Privacy Policy
Section 1
Controller Information
UCVreg is a product of UnicodeVision Limited, registered in England and Wales.
UnicodeVision Limited acts as the Data Controller for personal data processed in connection with the UCVreg website and platform.
Section 2
Scope
This Privacy Policy applies to:
- Visitors of the UCVreg website
- Registered users of the UCVreg platform
- Representatives of customer organizations
It does not apply to data that customers upload into the platform in their capacity as independent controllers (see Section 5).
Section 3
Categories of Personal Data
A. Identity & Contact Data
- Name
- Business email address
- Company name
- Job title
- Contact form submissions
B. Account & Authentication Data
- Login credentials (hashed)
- Account identifiers
- Access logs
C. Usage & Technical Data
- IP address
- Device type
- Browser type
- System logs
- Timestamps
- Interaction events
D. Payment & Billing Data
Payments are processed by Stripe, Inc. or Stripe Payments Europe Ltd.
- We do not store full payment card details.
- Stripe acts as an independent Data Controller.
Section 4
Purpose of Processing
We process personal data to:
- Provide and operate the UCVreg platform
- Manage subscriptions and billing
- Authenticate users
- Maintain platform security
- Monitor system integrity
- Provide support
- Comply with legal and regulatory obligations
- Prevent fraud and abuse
We do not sell personal data. We do not use personal data for automated profiling.
Section 5
Customer Data vs Platform Data
UCVreg customers may upload regulatory or operational data into the platform. In such cases:
- The customer remains the Data Controller.
- UnicodeVision acts as a Data Processor.
- Processing is governed by a Data Processing Agreement (DPA).
We process customer data only under documented instructions.
Section 6
Legal Basis
Under UK GDPR and EU GDPR, processing is based on:
Primary Bases
- Contractual necessity (Art 6(1)(b))
- Legitimate interests (Art 6(1)(f))
- Legal obligation (Art 6(1)(c))
- Consent (Art 6(1)(a), where required)
Legitimate Interests
- Platform security
- Fraud prevention
- Service performance monitoring
- Product improvement
Section 7
International Data Transfers
UCVreg infrastructure may involve cloud providers located outside the UK or EU. Where personal data is transferred outside the UK or EEA, we ensure lawful transfer through:
- Adequacy decisions (where applicable)
- Standard Contractual Clauses (SCCs)
- UK International Data Transfer Addendum
- Supplementary technical safeguards, including encryption and access controls
Data transfers are assessed under a documented Transfer Risk Assessment (TRA) process.
Section 8
Data Retention
Retention periods are determined by contractual duration, regulatory requirements, security logging necessity, and accounting obligations.
| Data Type | Retention Period |
|---|---|
| Account data | Duration of contract + up to 6 years |
| Billing records | In accordance with UK tax law |
| Security logs | Based on operational necessity |
| Marketing data | Until consent is withdrawn |
Regulatory artifacts may be retained in accordance with statutory obligations (often 10+ years).
Section 9
Security Measures
We implement technical and organizational measures including:
- Encryption in transit (TLS)
- Role-Based Access Control (RBAC)
- Tenant isolation
- Cryptographic anchoring of regulatory artifacts
- Audit logging
- Secure cloud infrastructure
- Least-privilege access policies
Details are available on our Security page.
Section 10
Your Rights
You have the right to:
- Access your personal data
- Request correction
- Request erasure
- Restrict processing
- Object to processing
- Request data portability
- Withdraw consent (where applicable)
You may lodge a complaint with the UK Information Commissioner's Office (ICO).
Section 11
Updates
We may update this Privacy Policy periodically. The latest version will always be available on our website.
© 2026 UnicodeVision Ltd. All rights reserved.