as long as needed to honour an opt-out. Legal-document and acceptance evidence is designed to be append-only so that contractual history is not silently rewritten.
Where an exact period is not stated, we use the nature of the information, sensitivity, contractual requirements, legal limitation periods, security value and deletion risk to determine the period.
9. Security
We use technical and organisational measures including identity-bound access, tenant isolation, controlled server-side credentials, restricted outbound actions, validation and exception handling, audit logging, private storage, quarantine controls and fail-closed production configuration. No service can guarantee absolute security. If a personal-data breach occurs, we will assess and respond to it in accordance with applicable law and contractual obligations.
10. AI and automated processing
Aveniqra may use automation or AI-assisted tools for tasks such as extraction, classification, research, drafting and workflow decisions. Material actions are subject to policy, confidence, approval or exception controls appropriate to the task. We do not intend to make solely automated decisions about individuals that produce legal or similarly significant effects unless an applicable lawful basis, safeguards and customer instructions are in place.
12. Your data-protection rights
Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, portability and objection. Where processing is based on consent you may withdraw it. Where we rely on legitimate interests you may object, and the right to object to direct marketing applies at any time.
If Aveniqra is acting only as a processor for a customer, we may direct your request to that customer or assist the customer in responding. We may need to verify identity before completing a request. Requests can be submitted through our contact page or the Data & Privacy area of an authenticated account.
13. Complaints
Please contact us first if you have a concern so we can investigate it. You also have the right to complain to the UK Information Commissioner’s Office (ICO). The ICO provides current complaint and contact information at ico.org.uk.
14. Children
Aveniqra is a business service and is not directed to children. We do not knowingly offer consumer accounts to children.
15. Changes to this notice
We may update this notice when our processing, providers or legal obligations change. We will publish the current version and update the date. Material changes will be communicated through an appropriate channel where required.