Privacy notice

Who is responsible for your data

You use the Efficentia platform through your organisation. Your organisation is the controller of your account and of everything it puts into the platform. Efficentia Ltd provides the platform and processes that data only on your organisation's instructions, under a data processing agreement with it.

For questions about your data, or to exercise your rights over it, contact your organisation first. If you contact us instead, we will pass your request to them.

Efficentia Ltd, company number 17125516, 33 St. Vincent Road, Walton-On-Thames, England, KT12 1PA. Contact: info@efficentia.co.uk.

What we hold

• Your account: name, business email address, role, and the multi-factor authentication you set up.
• What your organisation provides: uploaded documents and the text extracted from them, chat messages and prompts, generated documents, and audit records such as interview notes.

Where Efficentia decides

We are the controller for a small amount of data we need to run the platform securely: sign-in and security records, and records of the service emails we send you, such as invitations and password resets. We rely on our legitimate interest in keeping the platform secure and working.

Who else processes it

We use two providers, each bound by data processing terms and acting only on our instructions:

• Amazon Web Services (Amazon Web Services EMEA SARL): hosting, storage, sign-in and security, in London.
• Anthropic (Anthropic Ireland, Limited): AI processing for drafting, analysis and reading documents, carried out in the United States. Anthropic may not use your data to train its models.

Transfers to Anthropic are protected by the UK Addendum to the EU Standard Contractual Clauses, which forms part of Anthropic's data processing terms, and we have assessed the risks of the transfer. Everything else is held in the UK. We tell organisations before adding a new provider.

How we protect it

• Encryption in transit and at rest.
• Multi-factor authentication for every account.
• Access restricted by role, and each organisation's data kept separate from every other's.
• Regular encrypted backups with tested recovery.
• Confidentiality obligations for everyone with access.

How long we keep it

Your organisation's data is kept while its account is open. When the account closes, or earlier if your organisation asks, we delete it. Copies in our encrypted backups are removed automatically within about 40 days. Security and system logs are kept for up to 90 days.

Cookies

The platform uses only the cookies needed to keep you signed in securely. There are no analytics or advertising cookies.

Your rights

Under UK GDPR you can ask for access to your data, correction, erasure, restriction, or a copy to take elsewhere, and you can object to processing. For data your organisation controls, ask your organisation. For the data we control, contact info@efficentia.co.uk. We respond within one calendar month.

You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.