PRIVACY NOTICE

How ORVIA uses personal information.

The controller is ORVIA Oversight Ltd (company 16123685, registered in England and Wales, 3rd Floor, 86–90 Paul Street, London EC2A 4NE), registered with the Information Commissioner's Office under reference ZC152311. This notice covers ORVIA and every ORVIA website and service. Last updated 10 October 2026.

What we use and why

Purpose	Information	Lawful basis
Answering enquiries, calls and booking requests	Name, contact details, organisation, what you tell us	Legitimate interests (Art. 6(1)(f)); steps before a contract (Art. 6(1)(b))
Delivering services you buy (reviews, Action Plans, Voice, Web, training)	Contact and account details, service records, information you give us about your service	Contract (Art. 6(1)(b))
Care, safeguarding or health information you share with us as part of a service	Special category data, which may include health and care information	Contract or legitimate interests, with Art. 9(2)(h) (health and social care) or 9(2)(g)/(f) where they apply. Customers remain controller for their own service-user records; ORVIA acts as processor under a written agreement
Payments and invoices	Name, billing details, payment status (card details are handled by Stripe, not stored by ORVIA)	Contract (Art. 6(1)(b)); legal obligation for accounting records (Art. 6(1)(c))
Phone calls answered by ARIA (AI) on the main line	Caller number, call audio, transcript and summary	Legitimate interests (Art. 6(1)(f)). You are told at the start of the call that ARIA is an AI. A person reviews and decides any follow-up
Website security, cookies and (with consent) analytics	Device, browser and usage information	Legitimate interests for essential cookies; consent (PECR) for analytics

Who we share it with

We do not sell personal information. We use these service providers (processors), under contracts that require them to protect it:

Microsoft (Microsoft 365, Entra ID, Bookings, Outlook): Email, files, sign-in and call bookings
Vercel Inc.: Website hosting and delivery
Stripe Payments Europe Ltd: Card payments and payment links
Supabase: Database and sign-in for customer workspaces, hosted in the EU (AWS eu-west-1, Ireland)
Vapi: AI call handling for ARIA on the main line; the 0330 number is carried by Yay.com (SIP)
monday.com: Enquiry and work tracking for human follow-up
Google (Google Analytics): Website analytics, only if you accept analytics cookies

We may also share information where the law requires it, for example with a regulator, the police or a local authority safeguarding team when there is a risk of harm. Some providers may process data outside the UK; where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement/Addendum.

How long we keep it

Enquiries that do not become work: up to 2 years from last contact. Customer and service records: for the life of the contract plus 6 years. Accounting records: 6 years from the end of the financial year. Call recordings and transcripts: 90 days, unless needed for a complaint or safeguarding matter. We delete or anonymise information at the end of these periods.

Your rights

You have the right to be informed, to access your information, to have it corrected, to have it erased, to restrict or object to its use, to data portability, and not to be subject to solely automated decisions with legal or similarly significant effects. ORVIA does not make such decisions: a person reviews every safeguarding, clinical, legal, regulatory or culpability decision. Where we rely on consent you can withdraw it at any time. We reply within one month.

Complaints

Please contact us first so we can put things right. You can complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, or call 0303 123 1113.

Contact

Email hello@orvia.org.uk with the subject "Data Protection", call 0330 043 3703 (main line) or 07375 612354, or write to ORVIA Oversight Ltd, 3rd Floor, 86–90 Paul Street, London EC2A 4NE.

ORVIA Oversight

Start

ORVIA family