Privacy Policy
01 Who we are
Wesolv Limited (“Wesolv”, “we”, “us” or “our”) is a company registered in England and Wales under company number 17023265. We act in two capacities. For our own website, marketing and customer relationships we are the controller of the personal data we process about you, which means we decide how and why your data is used. When we provide our platforms and services to our business customers, we act as a processor on their behalf — see section 09 for details of that role.
We are registered with the Information Commissioner’s Office (the “ICO”), the UK supervisory authority for data protection, under registration reference ZC091641.
This notice applies to personal data we collect through our website, our services, and any other interaction you have with us.
02 The personal data we collect
Depending on how you interact with us, we may collect and process the following categories of personal data:
Identity & contact data
- Full name, title, company name and job role
- Email address, postal address and telephone number
Account & transaction data
- Username, password (stored in hashed form) and account preferences
- Records of services purchased, billing details and correspondence
Technical & usage data
- IP address, browser type and version, time zone setting and operating system
- Pages visited, referring URLs, clickstream data and approximate location derived from IP
Marketing & communications data
- Your preferences for receiving marketing communications
- Your responses to surveys, feedback forms and competitions
Special category data. We do not normally collect any special category personal data (such as data about your health, race, religion, sexual orientation or political opinions). Where we do, we will rely on a specific lawful basis and tell you at the point of collection.
03 How we collect your data
Directly from you
When you fill in a form on our website, register for an account, contact us by email or phone, subscribe to our newsletter, or otherwise correspond with us.
Automated technologies
When you interact with our website we automatically collect technical data using cookies, server logs and similar technologies. See section 11 for details.
Third parties & public sources
We may receive data from search information providers, payment service providers, and from publicly available sources such as Companies House.
04 How we use your data & our lawful bases
Under UK GDPR we must have a lawful basis for processing your personal data. The bases we rely on are set out below:
| Purpose | Data used | Lawful basis |
|---|---|---|
| To register you as a new customer and manage your account | Identity, contact, account | Performance of a contract |
| To process and deliver your order, including payments and refunds | Identity, contact, transaction | Performance of a contract |
| To send service emails and important notices | Identity, contact | Performance of a contract; legal obligation |
| To send marketing emails about products and services | Identity, contact, marketing preferences | Consent; or legitimate interests (existing customers) |
| To administer and protect our business and website | Technical, usage | Legitimate interests (running our business, network security) |
| To improve our website, services and customer experience | Technical, usage | Legitimate interests (we use Fathom Analytics, a cookieless analytics tool that does not collect personal data or require consent) |
| To comply with legal, regulatory and tax obligations | Identity, contact, transaction | Legal obligation |
“Legitimate interests” means the interest of our business in conducting and managing our business so that we can give you the best service or product and the most secure experience. We make sure to consider and balance any potential impact on you and your rights before processing on this basis.
05 Who we share your data with
We may share your personal data with the following categories of recipient:
- Service providers acting as processors on our behalf — including cloud hosting, IT support, email delivery, payment processing, and customer support tools
- Professional advisers such as lawyers, accountants, auditors and insurers
- Regulators and law enforcement where required by law
- Prospective buyers in the event of a sale, restructuring or acquisition of all or part of our business
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes and only permit them to process it for specified purposes and in accordance with our instructions.
06 International transfers
Some of our service providers may be based outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection by:
- Only transferring to countries that have been deemed to provide an adequate level of protection under UK adequacy regulations; or
- Using specific contracts approved for use in the UK — such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — which give personal data the same protection it has in the UK.
07 How long we keep your data
We retain your personal data only for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting or reporting requirements.
By way of guidance:
- Customer account data — kept for the duration of your relationship with us and for 6 years afterwards (to meet tax and contractual obligations).
- Marketing data — kept until you withdraw consent or are otherwise inactive for 24 months.
- Website analytics — we use Fathom Analytics which collects no personal data; aggregate traffic statistics are retained indefinitely.
In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information indefinitely without further notice to you.
08 Data security
We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These include encryption in transit, access controls, staff training, and regular review of our systems.
We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
09 When we act as a processor
When we provide our platforms and services to our business customers, those customers decide what personal data is processed and why. In that situation our customer is the “controller” and Wesolv is the “processor”: we process the data only to deliver the service and only on the customer’s documented instructions. Where you are an individual whose data we process on a customer’s behalf — for example a client, creditor or employee of one of our customers — this section explains how that works and how to exercise your rights.
Our platforms and the data we process
We process personal data on behalf of our customers through the platforms below. The exact data involved in each case depends on what the customer chooses to put into the platform:
| Platform | What it does | Personal data we process on a customer’s behalf |
|---|---|---|
| Pegasus | Reads and interprets complex documents and provides a video and electronic signing platform | Client identity and contact details, financial data, documents and their contents, signatory, verification and audit-trail data, video recordings and correspondence |
| Aquarius | CRM for managing and handling corporate insolvency case referrals | Client, referrer and creditor identity and contact details, financial data, documents, case-management data and correspondence |
| Metia | Client and creditor platform handling customer relations and client data | Client and creditor identity and contact details, financial data, documents, correspondence and customer-relations records |
| Athena | Training platform | Employee identity and contact details, financial data, documents, training records and assessment results |
| Ioana | Education platform | Employee and learner identity and contact details, financial data, documents, education and training records |
| Gaia | AML, KYC and credit-reference platform | Client identity and contact details, financial data, AML and KYC verification, credit-reference and credit-report data, documents, and data relating to criminal offences and alleged offences |
| Odyssey | IVA case-management system | Client and creditor identity and contact details, financial data, documents, IVA case and proposal data and correspondence |
| Aura | CRM assessing client viability for insolvency products | Client identity and contact details, financial data, documents, financial-circumstances and viability-assessment data and correspondence |
| Themis | Creditor-services platform | Creditor and client identity and contact details, financial data, documents, account and balance data and correspondence |
Categories of individuals
Depending on the platform and the customer, the individuals whose data we process on our customers’ behalf may include our customers’ clients, creditors, debtors and referrers, our customers’ employees, and other individuals named in the documents and cases handled through the platforms.
Special category and criminal-offence data. Several of our platforms — including our AML, KYC, credit-reference and insolvency case-management tools — may process information about an individual’s financial difficulties and, where a customer provides it, special category data or data relating to criminal offences and alleged offences. We process such data only on the controller’s instructions and under the safeguards required by UK data protection law.
Our obligations as a processor
When we act as a processor we comply with Article 28 of the UK GDPR. In particular:
- We act only on the documented instructions of the controller, unless we are required by law to do otherwise (in which case we will tell the controller before processing, where the law allows).
- We ensure that staff authorised to access the data are bound by appropriate confidentiality obligations.
- We apply appropriate technical and organisational security measures to protect the data.
- We engage sub-processors only under written contract and with the controller’s authorisation.
- We assist the controller, so far as we are able, in responding to data-subject requests and in meeting their own security, breach-notification and data-protection-impact-assessment obligations.
- At the end of the relevant contract we delete or return the service data as the controller directs, unless we are required by law to keep it.
Sub-processors and international transfers
To deliver our services we use trusted third-party sub-processors, such as cloud hosting, infrastructure, communications and security providers. We put a written contract in place with each sub-processor imposing the same data-protection obligations that apply to us, and we remain responsible to the controller for their performance. Where a sub-processor is located outside the UK, we ensure the transfer is protected by an adequacy decision or by appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as described in section 06.
Personal-data breaches
If a personal-data breach affecting service data occurs, we will notify the affected controller without undue delay after becoming aware of it, and provide the information the controller reasonably needs to meet its own obligations to the ICO and to affected individuals.
How long we keep service data
When we act as a processor, the controller decides how long the service data is kept. We retain it for as long as we provide the service to that customer and in accordance with our contract with them. After the contract ends we delete or return the data as instructed, subject to any retention period required by law.
Your rights where we act as a processor
If we hold or process your personal data on behalf of one of our customers, that customer is the controller and is responsible for your rights. If you wish to access, correct, delete, restrict, object to or port your data, please contact the relevant customer directly. If you contact us instead, we will pass your request on to the relevant controller and support them in responding within a reasonable time.
Data processing agreement
We are ready to enter into a written data processing agreement with each customer, setting out the subject matter, duration, nature and purpose of the processing, the types of personal data and categories of data subjects, and the rights and obligations of both parties, as required by Article 28 of the UK GDPR.
10 Your rights
Under UK GDPR you have the following rights in relation to your personal data:
- Right of access — to request a copy of the personal data we hold about you
- Right to rectification — to ask us to correct inaccurate or incomplete data
- Right to erasure — (“right to be forgotten”) to ask us to delete your data where there is no good reason for us to continue processing it
- Right to restrict processing — to ask us to suspend the processing of your data in certain circumstances
- Right to data portability — to receive a copy of your data in a structured, commonly used and machine-readable format
- Right to object — to object to our processing where we rely on a legitimate interest, or to direct marketing at any time
- Right to withdraw consent — where we rely on consent, you may withdraw it at any time
- Rights in relation to automated decision-making and profiling — we do not currently make decisions about you using solely automated means
You will not have to pay a fee to exercise any of these rights. We will respond to legitimate requests within one month. To exercise any of these rights, please contact us using the details in section 14.
11 Cookies
Our website uses cookies and similar technologies to distinguish you from other users. This helps us provide you with a good experience when you browse our website and also allows us to improve our site.
Types of cookies we use
Our website uses a small number of strictly necessary cookies to enable core functionality, such as recording contact form submissions. We use Fathom Analytics for website analytics — it is cookieless and collects no personal data. For full details of the cookies we use, please see our Cookie Policy.
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our website may become inaccessible or not function properly.
12 Children
Our services are not intended for, and we do not knowingly collect personal data from, children under the age of 13. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.
13 Changes to this notice
We may update this privacy notice from time to time. Any changes will be posted on this page with an updated revision date. Where the changes are significant, we may also notify you by email.
14 Contact us & complaints
If you have any questions about this notice, how we handle your data, or you wish to exercise any of your rights, please contact us:
Wesolv Limited
Company number: 17023265 (England & Wales)
Email: privacy@wesolv.co.uk
Helpline: 07823 330 000
ICO registration: ZC091641
Right to complain
You have the right to lodge a complaint with the Information Commissioner’s Office (the UK supervisory authority for data protection) at any time. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.
Information Commissioner’s Office · ico.org.uk · Helpline: 0303 123 1113