Privacy Policy

Your AI Work Platform – Your Privacy Matters

Welcome to Avantwerk. This Privacy Policy explains how Avantwerk ("we", "us", "our") collects, uses, discloses, and protects your personal data when you use our AI-powered SaaS platform at www.avantwerk.co.uk, our application at app.avantwerk.com, engage our professional implementation services, and all related services. We are committed to complying with the UK GDPR, EU GDPR, the Data Protection Act 2018, Polish data protection laws, and all applicable regulations.

Contents

1. Definitions

2. Data Controller Information

2.1 When Avantwerk Acts as Data Controller

Avantwerk is the data controller for personal data collected directly from you when you visit our website, create an account, subscribe to our services, engage our professional services, contact our support team, or engage with our marketing communications.

2.2 When Avantwerk Acts as Data Processor

When you use our Platform to manage your own customer data, Avantwerk acts as a data processor on your behalf. You remain the data controller for your customers' personal data. Our processing activities are governed by our Data Processing Agreement (DPA).

2.3 Company Details

Avantwerk is operated by Bennovate sp. z o.o., a Polish limited liability company.

3. Information We Collect

3.1 Information You Provide Directly

Account Registration

When you create an account, we collect your name, email address, telephone number, company name, job title, country, and preferred language.

Subscription and Payment

When you subscribe, we collect billing information including name, billing address, VAT number (if applicable), and payment method details. Payment processing is handled by Stripe, Inc., our PCI-DSS compliant processor. We do not store full credit card numbers. See Stripe's Privacy Policy.

Professional Services

When you engage our Implementation Services, we additionally collect:

• Business requirements and project specifications
• Technical environment information
• Contact details for project stakeholders
• Existing system and data migration requirements
• Training participant information

3.2 Information Collected Automatically

We automatically collect device information (IP address, browser type, operating system), usage data (pages visited, features used, navigation paths), and log data (access times, referring URLs, error logs).

3.3 Information from Third Parties

• Authentication Services: If you sign in using Google, Microsoft, or other providers
• Integration Partners: When you connect third-party applications
• Business Partners: Contact information from authorised partners with your consent
• Payment Processor: Transaction status and fraud prevention data from Stripe

4. Legal Basis for Processing

5. How We Use Your Information

5.1 Service Delivery

• Providing access to the Platform and its features
• Processing and managing your subscription
• Hosting your websites and managing your CRM data
• Executing marketing automation workflows
• Operating AI chatbots and communication tools
• Providing customer support and technical assistance

5.2 Platform Improvement

• Analysing usage patterns to enhance features
• Conducting research and development
• Testing new functionalities
• Identifying and fixing bugs

5.3 Security and Compliance

• Protecting against fraud, abuse, and security threats
• Verifying identity and preventing unauthorised access
• Complying with legal and regulatory requirements
• Enforcing our Terms of Service

6. AI and Automated Processing

6.1 AI-Powered Features

• AI Chatbots: Automated customer service agents
• Content Generation: AI-assisted marketing content creation
• Predictive Analytics: Machine learning for business insights
• SEO Optimisation: Automated website optimisation
• Lead Scoring: Algorithmic evaluation of customer value

6.2 Automated Decision-Making

In accordance with Article 22 of GDPR, we do not make solely automated decisions that produce legal effects without human oversight. You have the right to request human intervention and contest automated decisions.

6.3 AI Training and Data Use

We may use aggregated, anonymised data to improve our AI models. Client Data is not used for AI training without explicit consent. You can opt out of AI-assisted features through your account settings.

7. Professional & Implementation Services

7.1 Implementation Packages

7.2 Data Processed During Implementation

• Project Stakeholder Data: Names, roles, contact details
• Business Process Information: Workflows and operational data
• Migration Data: Data from existing systems for import
• Training Records: Attendance and completion status
• Communication Records: Project correspondence and documents

7.3 Implementation Partner Data Sharing

Implementation services may be delivered by Avantwerk directly or by Certified Implementation Partners from the Bennovate network. Partners operate under strict confidentiality agreements and must comply with this Privacy Policy.

8. Data Sharing and Disclosure

We do not sell your personal data. We share information only in the following circumstances:

8.1 Service Providers

• Cloud hosting and infrastructure (data centres in EU/UK)
• Payment processing (Stripe, Inc.)
• Email delivery services
• Analytics and monitoring tools
• Customer support platforms

All providers are bound by data processing agreements. See our Subprocessors list.

8.2 Legal Requirements

We may disclose personal data when required by law, regulation, court order, or government request, or to protect our rights, property, or safety.

8.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal data may be transferred with appropriate protections.

9. International Data Transfers

Avantwerk is operated from Poland (EU) and provides services globally. When we transfer personal data outside the EEA or UK, we ensure protection through:

• Adequacy Decisions: Transfers to countries with adequate data protection
• Standard Contractual Clauses (SCCs): EU-approved contractual safeguards
• UK IDTA: UK-specific mechanisms for international transfers

Our payment processor, Stripe, participates in the EU-U.S. Data Privacy Framework.

10. Data Security

10.1 Technical Measures

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Secure authentication including multi-factor authentication (MFA)
• Regular security assessments and penetration testing
• Intrusion detection and prevention systems
• Automated backup and disaster recovery

10.2 Organisational Measures

• Role-based access controls
• Staff training on data protection
• Incident response procedures
• Regular security audits

11. Data Retention

12. Your Rights

Under the UK GDPR, EU GDPR, and applicable data protection laws:

How to Exercise Your Rights

Contact us at [email protected] or use the data subject request form in your account settings. We respond within one month.

Supervisory Authorities

• Poland: UODO – uodo.gov.pl
• UK: ICO – ico.org.uk
• EU: Your local authority – EDPB Members

13. Cookies and Tracking

We use cookies and similar technologies. See our Cookie Policy for details.

• Essential Cookies: Required for Platform operation
• Functional Cookies: Remember your preferences
• Analytics Cookies: Help us understand usage (with consent)
• Marketing Cookies: For targeted advertising (with consent)

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: