This Privacy Policy explains how Recovantis Fileform Ltd ("Recovantis", "we", "us", or "our") collects, uses, discloses, and protects personal data about you when you visit our website, contact us with an enquiry, or engage us for file recovery services. It is written with reference to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations.
1. Who we areRecovantis Fileform Ltd is a private limited company registered in Scotland, operating from 5 South Charlotte Street, Edinburgh, EH2 4AN, United Kingdom. For the personal data described in this policy, we act as the Data Controller under UK GDPR.
Our contact details for privacy matters are:
Email: support@recovantisfileform.comPost: 5 South Charlotte Street, Edinburgh, EH2 4AN, United Kingdom
2. What personal data we collectWe collect personal data in three distinct contexts, and each is handled differently.
(a) When you visit our website. Our web server automatically records technical information about your visit, including your IP address, the browser and device you are using, the pages you view, the time of the visit, and the referring page. This data is collected through standard web server logs and through any analytics cookies you have accepted.
(b) When you contact us. If you send us an enquiry through our contact form, by email, or by telephone, we collect the information you provide. This typically includes your name, business email address, telephone number, the organisation you represent, and a description of the situation you are asking about. We may also retain any further correspondence that follows from that initial enquiry.
(c) When you engage us for recovery work. If you become a client, we collect the information necessary to carry out the engagement. This includes the names and contact details of the individuals we liaise with, commercial information about your organisation, and details of the incident or matter for which we have been instructed. During recovery work itself, we access the data contained on the storage media you supply to us. This data is treated separately under section 3 below.
We do not collect special category data (as defined in UK GDPR Article 9) through our website or general contact process. Where special category data is present on media supplied to us for recovery, our handling is governed by section 3.
3. Data contained on storage media supplied for recoveryFile recovery by its nature involves accessing data that may contain personal information, commercially sensitive material, and in some cases special category data. The following principles apply to all such data without exception.
We access the contents of supplied media only to the extent technically necessary to carry out the recovery work you have instructed.We do not examine, index, search, or analyse the contents beyond the requirements of the recovery process itself.
We act on behalf of the client as a Data Processor in respect of personal data contained on supplied media, and our processing is governed by a written agreement entered into before work begins.
All recovered data is returned to the client on encrypted media. No copy is retained by us after the client confirms successful handover.
Residual case data is wiped to the UK Government Communications-Electronics Security Group (CPA) standard.
Recovery work is performed only by named engineers within our Edinburgh facility. No part of the work is subcontracted.
Clients who wish to enter into a separate Data Processing Agreement under UK GDPR Article 28 should contact us; we provide such agreements on request.
4. Why we process personal data, and the legal basisWe process personal data only where we have a lawful basis to do so under UK GDPR Article 6. The specific basis depends on the activity.
To respond to enquiries and assess prospective engagements. Our legal basis is our legitimate interest in responding to people who approach us about our services, and, where applicable, taking steps prior to entering into a contract at your request.
To carry out recovery work and related services. Our legal basis is the performance of the contract we have entered into with the client organisation.
To comply with our legal and regulatory obligations. This includes tax records, accounting records, and, in specific cases, responses to lawful requests from UK authorities. Our legal basis is compliance with a legal obligation.
To maintain records of past engagements for internal quality and reference purposes. Our legal basis is our legitimate interest in being able to refer back to past work, subject to the retention periods in section 5.
To administer the website and analyse its use. Our legal basis is our legitimate interest in operating and improving our website. Where we use non-essential analytics cookies, we rely on your consent.We do not process personal data for direct marketing purposes, and we do not send commercial communications to people who have not asked to receive them.
5. How long we keep personal data
Website server logs: up to 12 months from the date of the visit.
Enquiries that do not proceed to engagement: up to 24 months from the date of the last communication, after which records are deleted unless we have a specific reason to retain them.
Client engagement records: up to 7 years after the closure of the engagement, in line with UK professional and statutory record-keeping requirements.
Recovered data from supplied media: wiped promptly after the client confirms successful handover, to UK CPA standard. We do not retain copies of client data after that point.
Financial and tax records: in accordance with the applicable HMRC retention period.
6. Who we share personal data withWe do not sell personal data, and we do not transfer it for third-party marketing.
We share personal data only in the following circumstances:
With service providers who help us run our operations. This includes our email and office productivity provider, our website hosting provider, and our accountants. Each such provider is contractually required to handle personal data in accordance with UK GDPR.
With legal, regulatory, or law-enforcement bodies where we are required to do so by law, or where disclosure is necessary to protect our legal rights.
With a successor organisation in the event of a sale, merger, or reorganisation of the business, subject to the protections in this policy.We do not share data obtained through recovery work with any third party, under any circumstances, except as required by the client's own instructions or by an order of a court of competent jurisdiction.
7. International transfersWe are based in the United Kingdom and process the majority of personal data within the United Kingdom. Some of the providers referred to in section 6 may process personal data in the European Economic Area or in other jurisdictions covered by a UK adequacy regulation. Where a transfer to a jurisdiction outside those areas is required, we rely on the UK International Data Transfer Agreement or Standard Contractual Clauses as approved by the UK Information Commissioner's Office.Recovery work involving client media is performed exclusively at our Edinburgh facility. Media is not shipped outside the United Kingdom for any stage of the work.
8. Your rights under UK GDPRYou have the following rights in respect of personal data we hold about you. To exercise any of these rights, please contact us using the details in section 11.
Right of access to a copy of the personal data we hold.
Right to rectification of inaccurate or incomplete data.
Right to erasure ("right to be forgotten") in defined circumstances.
Right to restriction of our processing in defined circumstances.
Right to data portability for data you have provided to us, where technically feasible.
Right to object to processing based on our legitimate interests.
Right to withdraw consent at any time, where processing is based on consent.We will respond to requests within one calendar month, and will explain any delay or refusal in writing.If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office, whose details are at ico.org.uk.
9. CookiesOur website uses a small number of cookies. Those strictly necessary for the site to function are set automatically. Any non-essential cookies (for example, analytics) are set only after you have given consent through the cookie banner displayed on your first visit. You can withdraw consent at any time by revisiting the banner or by clearing cookies in your browser.
10. SecurityWe apply organisational and technical measures proportionate to the sensitivity of the data we handle. These include controlled-access physical premises, access control on all case management systems, encryption of recovered data before handover, separation of case files to named engineers, and the CPA-standard wiping procedure referred to above. No method of transmission or storage is completely secure, and we do not guarantee absolute security, but we design our processes to reduce risk to the lowest reasonable level for professional recovery work.
11. Contact and complaintsFor any question about this policy, or to exercise any of your rights, please contact us:
Email: support@recovantisfileform.comPost: Recovantis Fileform Ltd, 5 South Charlotte Street, Edinburgh, EH2 4AN, United Kingdom
If you remain dissatisfied, you may complain to the Information Commissioner's Office at ico.org.uk, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
12. Changes to this policyWe may update this policy from time to time, and the "last updated" date at the top will be revised accordingly. Material changes will be notified to clients with active engagements; other changes will be communicated by posting the updated policy on this page.
