Privacy Notice

This notice explains how TrueValue Technologies Ltd uses personal information in connection with the TrueValue website, deal workspace, subscriptions, support and related features. We are registered in England and Wales under company number 17462580. Our registered office is 66 Paul Street, London, England, United Kingdom, EC2A 4NA.

Contact our privacy lead at privacy@truevalue.business or write to the registered office marked “Privacy”. A privacy contact is not, by itself, a statement that we have appointed a statutory Data Protection Officer. Where an appointed representative or Data Protection Officer is legally required, their applicable details are supplied in the completed regional information below.

This notice applies to visitors, account holders, workspace users, prospective customers, business contacts, directory participants, data-room guests and signatories. It describes relevant processing, not an agreement to every possible use of information. We obtain separate consent when the law requires it.

We are a controller when we decide why and how to use information for our own purposes, such as administering subscriptions, managing our customer relationships, preventing misuse, maintaining security and conducting our own lawful marketing.

For personal information in documents, CRM records, deal rooms and AI tasks that a customer instructs us to process for its purposes, the customer normally acts as controller and we act as processor. An adviser may itself be a processor for a client, in which case we may be its subprocessor. Our DPA governs this processing. The relevant customer explains its purposes, lawful bases and sharing decisions in its own privacy information.

Where we independently compile and maintain a reusable business-contact or sourcing database, rather than solely execute a customer's instructions, we are responsible as controller for that separate activity. Sourcing features do not make all data use a processor activity. The feature's source information and this notice apply; a customer receiving information has separate obligations for its subsequent use.

To exercise rights over a customer's deal documents, contact that customer where possible. A request sent to us will be handled in accordance with our role, including referring it promptly to the relevant customer and assisting them where appropriate.

Account and professional details include names, business contact information, organisation, role, account identifiers, permissions and account settings. Billing information includes billing contacts, addresses, subscription and invoice details, transaction references and payment status. Payment providers process the payment information submitted to their payment interface.

Customer content can include financial statements, company and transaction information, contact records, communications, document text, valuation assumptions, prompts and AI outputs. Much business information is not personal data, but documents can identify owners, directors, employees, customers, guarantors or advisers.

Technical and activity information can include IP addresses, device and browser details, authentication events, timestamps, page or feature interactions, errors, access records and integration events. Guest and signature records may include an invitation address, document identifier, viewing or signing events, verification steps and the evidence captured by the selected workflow. The workflow notice explains any additional identity data.

Support and correspondence information includes messages, attachments and records needed to investigate and resolve issues. Marketing information includes communication preferences, consent records where relevant, campaign interaction data where lawfully collected and suppression records used to respect objections.

Public professional information used in enabled sourcing features may include a person's name, professional role, business contact details and relevant company associations. Sources may contain estimates or outdated information. We do not treat an estimate as verified personal information or infer sensitive characteristics merely because an AI tool can do so.

We receive information from you; the organisation that invites or authorises you; customers and their permitted contributors; connected services you or a customer enable; our payment and infrastructure providers; and people communicating with us.

For enabled sourcing and directory activities, information may come from official corporate or regulatory registers, company websites, published business listings, licensed datasets and details supplied by the listed organisation or an authorised introducer. Source categories and, where available, the particular origin and retrieval date are provided with the relevant record or on request. A public source does not remove our privacy obligations.

When we obtain your information indirectly as controller, we provide the required privacy information within the applicable period, generally no later than one month, and sooner where required on first communication or disclosure. We rely on an exception only after assessing and documenting that it applies.

The following table concerns processing for which we are controller. Processing strictly for customer instructions is instead governed by the customer's lawful basis and our DPA.

When relying on legitimate interests, we consider necessity, reasonable expectations and the potential effect on individuals. Contact us for more information about the assessment relevant to your data. We do not apply a “contract” basis to an employee simply because their employer is our customer.

Some information is necessary to create and secure an account, deliver a requested service or meet a legal duty. Where you do not provide necessary information we may be unable to provide that service; we explain this at the relevant collection point. Optional marketing consent is not required to buy the ordinary subscription.

When an AI-enabled feature is used, relevant prompts, selected documents, extracted text, context and outputs may be processed by the AI providers identified in our completed Subprocessor Register. The amount shared depends on the task. This may include personal information within a document, not merely anonymous statistics.

We do not use confidential Customer Data to train general-purpose AI models. Any separately agreed optional model-improvement use requires its own specific explanation and appropriate lawful basis. Supplier retention, abuse monitoring, human access and processing locations must be read alongside the supplier-specific information in the Subprocessor Register. We do not describe processing as “zero retention” unless that arrangement actually applies.

Customer-connected external AI clients or other integrations may receive information you authorise them to access. Their independent processing is subject to their own privacy terms. Permission to connect is not consent to unrelated uses by TrueValue, and revoking a connection does not automatically erase copies already lawfully received by that provider.

Our analysis tools support human decisions; they are not intended to make solely automated decisions about individuals that have legal or similarly significant effects, such as employment or personal credit decisions. Customers must not use them for that purpose without an appropriate, separately assessed arrangement. If we introduce our own such processing, we will provide the required explanation, lawful basis and safeguards before it begins.

Within a workspace, information is available to the users and guests authorised through the customer's permissions and sharing choices. A data-room owner may receive access and engagement records; a document sender and permitted parties may receive signing status and completion evidence. Review the invitation or workflow notice before participating.

We use providers for infrastructure, database and storage services, authentication, communications, AI processing, support and payments as relevant to the feature. The Subprocessor Register identifies providers processing Customer Personal Data on our behalf. Some providers act as independent controllers for particular activities, such as certain payment, fraud-prevention and legal-compliance functions; their role is stated separately rather than automatically calling them subprocessors.

We may share necessary information with professional advisers, insurers where relevant to an actual claim or cover, authorities where lawfully required, and a confidentially bound prospective purchaser or successor where necessary for a lawful business transaction. We minimise disclosures and apply appropriate safeguards.

We do not sell confidential customer documents or personal account information for unrelated marketing. A customer-authorised introduction or enabled professional-directory disclosure is handled for its stated purpose, not as an unrestricted permission to sell contact lists. We do not provide a founder's or related advisory business with customer deal data for its own commercial use without separate lawful authority.

Information may be processed outside the UK or the country where you are located, including through overseas support access even where primary hosting is local. The Subprocessor Register identifies the relevant locations and transfer arrangements. A UK-hosted database does not mean every supplier processes information only in the UK.

Where a restricted transfer requires a safeguard, we use a valid applicable adequacy arrangement or an appropriate contractual mechanism, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and the EU clauses where the EU GDPR applies. We undertake the required assessment and supplementary measures where applicable. We do not assume that a supplier's country or participation in a framework automatically makes every transfer covered.

Ask privacy@truevalue.business for information about a relevant transfer and a copy or meaningful description of its safeguards, subject to necessary redactions that do not prevent you understanding the protection.

Regional representative information: TrueValue Technologies Ltd is established in the United Kingdom and offers the Service principally to businesses in the United Kingdom. We have not appointed a representative in the European Union or in any other jurisdiction. If you believe a representative is required for processing that concerns you, contact privacy@truevalue.business.

The Data Retention, Export and Deletion Policy gives the applicable periods and criteria. Customer-controlled active content is normally held while the service is active and deleted or irreversibly anonymised within 30 calendar days after effective termination or a verified earlier deletion instruction, subject to lawful exceptions and a separately agreed export extension where permitted.

Protected backup copies expire within the verified maximum period in that Policy. They are not a continuing live service or a right to reuse deleted information. Billing, dispute, security and suppression records may have different, purpose-specific periods; we do not retain the entire deal workspace merely because an invoice must be retained.

Account closure, stopping renewal and erasing an individual's personal data are different actions. A person may remain mentioned in records that another controller has a lawful reason to retain. We consider rights requests individually and explain any lawful refusal or limitation.

Subject to the applicable law and conditions, you may request access, correction, erasure, restriction and a portable copy of relevant information. You may object to processing based on legitimate interests, and may withdraw consent at any time without affecting lawful processing before withdrawal. Where applicable, you have rights and safeguards concerning significant automated decisions.

You have the right to object to the use of your personal information for direct marketing, including related profiling. We will stop that use. Use the unsubscribe route in the message or contact privacy@truevalue.business. We may keep a minimal suppression record to prevent future unwanted contact. Essential service or security notices are not promotional messages and may still be sent where necessary.

Contact privacy@truevalue.business to exercise rights. We may request proportionate information to verify identity or authority, but will not routinely demand unnecessary identity documents. We respond without undue delay and within the applicable statutory period, normally one calendar month for a UK GDPR rights request. Any lawful extension or other adjustment will be explained within the required period. We do not charge a routine fee for exercising rights.

Our Cookie Policy describes storage and access technologies and the choices available. Changing marketing preferences does not necessarily change browser tracking consent; use the cookie controls as well.

We apply the security obligations described in the DPA and Security Statement. No online service can guarantee absolute security. Do not send passwords, full card details or unnecessary confidential files when contacting support.

The ordinary Service is not intended to collect children's information or unnecessary special-category or criminal-offence data. Customers should minimise and redact sensitive personal information in transaction documents and arrange any genuinely necessary sensitive processing with us in advance. If such information is received unexpectedly, we restrict handling and assess appropriate action rather than treating an accidental upload as permission for unrestricted processing.

Raise a concern with privacy@truevalue.business under our Complaints Policy. You may also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/, or another competent supervisory authority where applicable. Our internal process does not remove your right to complain to a regulator or seek a judicial remedy.

We update this notice when relevant processing changes and show its publication date. Material changes will be brought to your attention where appropriate. A new notice does not retrospectively make an incompatible use lawful or substitute for required consent.