Privacy Notice
How ORVIA collects, uses, shares and protects personal information.
Who is the controller
The controller is ORVIA Oversight Ltd, registered in England and Wales, company number 16123685, registered office ORVIA Oversight Ltd, 3rd Floor, 86–90 Paul Street, London EC2A 4NE. ORVIA is registered with the Information Commissioner’s Office under registration ZC152311.
For any question about this notice or about your information, contact [email protected] or telephone 0114 399 8231.
ORVIA has not appointed a statutory Data Protection Officer under UK GDPR Article 37. Data protection questions and rights requests are handled by the ORVIA Data Protection Contact at [email protected]. If ORVIA’s processing activity later triggers the Article 37 threshold, a DPO will be appointed and named here.
What information we collect
| Enquiry information | Your name, the contact details you give us and the description of your situation that you choose to send. |
|---|---|
| Engagement information | Where a matter proceeds: the written scope, correspondence, the document register and the evidence you supply. |
| Case evidence | Records created by other organisations that you send to us, which may name people other than you. |
| Practitioner information | Professional profiles sent to us by people asking to be considered for the practitioner network. |
| Technical information | Information handled by our website host in order to serve this website. |
Special category and criminal offence information
Safeguarding and evidence-review material frequently contains special category data – for example health, disability, ethnicity, religion, sexual life or trade union information – and information about alleged or actual criminal offences. Please do not send confidential evidence with your first enquiry.
Why we use it, and our lawful basis
| Activity | Lawful basis |
|---|---|
| Responding to your enquiry and deciding whether ORVIA is suitable | Legitimate interests – responding to a request you have made to us; or steps towards a contract. |
| Carrying out a review under a written scope | Performance of a contract with you; or legitimate interests where the client is an organisation. |
| Handling special category evidence within a review | Explicit consent, or the substantial public interest condition for safeguarding, or establishing, exercising or defending legal claims – identified for the specific matter and recorded in writing. |
| Considering a practitioner expression of interest | Legitimate interests – assessing suitability for work you have asked to be considered for. |
| Complying with law, and cooperating with a safeguarding or statutory referral | Legal obligation, or the safeguarding condition in substantial public interest. |
| Keeping our own records of decisions and accountability | Legitimate interests – maintaining a traceable, accountable record of our work. |
Where we rely on legitimate interests, we have considered the effect on the people concerned. You can ask us for that assessment.
We do not use your information for marketing, and we do not sell it. We do not make automated decisions about you that have a legal or similarly significant effect.
AI-assisted processing and human review
ORVIA uses AI-assisted quality assurance within its structured review process to support consistency, document quality and disciplined analysis. All findings, recommendations and conclusions are reviewed and approved by an authorised human before release. Technology supports the ORVIA Method. It does not replace professional judgement, human accountability or approval.
The specific AI-assisted steps include: drafting and formatting assistance for internal review documents; consistency checks against ORVIA’s method and standards; and language quality assurance. AI is not used to make safeguarding, legal, regulatory, membership or Gate decisions.
ARVIA, ORVIA’s conversational guidance service, can help visitors find the right route and record the information they choose to provide. ARVIA does not make safeguarding, legal, regulatory or eligibility decisions. Any enquiry requiring action is reviewed by an ORVIA human decision-maker.
Safeguarding information
Where a submission indicates a safeguarding concern or that someone may be at immediate risk, ORVIA will:
- display and repeat the 999 emergency notice;
- mark the corresponding Monday.com record as high priority;
- assign a responsible ORVIA person and create an urgent human-review task;
- record the time the concern was received and the emergency guidance shown;
- cooperate with any statutory safeguarding referral without holding, delaying or filtering it.
ORVIA does not promise emergency intervention. ORVIA and ARVIA are not emergency services.
Who we share it with
We share personal information only where there is a reason to:
- with you, and with anyone you tell us in writing to include;
- with the client organisation where the review has been commissioned by an organisation, within the agreed written scope;
- with a local authority safeguarding service, the police or another statutory body where a safeguarding concern requires it – ORVIA does not hold, delay or filter a statutory referral;
- with our professional advisers and insurers where necessary;
- with our technology suppliers, who process information on our instructions only.
Suppliers and processors ORVIA uses
ORVIA uses the following categories of supplier to run this website and the operational systems that support it. Each processor operates on written instructions from ORVIA under UK GDPR Article 28 terms. This list is kept current as suppliers are added or removed.
| Category | Supplier | What they process |
|---|---|---|
| Website hosting | Perplexity AI, Inc. (temporary hosting during launch; permanent host to be named in the next version of this notice) | Website pages, request logs, connection metadata. |
| Operational record system | monday.com Ltd | Enquiry records, membership leads, case owners, action tracking, ORVIA references. |
| Productivity, email and secure workspace | Microsoft Corporation — Microsoft 365, Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams | Email, documents, secure evidence workspace, internal collaboration. |
| Appointment booking | Microsoft Bookings (part of Microsoft 365) | Booking requests, appointment times, contact details supplied by the visitor. |
| ARVIA conversational guidance | ARVIA is an ORVIA-controlled conversational service hosted through the same infrastructure as the website. Conversations are recorded to a Monday.com enquiry when the visitor chooses to submit them. | Conversation content the visitor chooses to share, route selected, ORVIA reference generated. |
| Integration layer | ORVIA-controlled server endpoint (proxied through Perplexity AI infrastructure during launch) | Website form submissions in transit between the browser and Monday.com. Submissions are not retained by the integration layer once written to Monday.com. |
| Telephony | Gamma Telecom Holdings Ltd (Operator Connect) with Microsoft Teams Phone | Inbound and outbound calls, voicemail, call metadata. |
| Payments (once activated) | Stripe Payments Europe Ltd | Payment card and billing information for members and clients. Not currently in use. |
| Analytics | Not currently deployed. If deployed, the supplier and its purpose will be listed here before any analytics data is collected. | — |
ORVIA does not use FormSubmit or any other third-party form relay. Website forms submit directly to the ORVIA-controlled endpoint, which writes to Monday.com. No enquiry is passed through an uncontrolled public form service, personal email inbox, Zapier, Make or any consumer form product.
Transfers outside the UK
ORVIA’s intention is to keep case evidence, membership records and safeguarding information within the United Kingdom. The following suppliers may involve access to or storage of personal information outside the UK:
- Microsoft 365 (Exchange Online, SharePoint Online, OneDrive for Business, Teams, Bookings) – ORVIA’s Microsoft 365 tenant is configured with EU data residency (Ireland, Netherlands) where available. Support access from other Microsoft regions is governed by Microsoft’s Data Protection Addendum, which incorporates the UK International Data Transfer Addendum.
- monday.com – monday.com is an Israeli company that processes customer data in the EU. ORVIA relies on the UK adequacy regulations (Israel) and monday.com’s standard data processing terms.
- Stripe (once activated) – Stripe Payments Europe Ltd processes payments in Ireland with support access from the United States under the UK International Data Transfer Addendum.
- Website hosting during launch – Perplexity AI infrastructure processes website traffic in the United States under the UK International Data Transfer Addendum. ORVIA does not send case evidence or safeguarding disclosures through the website host’s systems – only enquiry forms and general website content.
Case evidence and safeguarding disclosures are held inside the ORVIA Microsoft 365 tenant with UK/EU data residency. They are not synchronised outside that tenant.
How long we keep it
We keep personal information only for as long as we need it, and we apply these criteria:
- an enquiry that does not proceed is kept only as long as needed to record the decision not to proceed;
- a declined matter is kept only as long as needed to evidence why it was declined;
- an active case is kept for the life of the engagement;
- a closed case is kept for the period needed to answer questions about the findings, to meet insurance and legal requirements, and no longer;
- information under a legal hold is retained until the hold ends.
The full retention schedule – setting the exact periods against professional indemnity terms and legal advice – is published on the Data Protection & Retention page and updated as periods are formally settled. This notice states the criteria used to set those periods.
Your rights
Subject to the conditions in UK data protection law, you have the right to be informed, to request a copy of your information, to have inaccurate information corrected, to ask for erasure, to ask us to restrict processing, to object to processing based on legitimate interests, to data portability where it applies, and to withdraw consent where we rely on consent.
Some rights are limited. For example, we may not be able to erase material that forms part of the accountability record of a review, or that we must keep for a legal claim.
To exercise a right, email [email protected]. We will respond within one month, and will tell you if we need longer.
Complaints
If you are unhappy with how we have handled your information, please tell us first through our Complaints Procedure. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
This is version 1.1, effective 4 August 2026, with a next review date of 4 February 2027. It will be reviewed earlier if our systems, suppliers or services change.
What changed in v1.1: the internal “launch gate” placeholders were removed and the real live-system suppliers and processors (Monday.com, Microsoft 365, Microsoft Bookings, ARVIA, ORVIA integration layer, Gamma / Microsoft Teams Phone, Stripe) are now named. A dedicated section on AI-assisted processing and human review, and a dedicated safeguarding section, were added.