How Corevanta Advisory collects, uses and protects personal information — on this website, when you get in touch, and in the work we do for our clients.
Version
1.0
Last updated
19 October 2026
1Who we are
Corevanta Advisory Ltd (“Corevanta”, “we”, “us”) is a private limited company registered in England and Wales, company number 17338483, with its registered office at First Floor, Office R06, 35 Haymarket, London SW1Y 4HA.
For the personal information described in this policy we are the controller — the organisation that decides how and why it is used — except where section 6 explains that we act on a client’s behalf.
You get in touch by email, phone or the brief form
Name, email address, phone number, organisation, your message and anything you attach
Replying, arranging a first conversation, understanding what you need, preparing a proposal
Steps you ask us to take before a contract; our legitimate interest in answering enquiries
12 months after our last contact, if no work follows
Your organisation becomes a client
Names, roles and contact details of the people we work with, correspondence, proposals, invoices and engagement records
Delivering the engagement, invoicing, keeping proper accounts
Our contract; legal obligations (tax and accounting); legitimate interests
For the engagement, then six years after the end of the financial year in which it ended
We interview you or run a workshop you attend
Your name and role, and notes of what you tell us
Understanding how the organisation works, so we can advise the client (see section 7)
Legitimate interests of our client and of us in delivering the engagement
Deleted within 90 days of the end of the engagement
You work with us as an associate or supplier
Contact, payment and qualification details
Working with you and paying you
Our contract with you; legal obligations
Six years after the end of the financial year in which we last worked together
You visit this website
Nothing collected by the site itself. Our hosting may keep technical logs: IP address, time, page requested and browser type
Keeping the website secure and working
Legitimate interests
A short period, normally no longer than 30 days
We don’t make decisions about anyone by automated means alone, and we don’t build marketing profiles of the people we deal with.
3Our lawful bases
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 we may use personal information only when we have a lawful basis. We rely on:
Contract — to do work you’ve asked for, or to take steps you’ve asked for before a contract, such as preparing a proposal.
Legal obligation — for example, keeping accounting records for HMRC.
Legitimate interests — answering enquiries, delivering engagements and running and protecting our business and this website, where those interests aren’t outweighed by your rights. You can object at any time (section 11).
Consent — only where we ask for it specifically, for example before quoting you by name or naming your organisation as a client. You can withdraw consent at any time.
We don’t ask for special category information (such as health, ethnicity or trade union membership). If a client shares any as part of an engagement, we use it only as their instructions allow, and handle it with extra care.
4This website: cookies, storage and links
No cookies. This website doesn’t set cookies and doesn’t use analytics, advertising or social-media tracking.
Session storage. When you move from one page to the next, the site keeps a one-word note (cv-aperture) in your browser’s session storage so it can play the page transition. It contains no personal information, is never sent to us and disappears when you close the tab. The site works the same if your browser blocks it.
Links to other websites. If you choose to follow a link — to open our address in a map service, for example, or to view the public register at Companies House — that website is covered by its own privacy policy.
5The brief form and email
The form on our contact page doesn’t send anything to us or store anything on this website. When you press “Send brief by email”, it opens your own email app with your message filled in; nothing reaches us until you send it. From then on, your message is handled as described in section 2.
Our email is provided by Microsoft (Outlook.com), which processes messages on our behalf. Email isn’t a secure channel for confidential material: please don’t send sensitive documents with a first enquiry. If an engagement needs them, we’ll agree a secure way to share them.
6When we work for a client
In an engagement a client may give us information about its people — organisation charts, role descriptions, workload or performance data, survey results. That information belongs to the client. We act as its processor: we use it only on the client’s documented instructions and for the engagement, keep it confidential, and delete or return it when the work ends, normally within 90 days of completion unless the client asks us to keep it.
We ask clients to share only what the work needs, and to anonymise or aggregate data wherever that will do. On request we’ll sign a data processing agreement that meets Article 28 of the UK GDPR.
We don’t put confidential client material into public AI tools. If a tool would genuinely help, we’ll tell the client in advance and use only a service that doesn’t keep or learn from the data — and only with the client’s agreement.
7If we interview you
Much of our work starts with conversations with the people closest to the work. If your organisation has asked us to interview you or to run a workshop you take part in:
we’ll tell you at the start who we’re working for and what the conversation is for;
we report themes and evidence, not who said what. We won’t attribute a comment to you without your permission;
our notes are kept confidential to the engagement team and deleted within 90 days of the end of the engagement;
we don’t record conversations unless everyone present agrees beforehand.
You have the rights described in section 11, and you’re welcome to ask us any questions before or after we speak.
8Who we share it with
We never sell personal information or share it for marketing. We share it only with:
associates working with us on an engagement, who are bound by confidentiality and data protection terms;
providers that run our business — email, file storage, video calls and accounting software — under contracts that require them to protect it;
our accountants, lawyers and insurers, where needed;
public authorities such as HMRC, the police or a court, where the law requires it.
9International transfers
Some of our providers may store or process information outside the UK. When personal information leaves the UK we make sure it stays protected — for example because the destination is covered by UK adequacy regulations (including the UK–US Data Bridge for certified US organisations), or by using the ICO’s International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Ask us for the safeguards that apply to you.
10How we protect it
Access to client material is limited to the people working on the engagement. Our accounts use multi-factor sign-in, our devices are encrypted, and files travel over encrypted connections. Associates accept confidentiality terms before they see anything.
If a breach puts your information at risk, we’ll tell you without undue delay and report it to the Information Commissioner’s Office (ICO) where the law requires.
11Your rights
You have the right to:
ask for a copy of the personal information we hold about you;
ask us to correct anything that’s wrong or incomplete;
ask us to delete it, or to restrict how we use it;
object to our use of it where we rely on legitimate interests;
receive information you gave us in a portable format, or have it sent to another organisation;
withdraw your consent, where we rely on it.
To use any of these rights, write to corevantaadvisory@outlook.com. We’ll respond within one month, usually free of charge, and may first need to confirm your identity. Where we hold your information as a client’s processor (section 6), we’ll pass your request to the client and help them answer it. Some rights have limits — we must keep accounting records for as long as the law requires, for example — and if one applies, we’ll explain why.
12Complaints
If you’re unhappy with how we’ve handled your personal information, please tell us first at corevantaadvisory@outlook.com. We’ll acknowledge your complaint within 30 days, look into it without undue delay and tell you what we’ve found and what we’ll do.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
13Children
Our services are for organisations and the adults who run them. We don’t knowingly collect information from anyone under 18.
14Changes to this policy
We’ll update this policy when the way we handle information changes, and show the new date at the top of the page. If a change matters to people we’re already working with, we’ll tell them directly.