Privacy notice

Draft for solicitor review. This is a starting draft and has not been checked by a solicitor. It is not yet in force.

This notice explains what personal information Invola collects about the businesses that use it and the people who work for them, why we collect it, who we share it with, how long we keep it and what your rights are. It follows the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Invola is a trading name of [FILL IN: company name] Ltd, a company registered in England and Wales (company number [FILL IN]), registered office [FILL IN]. We are registered with the Information Commissioner's Office (ICO), registration number [FILL IN].

For questions about this notice or your information, email support@invola.co.uk or message us from Help & support in the app. [DECIDE: whether to use a separate address such as privacy@invola.co.uk.]

2. Our two roles

We are the controller for information about our own customers: the businesses that sign up, their owners and their team members, and people who contact us or visit invola.co.uk. This notice covers that information.

We are a processor for the information businesses keep in Invola about their own customers: names, addresses, phone numbers, emails, sites, appliances, photos, signatures, certificates, messages and payments. The business decides what to keep and why. We only handle it on the business's instructions, under our data processing agreement.

If you are a customer of a business that uses Invola (for example you had a boiler serviced and received a certificate or invoice), the business is responsible for your information. Please contact that business about it. If you contact us, we will pass your request to them.

3. Information we collect

When you sign up

Your business name, your name, email address, the web address you chose, your trades and how many people will use Invola.
Your password, which we only ever keep in scrambled (hashed) form. We cannot read it.
The version of our terms and privacy notice you accepted, when you accepted it, and the IP address and browser you used.

When you use Invola

Account and team details: names, email addresses, usernames, roles and permissions, phone numbers, and the registration numbers and expiry dates you add for qualifications (for example Gas Safe, OFTEC or unvented).
Business details: trading name, address, phone, logo, website address, VAT and company details, and your Gas Safe registration number and the name it is registered under, which we check against the public Gas Safe Register. For a sole trader or partnership, these can be personal information.
Security information: sign-ins, the devices you sign in from (a random device code, the browser and IP address), two-step sign-in settings, failed sign-in attempts, and records of security events such as password changes, bank detail changes and emails held by the fraud guard.
Usage counts: numbers only, such as how many users, customers, jobs, documents and emails you have, how much storage you use and when someone last signed in. We use these to apply plan limits and keep the service healthy.
Email sending records: how many emails each business sends, bounces and spam complaints, so we can protect delivery for everyone.

When you pay us

Your plan, billing status, invoices, receipts and payments.
Card payments are handled by Stripe. We never see or store your full card details. Stripe tells us whether a payment worked and gives us the customer and subscription records we need.
For bank transfer, the payments we record (amount, date, reference).

When you contact us or give feedback

Support messages, up to 3 pictures or screenshots per message, and our replies. Before you send, the app shows you what it adds automatically: your business, your name and role, your plan, the app version, your device and the page you were on. It never adds anything about your customers.
Feedback, star ratings and comments. If you tick the box allowing us to quote you, we keep that permission, its date and the exact words you agreed to.
Messages sent through the contact form or the "Can't sign in?" form on invola.co.uk: your name, email, business, phone if you give it, and your message.

When you visit invola.co.uk

Our website does not use advertising or analytics cookies. It only sets cookies that its forms need, and on some forms Cloudflare Turnstile checks that you are a person. Cloudflare may set its own cookies to do this. Our cookies page lists them. To stop abuse of our forms, we keep the IP address that sent each form for 1 day.

The Invola app keeps you signed in using your browser's own storage on your device, not cookies. This includes a random device code that lets us recognise your device for security.

4. Why we use it, and our lawful basis

To provide Invola and run your account (setting up your business, signing in, sending your emails, storage, support): needed for our contract with you.
To take payment and keep accounts: needed for our contract, and to meet our legal duties under tax law.
To keep Invola and your account secure and prevent fraud (two-step sign-in, new device alerts, the 48-hour bank detail wait, the fraud guard, spam checks, sending limits, checking for repeat trials and lookalike business names): our legitimate interests, and yours, in stopping fraud and abuse. Some of this also helps your business meet its own security duties.
To check Gas Safe registrations before gas certificates can be issued: our legitimate interest in making sure only registered businesses issue gas safety certificates through Invola.
To send service emails (trial reminders, billing, security alerts, planned maintenance and problems): needed for our contract.
To send news about Invola (information announcements): our legitimate interests. Every one has an unsubscribe link, and we keep only a scrambled (hashed) copy of the address of anyone who unsubscribes, so we know not to send to them. We do not sell or share your details for other companies' marketing.
To improve Invola using feedback and usage counts: our legitimate interests.
To quote you on our website: your consent, which you can withdraw at any time in My messages. Withdrawn quotes come off the website within a minute.
To meet legal obligations and deal with legal claims.

Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details and you can object (see section 9).

We do not use your information for automated decisions that have legal or similarly significant effects on you. Some sign-ups are held for a person to check (for example a business name very close to an existing one), but a person always makes the decision.

5. Who we share it with

We use these service providers. Each one only gets what it needs to do its job, under a contract that requires it to protect your information.

Hetzner Online GmbH (Germany): our servers, databases and file storage, in data centres in Germany.
Postmark (ActiveCampaign, LLC, USA): sends and receives email for Invola and for the businesses that use it.
Stripe: takes card payments and manages subscriptions. Stripe is also responsible for some payment information itself, under its own privacy notice.
Cloudflare, Inc. (USA): runs the DNS for our domains, and Turnstile, which checks for spam on our forms and on businesses' website contact forms.
Backblaze, Inc. (USA, storing in its EU Central region): keeps our encrypted backups. The backups are encrypted before they leave our servers, and Backblaze cannot read them.
Apple, Google and Mozilla push services: deliver notifications to our own staff's phones. These carry only counts and business names, never your messages.

[DECIDE: confirm this list against the accounts actually in use at launch, and which Stripe company contracts with us.]

If you connect a Starling bank feed, your business chooses that in its own agreement with Starling. Starling sends payment details to Invola; we do not send your information to Starling.

We may also share information if the law requires it, with professional advisers (for example our accountant or solicitor), or with a company that takes over Invola, who would have to keep to this notice.

6. Transfers outside the UK

Our servers are in Germany, in the European Economic Area, which the UK recognises as protecting personal data adequately. Some providers (Postmark, Cloudflare, Stripe and Backblaze) are US companies or may handle data in the USA. Where information goes to a country without UK adequacy, we use the protections UK law allows: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. [DECIDE: confirm which safeguard each provider uses, from their data processing terms.] You can ask us for a copy of the relevant safeguards.

7. How long we keep it

Sign-ups not confirmed within 24 hours: the personal details are wiped after 24 hours, and the empty record is deleted after 30 days.
Your account data: for as long as your account is open, including while it is read-only.
After you close your account: the account's database and all its stored files (photos, PDFs, uploads and exports) are deleted 30 days after the closure is confirmed. Until then the closure can still be stopped.
Backups: encrypted database backups are kept for up to 200 days, then deleted. Nobody can change or delete a backup during that time, which protects against ransomware and mistakes. This means data you delete, including a closed account's data, stays inside those encrypted backups until they expire, up to 200 days later. It is only ever used to restore the service after a fault, never for anything else.
Encrypted copy of stored files: a file deleted from Invola (for example a photo deleted for good from the Recycle bin, or the files of a closed account) is removed from the nightly encrypted copy at our backup provider 30 days later. Older versions of changed files are also kept there for 30 days.
Your sign-up record (terms version, time, IP address and browser): the IP address and browser are removed after 12 months. The rest is kept for the life of the account plus 6 years, as evidence of what was agreed (6 years after the sign-up if no account was made).
Our invoices and payment records: 6 years from the end of the financial year they relate to, as HMRC requires, then deleted. Stripe keeps its own records under its own rules.
The basic record of a deleted business (its web address, so it is never given to anyone else): kept. [DECIDE: which other details stay on it, for example the owner's name and email, and for how long.]
Support conversations and feedback: 2 years after the conversation is closed or last used, then deleted. The same for feedback, star ratings and comments on help articles, unless you agreed to be quoted and the quote is still on our website.
Security and activity records (sign-ins with their IP address and browser, failed sign-in attempts, our own platform events and admin records): 1 year, then deleted. A device you still sign in from stays on your list of signed-in devices while you use it.
A business's own audit log: the record in the app of what was deleted, restored and changed, by whom and when, is part of the business's records, not one of our logs. No time limit deletes it: it is kept for the life of the account and deleted with the account.
Items in a business's Recycle bin: 30 days from the day each one was deleted, then deleted for good (sent invoices, receipts, credit notes and issued certificates that must stay on record excepted).
IP addresses used to stop abuse of our website forms: 1 day.
Email held while an account is suspended: 30 days, then deleted.
Your data export: the download file is deleted after 7 days.
Unsubscribe records: a scrambled (hashed) copy of the address, for as long as we send announcements.
Testimonials: until you withdraw permission.
Emails held at Postmark: [DECIDE: check the message retention setting on our Postmark servers and state it here.]

8. Keeping it safe

Each business has its own database, its own database logins and its own encryption key.
Customer names, addresses and messages are encrypted in the database.
All connections use HTTPS. Backups are encrypted with a key that is never kept on our servers.
Passwords are stored as hashes, and you can use two-step sign-in with an authenticator app.
Our own admin tools do not show any business's customers, jobs or documents, and every admin action is logged.

No system is perfectly secure. If we have a personal data breach that is likely to put you at risk, we will tell you and the ICO as the law requires.

9. Your rights

You have the right to:

access the personal information we hold about you;
have it corrected if it is wrong (you can change most of it yourself in My Account and Settings);
have it erased in some circumstances;
restrict how we use it in some circumstances;
object to our use of it where we rely on legitimate interests, and to direct marketing at any time;
data portability: the account owner can download the business's data at any time with Export My Data;
withdraw consent where we rely on it, without affecting what we did before.

To use any of these rights, email support@invola.co.uk. We will reply within one month. It is free unless a request is clearly unfounded or excessive.

If you are a team member, some of your information (for example the jobs you worked on) is also part of your employer's business records, which they control. We may need to refer some requests to them.

10. Complaints

Please contact us first and we will try to put things right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.

11. Children

Invola is for businesses and is not meant for anyone under 18.

12. Changes to this notice

We may update this notice. The version number is at the foot of this page. If we make an important change, we will tell account owners by email or in the app before it applies.