Privacy Policy

Effective Date: 28 October 2026

Document Reference: AV-LEGAL-MASTER-PRIVACY-2026

Statutory Alignment: UK General Data Protection Regulation (UK GDPR) / Data Protection Act 2018 / Privacy and Electronic Communications Regulations (PECR)

Supervisory Authority: Information Commissioner's Office (ICO) — Tier 1 Data Controller

OPERATIONAL PRIVACY STATEMENT

AquaVeris Solutions Ltd ("the Company", "we", "us", or "our") is committed to protecting the privacy, commercial confidentiality, and security of all personal and commercial data entrusted to us. This Privacy Policy governs data processing across all operational spheres: our primary domain (aquaveris.co.uk), digital compliance storefronts (including Payhip checkout engines), direct business-to-business communications, and physical site contracting arrangements.

1. Data Controller Identification & Statutory Governance

The statutory Data Controller responsible for your personal data under the Data Protection Act 2018 is:

  • Legal Entity Name: AquaVeris Solutions Ltd (Company No. 16480410, registered in England and Wales)

  • Trading Domain: aquaveris.co.uk

  • Data Protection & Regulatory Compliance Desk: compliance@aquaveris.co.uk

  • Customer Support Operations: support@aquaveris.co.uk

  • ICO Registration Status: Tier 1 Data Controller (under Section 108 of the Data Protection Act 2018)

2. Categories of Data We Collect

We collect and process personal and commercial data only where strictly necessary to operate our multi-vertical business architecture. We do not collect "Special Category" personal data (such as health, biometric, or trade union records) via public web channels.

A. Commercial Storefront & E-Commerce Transactions

When you purchase procedural compliance toolkits, digital frameworks, or company passes via our storefront, we collect:

  • Contact Details: Customer name, business email address, company trading name, and business postal/billing address.

  • Transaction Metadata: Unique transaction identification hash, product SKU, purchase timestamp, currency, and value.

  • Anti-Fraud & Audit Evidence (Visa CE 3.0 / PSD2): IP address, geolocation data, and digital delivery confirmation logs.

  • Payment Data Notice: We do NOT collect, process, or store payment card numbers, CVVs, or bank credentials on our servers. All card transactions are encrypted and processed directly by PCI-DSS Level 1 compliant processors (Stripe Payments UK Ltd and PayPal UK Ltd).

B. General Inquiries, Technical Support & Swap Requests

  • Communications: Name, work email address, telephone contact (if supplied), and details submitted via our contact forms, direct email, or the 24-Hour Wrong-Track Swap desk (aquaveris.co.uk/support).

  • Customer Support History: Records of operational support tickets, license re-issuances, and transaction verification queries.

C. Technical & Analytical Data

  • Server & Access Logs: IP address, browser type, operating system version, referral headers, and page view timestamps captured automatically by our web host (Squarespace) for platform stability and cybersecurity defence.

3. Lawful Bases for Data Processing

Under Article 6(1) of the UK GDPR, we process personal data strictly under the following statutory grounds:

Processing Purpose

Categories of Data

Lawful Basis (UK GDPR Article 6)

 

Digital Product Fulfilment & Delivery

Name, email address, transaction ID, order details

Article 6(1)(b) — Performance of Contract: Necessary to generate download links, forced-copy Google Docs, and receipts.

Fraud Prevention & Chargeback Defense

IP address, geolocation, download confirmation hash

Article 6(1)(f) — Legitimate Interests: Protecting the business against payment fraud, unauthorized chargebacks, and piracy under Visa CE 3.0 rules.

Statutory Tax & Company Accounting

Invoices, transaction history, VAT location proof

Article 6(1)(c) — Legal Obligation: Compliance with HMRC tax retention mandates (HMRC 6-year accounting rule).

Customer Support & 24-Hr Product Swaps

Order email, support messages, trade swap requests

Article 6(1)(b) — Performance of Contract: Fulfilling post-purchase commercial warranties and support obligations.

Regulatory & Statutory Currency Updates

Customer email, purchase edition year (e.g. 2026/2027)

Article 6(1)(f) — Legitimate Interests: Alerting past buyers when statutory UK safety legislation (HSE/BSI/IRATA) alters deployed frameworks.

Voluntary Marketing Updates & Lead Magnets

Name, business email address, trade discipline

Article 6(1)(a) — Explicit Consent: Freely given when opting in to receive technical checklists or safety whitepapers.

4. Third-Party Data Processors & Service Providers

We never sell, rent, lease, or monetise customer data to third-party marketing brokers. To deliver our digital services, we partner with vetted third-party data processors operating under strict data processing agreements aligned with UK GDPR standards:

  • Payhip Ltd: E-commerce checkout infrastructure, automated file delivery, digital VAT compliance, and server-side PDF license stamping.

  • Stripe Payments UK Ltd & PayPal (Europe) S.à r.l.: Encrypted PCI-DSS Level 1 payment processing, 3D Secure 2 (3DS2) authentication, and fraud prevention.

  • Squarespace Ireland Ltd: Website hosting, SSL encryption, and basic server infrastructure.

  • Google Workspace (Google Ireland Ltd): Encrypted corporate email routing, customer support logging, and cloud file management.

  • HM Revenue & Customs (HMRC) & Companies House: Direct statutory reporting as required by UK corporate and tax law.

5. International Data Transfers

Where cloud infrastructure providers (such as Google Workspace or Stripe) transfer data outside the United Kingdom, they do so under statutory UK International Data Transfer Agreements (IDTAs), approved Standard Contractual Clauses (SCCs), or to jurisdictions recognised by the UK Government as providing adequate data protection safeguards.

6. Data Retention Schedules

We retain personal and commercial data only for as long as strictly necessary to fulfil the operational purpose for which it was gathered:

  • Commercial Financial & Order Records: Retained for exactly six (6) full tax years following the accounting period end, in accordance with the statutory mandates of the Taxes Management Act 1970 and HMRC corporate guidelines.

  • Customer Support & Trade Swap Records: Retained for up to twenty-four (24) months following resolution to verify commercial licensing history.

  • Marketing Opt-Ins: Retained until you withdraw consent or click "unsubscribe" in any broadcast email.

7. Dynamic Licensing Stamping & Anti-Piracy Architecture

In accordance with our legitimate interests in intellectual property protection and the Copyright, Designs and Patents Act 1988 (CDPA 1988), reference documents, license certificates, and quick-start guides downloaded from our storefront are dynamically watermarked at the point of purchase with the buyer's verified corporate email, order reference, and timestamp. This creates a secure, auditable chain of custody if documentation is inspected during on-site Tier 1 contractor desk audits.

8. Cookies & Website Analytics

Our website uses limited, privacy-focused cookies:

  • Essential Operational Cookies: Required for secure login sessions, checkout cart integrity, and payment gateway tokenisation. These cannot be disabled without breaking checkout functionality.

  • Analytics Cookies: Aggregated, anonymised website traffic data processed via Squarespace analytics to evaluate page speed, referral sources, and mobile layout rendering without tracking personal identity.

  • No Invasive Ad Trackers: We do not deploy cross-site tracking pixels (such as Meta Pixel) or data-broker advertising scripts. You can adjust your browser settings to reject non-essential cookies at any time.

9. Your Statutory Data Protection Rights

Under Chapter III of the UK GDPR, you have the following enforceable legal rights:

  • Right of Access: You may request a formal copy of any personal data we hold concerning you (Subject Access Request).

  • Right to Rectification: You may require us to correct incomplete or inaccurate personal records.

  • Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal records, provided they are not required to satisfy statutory HMRC accounting retention mandates (Section 6).

  • Right to Restriction of Processing: You may request that we suspend processing your data in certain circumstances.

  • Right to Data Portability: You may request a structured, machine-readable export of your personal transaction data.

  • Right to Object: You have the absolute right to object at any time to the processing of your data for direct marketing purposes.

  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw it immediately without affecting the lawfulness of prior processing.

To exercise any of these rights, contact our Data Protection Officer at: compliance@aquaveris.co.uk. We respond to all verified statutory requests within one calendar month without an administrative fee.

10. Responsible AI Use & Systems Transparency

AquaVeris Solutions Ltd utilises secure, privacy-respecting computational and language tools strictly to assist with document drafting optimisation, structural code validation, and operational data organisation. We do NOT use artificial intelligence for automated decision-making that produces legal or significant effects, nor do we employ automated customer profiling. All outputs are reviewed and verified by qualified company personnel.

11. Right to Lodge a Regulatory Complaint

If you have concerns regarding our data handling or believe our processing infringes data protection law, you have the statutory right to lodge a formal complaint with the UK supervisory authority:

  • Information Commissioner's Office (ICO)
    Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
    Helpline: 0303 123 1113 | Website: ico.org.uk

12. Contact & Corporate Governance Details

For any legal, privacy, or data governance queries, please direct communications to: