Aveni Limited
External Privacy Notice
Last Updated: 07/07/2026
Aveni Limited (“Aveni”, “we, “us”, “our”), a company registered in Scotland under registration number SC600143, whose registered address is 58 Morrison Street, Edinburgh, Scotland, EH3 8BP, is committed to protecting and respecting your privacy. We are committed to the protection of the Personal Data we process in line with the data protection principles set out in the UK General Data Protection Regulation and the EU General Data Protection Regulation (2016/679), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and the Data Protection Act 2018.
Where Aveni Limited is the Controller of your Personal Data, we are registered in the UK with the Information Commissioner’s Office (“ICO”), registration reference ZA925667.
We have appointed an external data protection officer (“DPO”), details as follows:
Evalian Limited
West Lodge
Leylands Business Park
Colden Common
Hampshire
SO21 1TH
United Kingdom
Email: dpo@evalian.co.uk
Phone: +44 (0)333 050 0111
Website: www.evalian.com
As an information-led business, we place great importance on ensuring the quality, confidentiality, integrity and availability of the data we hold and in meeting our data protection obligations when processing Personal Data. We are committed to protecting the security of your Personal Data, using a variety of technical and organisational measures to help protect your Personal Data from unauthorised access, use or disclosure.
We update this privacy notice from time to time in response to changes in applicable laws and regulations, to our processing practices and to the products and services we offer. When changes are made, we will update the date at the bottom of this document. Please review this privacy notice periodically to check for updates.
Unless we notify you otherwise, we are the controller of the Personal Data we process about you. This means that we decide what Personal Data to collect and how to process it.
The purpose of this privacy notice is to explain what Personal Data we collect about you and how we process it. This privacy notice also explains your rights, so please read it carefully. If you have any questions or wish to make a complaint, you can contact us using the information provided below under the ‘How to contact us’ section.
This privacy notice applies to you if:
‘Personal Data’ means any information from which someone can be identified either directly or indirectly. For example, you can be identified by your name or an online identifier. We process the information you give us, whether this is given through interactions with our Website or by any other form of correspondence.
We collect Personal Data through several means, for example:
Data protection legislation requires us to identify an appropriate lawful basis to process Personal Data. The lawful bases we rely on as Controller are detailed below with the types of processing to which they apply:
We will only use your Personal Data when the law allows. Most commonly, we will use your Personal Data in the following circumstances:
Categories of individuals | Categories of Personal Data | Purpose of Processing | Lawful Basis | Retention Period |
|---|---|---|---|---|
Client or Supplier | Name, job title, email address, phone number, company you work for | Contracting new Clients or Suppliers. | Contract | 6 years following termination of the contract |
Client | Name, job title, work email address, work phone number, company you work for | Providing you with our Services and carrying out Client instructions in connection with those Services. | Contract | 6 years following termination of the contract |
Former Clients | Name, job title, work email address, work phone number, company you work for | Managing queries relating to services we have provided historically. Legitimate interests: business continuity, trade goodwill, brand and reputation protection. | Legitimate interests | 2 years following last meaningful contact |
Client, Supplier, Business Contact | Name, job title, work email address, work phone number, company you work for | Managing our relationships with clients, suppliers, or business contacts. Legitimate interests: business continuity, trade goodwill, brand and reputation protection. | Legitimate interests | 2 years following last meaningful contact |
Data Subject | Name, email address, address | Complying with Data Subject right requests | Legal Obligation | 1 year following completion of request |
Data Subject | Name, email address, address | Communicating with relevant Controllers or Processors about Data Subject right requests | Legal Obligation | 1 year following completion of request |
Client | Name, job title, work email address, work phone number, company you work for | Processing orders for our Products or Services. | Contract | 6 years following termination of the contract |
Clients, former Clients, Suppliers, website users | Name, email address, phone number, company you work for | Seeking views or feedback about our Products or Services. Legitimate interests: Service evaluation, quality improvement, compliance evidence. | Legitimate interests | 2 years following last meaningful contact |
Clients or former Clients | Name, email address, phone number, company you work for | Notifying about changes to our Services. Where no current contract exists, our legitimate interests are business continuity, trade goodwill, and brand and reputation protection. | Contract or Legitimate interests | 2 years following last meaningful contact |
Clients, former Clients, Suppliers, website users | Name, email address, phone number, company you work for | Handling an enquiry or complaint. Where no current contract exists, our legitimate interests are business continuity, trade goodwill, and brand and reputation protection. | Contract or Legitimate interests | 2 years following last meaningful contact |
Mobile app users | Name, email address, company you work for, account login details and information generated through use of the mobile app | Registering you for, and enabling your use of, the mobile app. | Contract | For the duration of the user’s account and for up to 2 years following account closure or last use of the app |
Clients, Prospective Clients, Former Clients | Name, email address, phone number, company you work for | Sending marketing communications and other company updates | Consent | 2 years following last meaningful contact or when you withdraw your consent |
Where Personal Data is processed because it is necessary for the performance of a contract to which you are a party, we will be unable to provide our services without the required information.
There may be instances where we need to process Special Category Personal Data, such as health, race or ethnicity information. We will ensure the relevant special conditions are met and documented where required by law.
Our services are not designed for children or those under the age of 18. If we do become aware of anyone using our services who may be under 18, we will take all reasonable steps to ensure we do not process their data any further and will communicate this to them directly.
Please note, Personal Data will not be used for any automated decision-making processes, including profiling, with legal or similarly significant effects on Data Subjects.
We may need to share your Personal Data with other departments and members of our organisation, such as IT / technical support (including any help and assistance with our AI service offering).
There may also be instances where we may need to share your Personal Data with any competent law enforcement body, regulatory organisation, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation or (ii) to exercise, establish or defend our legal rights.
There may be instances where we need to transfer your Personal Data outside the UK or the European Economic Area (the EU member states, plus Norway, Iceland and Liechtenstein – “EEA”). This is because the organisations we use to provide our service to you are based outside the UK or EEA.
We have taken appropriate steps to ensure that when your Personal Data is processed in a country outside the UK or EEA, it does not have a materially lower level of protection than that guaranteed in the UK or EEA. We do this by ensuring that:
These measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this notice.
We may at times use processors to help us fulfil our contractual duties and obligations. We have put in place agreements with them and ensured the correct data protection language, obligations and responsibilities are incorporated in these agreements. A list of sub-processors is available upon request by contacting us using the details below.
We use cookies on our websites. More information to how we use cookies can be found in our Cookie Notice available here.
This website contains links to other websites, which are clearly marked as such. Please note that we have no control over external websites and are not responsible for the protection and privacy of any information which you may provide to them.
We would like to send you marketing news and updates regarding our company, products and services. You can opt into marketing communications by filling out the form at the bottom of our website.
In order to send you marketing communications, we require your consent. You can withdraw this consent at any time (i.e. opt out) by clicking on the relevant unsubscribe link at the bottom of the email. You also have the ability to opt out by contacting us using the details below. We do not sell your personal data to anyone for any purpose.
We do not make any decisions about you based solely on automated decisions.
We regularly review our data retention practices ensuring we only retain Personal Data for as long as necessary, in line with our data processing activities. We have created a Personal Data Retention Policy to help document relevant retention periods.
As a Controller we will retain Personal Data for as long as is necessary for the purposes of the processing and a reasonable time afterwards. As a Processor we will retain Personal Data as determined by our client Controllers. When Personal Data is to be deleted we will either delete it manually or anonymise it if deletion is not possible.
We may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of our business. Any Personal Data that you have provided will, where it is relevant to any part of our business that is being transferred, be transferred along with that part and the new owner or newly controlling party will be permitted to use that data only for the purposes for which it was originally collected by us.
We are ISO 27001 certified and copies of our certification are available upon request. We have also put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions and are subject to a duty of confidentiality.
If you are based in the UK or EEA, you have certain rights in relation to the processing of your Personal Data, including:
You have the right to know what personal data we collect about you, how we use it, for what purpose and in accordance with which lawful basis, who we share it with and how long we keep it. We use our privacy notice to explain this.
You have the right to receive a copy of the Personal Data we hold about you.
You have the right to have any incomplete or inaccurate information we hold about you corrected.
You have the right to ask us to delete your Personal Data.
You have the right to object to us processing your Personal Data. If you object to us using your Personal Data for marketing purposes, we will stop sending you marketing material.
You have the right to restrict our use of your Personal Data. This means that you can ask us to suspend the processing of your Personal Data, in certain circumstances, such as where you contest the accuracy of your Personal Data.
You have the right to ask us to transfer your Personal Data to another party.
You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We do not use automated decision-making.
If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.
How to exercise your rights
You will not usually need to pay a fee to exercise any of the above rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
If you wish to exercise your rights, you may contact us using the details set out below within the section called ‘How to contact us and our Data Protection Officer’. We may need to request specific information from you to confirm your identity before we can process your request. Once in receipt of this, we will process your request without undue delay and within one month. In some cases, such as with complex requests, it may take us longer than this and, if so, we will keep you updated.
You have the right to complain if you consider that we have not complied with the data protection law when handling your Personal Data. We will acknowledge receipt of your complaint within 30 days, investigate the matter without undue delay, and keep you informed of the progress and outcome. If you wish to complain please use the contact details given below under “How to contact us and our Data Protection Officer”. We will do our best to resolve the matter to your satisfaction.
If you are not satisfied with the outcome of your complaint, you can complain with the relevant supervisory authority. The supervisory authority in the UK is the Information Commission who can be contacted online at:
Or by telephone on 0303 123 1113
For supervisory authorities in other countries within the EU see the link below:
https://edpb.europa.eu/about-edpb/about-edpb/members_en
We do not offer our products and services to children and we do not knowingly collect Personal Data of children without parental consent, unless permitted by law. If you learn that a child has provided us with their Personal Data without parental consent, you may contact us, as described below, and if appropriate, we will securely and permanently delete it, in accordance with applicable law.
We will review this notice and make changes to it from time to time. We recommend you check this notice to see where changes have been made and to ensure you are able to always review updated information.
If you wish to contact us in relation to this privacy notice or if you wish to exercise any of your rights outlined above, you may contact our head office using the following details:
58 Morrison Street,
Edinburgh,
Scotland.
EH3 8BP
Email: info@aveni.ai
Phone: +44 (0)3330 165 242
Or you may contact our Data Protection Officer as follows:
Evalian Limited
West Lodge
Leylands Business Park
Colden Common
Hampshire
SO21 1TH
United Kingdom
Email: dpo@evalian.co.uk
Phone: +44 (0)333 050 0111
Last updated: 07th July 2026
