Privacy Policy

Your AI Work Platform – Your Privacy Matters

Effective Date: 1 February 2026

Welcome to Avantwerk. This Privacy Policy explains how Avantwerk (“we”, “us”, “our”) collects, uses, discloses, and protects your personal data when you use our AI-powered SaaS platform at www.avantwerk.co.uk, our application at app.avantwerk.com, engage our professional implementation services, and all related services. We are committed to complying with the UK GDPR, EU GDPR, the Data Protection Act 2018, Polish data protection laws, and all applicable regulations.

1. Definitions 2. Data Controller 3. Information We Collect 4. Legal Basis 5. How We Use Information 6. AI Processing 7. Implementation Services 8. Data Sharing 9. International Transfers 10. Data Security 11. Data Retention 12. Your Rights 13. Cookies 14. Contact Us

1. Definitions

Term	Definition
Personal Data	Any information relating to an identified or identifiable natural person.
Processing	Any operation performed on personal data, including collection, storage, use, and deletion.
Platform	The Avantwerk SaaS platform, including websites, applications, and all related services.
Client	A business or organisation that subscribes to our services or engages our professional services.
Client Data	Data uploaded, created, or processed by Clients through the Platform.
Implementation Services	Professional services including platform setup, configuration, customisation, training, and ongoing support.

2. Data Controller Information

2.1 When Avantwerk Acts as Data Controller

Avantwerk is the data controller for personal data collected directly from you when you visit our website, create an account, subscribe to our services, engage our professional services, contact our support team, or engage with our marketing communications.

2.2 When Avantwerk Acts as Data Processor

When you use our Platform to manage your own customer data, Avantwerk acts as a data processor on your behalf. You remain the data controller for your customers' personal data. Our processing activities are governed by our Data Processing Agreement (DPA).

2.3 Company Details

Avantwerk is operated by Bennovate sp. z o.o., a Polish limited liability company.

Company Name: Bennovate sp. z o.o.

Registered Office: ul. Christiana Andersena 25, 94-118 Łódź, Poland

Management Board: Bartłomiej Kubas, President of the Board

KRS: 0000597272

Registration Court: District Court for Łódź-Śródmieście, XX Commercial Division

VAT ID / NIP: PL7272799328

REGON: 363700466

Share Capital: 5,000.00 PLN (fully paid)

3. Information We Collect

3.1 Information You Provide Directly

Account Registration

When you create an account, we collect your name, email address, telephone number, company name, job title, country, and preferred language.

Subscription and Payment

When you subscribe, we collect billing information including name, billing address, VAT number (if applicable), and payment method details. Payment processing is handled by Stripe, Inc., our PCI-DSS compliant processor. We do not store full credit card numbers. See Stripe's Privacy Policy.

Professional Services

When you engage our Implementation Services, we additionally collect:

Business requirements and project specifications
Technical environment information
Contact details for project stakeholders
Existing system and data migration requirements
Training participant information

3.2 Information Collected Automatically

We automatically collect device information (IP address, browser type, operating system), usage data (pages visited, features used, navigation paths), and log data (access times, referring URLs, error logs).

3.3 Information from Third Parties

Authentication Services: If you sign in using Google, Microsoft, or other providers
Integration Partners: When you connect third-party applications
Business Partners: Contact information from authorised partners with your consent
Payment Processor: Transaction status and fraud prevention data from Stripe

4. Legal Basis for Processing

Legal Basis	When We Rely on It
Contract Performance	To provide Platform services, process subscriptions, deliver Implementation Services, and fulfil contractual obligations.
Legitimate Interests	To improve our Platform, ensure security, prevent fraud, conduct analytics, and send service communications.
Consent	For marketing communications, non-essential cookies, testimonials, and case studies.
Legal Obligation	To comply with applicable laws, regulations, court orders, and government requests.

5. How We Use Your Information

5.1 Service Delivery

Providing access to the Platform and its features
Processing and managing your subscription
Hosting your websites and managing your CRM data
Executing marketing automation workflows
Operating AI chatbots and communication tools
Providing customer support and technical assistance

5.2 Platform Improvement

Analysing usage patterns to enhance features
Conducting research and development
Testing new functionalities
Identifying and fixing bugs

5.3 Security and Compliance

Protecting against fraud, abuse, and security threats
Verifying identity and preventing unauthorised access
Complying with legal and regulatory requirements
Enforcing our Terms of Service

6. AI and Automated Processing

Transparency Notice: Avantwerk uses artificial intelligence and machine learning technologies to deliver key Platform features. We are committed to transparent AI practices.

6.1 AI-Powered Features

AI Chatbots: Automated customer service agents
Content Generation: AI-assisted marketing content creation
Predictive Analytics: Machine learning for business insights
SEO Optimisation: Automated website optimisation
Lead Scoring: Algorithmic evaluation of customer value

6.2 Automated Decision-Making

In accordance with Article 22 of GDPR, we do not make solely automated decisions that produce legal effects without human oversight. You have the right to request human intervention and contest automated decisions.

6.3 AI Training and Data Use

We may use aggregated, anonymised data to improve our AI models. Client Data is not used for AI training without explicit consent. You can opt out of AI-assisted features through your account settings.

7. Professional & Implementation Services

Service-Based Data Processing: When you engage our professional services, additional data processing occurs to deliver your project successfully.

7.1 Implementation Packages

Ignite AI

Basic setup: website, chatbot, CRM configuration

Elevate AI

Adds marketing automation and integrations

Momentum AI

Process automation and predictive analytics

Apex AI

Full customisation and enterprise integrations

7.2 Data Processed During Implementation

Project Stakeholder Data: Names, roles, contact details
Business Process Information: Workflows and operational data
Migration Data: Data from existing systems for import
Training Records: Attendance and completion status
Communication Records: Project correspondence and documents

7.3 Implementation Partner Data Sharing

Implementation services may be delivered by Avantwerk directly or by Certified Implementation Partners from the Bennovate network. Partners operate under strict confidentiality agreements and must comply with this Privacy Policy.

8. Data Sharing and Disclosure

We do not sell your personal data. We share information only in the following circumstances:

8.1 Service Providers

Cloud hosting and infrastructure (data centres in EU/UK)
Payment processing (Stripe, Inc.)
Email delivery services
Analytics and monitoring tools
Customer support platforms

All providers are bound by data processing agreements. See our Subprocessors list.

8.2 Legal Requirements

We may disclose personal data when required by law, regulation, court order, or government request, or to protect our rights, property, or safety.

8.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal data may be transferred with appropriate protections.

9. International Data Transfers

Avantwerk is operated from Poland (EU) and provides services globally. When we transfer personal data outside the EEA or UK, we ensure protection through:

Adequacy Decisions: Transfers to countries with adequate data protection
Standard Contractual Clauses (SCCs): EU-approved contractual safeguards
UK IDTA: UK-specific mechanisms for international transfers

Our payment processor, Stripe, participates in the EU-U.S. Data Privacy Framework.

10. Data Security

10.1 Technical Measures

Encryption in transit (TLS 1.3) and at rest (AES-256)
Secure authentication including multi-factor authentication (MFA)
Regular security assessments and penetration testing
Intrusion detection and prevention systems
Automated backup and disaster recovery

10.2 Organisational Measures

Role-based access controls
Staff training on data protection
Incident response procedures
Regular security audits

Important: While we take extensive measures to protect your data, no system is completely secure. We encourage you to use strong passwords, enable MFA, and protect your credentials.

11. Data Retention

Data Category	Retention Period
Active Account Data	Duration of account plus 30 days
Closed Account Data	Deleted within 90 days
Billing and Transactions	7 years (legal requirement)
Implementation Records	Duration plus 5 years
Service Agreements	10 years after completion
System Logs	90 days