Privacy Notice

1Who is responsible for your information

The data controller is UNOUI LTD, trading as unoui™ (“unoui”, “we”, “us” or “our”). UNOUI LTD is registered in England and Wales under company number 17362856. Its registered office is 12 Moorhey Road, Liverpool, United Kingdom, L31 5LQ.

Privacy enquiries and data-rights requests can be sent to privacy@unoui.co.uk or by post to the registered office above, marked “Privacy”.

For customer account, billing, relationship-management and our own legal records, UNOUI LTD generally acts as controller. Where a business customer determines why and how personal data is included in an ARI engagement and UNOUI LTD handles that data only to deliver the contracted service, the customer is controller and UNOUI LTD is processor under the applicable Data Processing Agreement.

2Information we collect

• Identity and contact details, including name, work email and telephone number.
• Organisation details, role, size, industry and business requirements.
• ARI assessment responses, scores, recommendations, reports and review notes.
• Enquiries, correspondence, meeting notes and support communications.
• Recruitment information, including CVs, employment history, professional profiles and application correspondence.
• Order, billing, transaction and payment-status information. Full card details are handled by Stripe and are not stored by unoui.
• Technical and security information such as IP address, browser information, timestamps and authentication records.
• Website preferences and consent records.

Please do not include special-category personal data, confidential personal case information or unnecessary personal data in an ARI response. The assessment is intended to evaluate organisations, not individuals.

3Why we use it and our lawful bases

Where we rely on legitimate interests, we consider whether the use is necessary and proportionate and balance it against the rights of the individual. You can object to direct marketing at any time.

4ARI scoring and human review

ARI applies predetermined scoring rules to assessment answers and may use automated processing to calculate readiness and identify potential priorities. These outputs support an organisational assessment; they are not decisions that produce legal or similarly significant effects about an individual. Executive reports are intended to receive human quality review before release.

5Who receives information

We use carefully selected service providers where necessary, including:

• Supabase for database hosting, authentication, assessment storage, website enquiries and private recruitment-file storage.
• Vercel for website hosting, delivery and operational logs.
• Zoho Mail for business-email delivery and storage.
• Porkbun for domain registration and DNS services.
• Stripe for payment processing once paid checkout is activated.
• Google Analytics for optional website usage measurement, only after consent.
• Professional advisers, insurers, auditors or authorities where reasonably required or legally obliged.

Providers may act as processors under contractual obligations or as independent controllers for limited purposes described in their own notices. We do not sell personal information.

6International transfers

Some technology providers may process information outside the UK. Where a restricted transfer occurs, we require a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, and any required data-protection assessment.

7How long we keep information

• Unconverted enquiries and priority leads: normally up to 24 months after the last meaningful contact.
• Customer Personal Data processed on a customer's behalf: for the service term and retrieval period, then normally deleted from active systems within 30 days and from protected backups within 90 days, unless the Order Form or law requires otherwise.
• Customer contracts, final reports, material correspondence and supporting commercial records that UNOUI LTD holds as controller: normally six years after the engagement ends, where needed for contractual, insurance or legal purposes.
• Invoices and accounting records: normally six years or any longer period required by tax or company law.
• Security and operational logs: normally up to 12 months unless a longer period is needed to investigate an incident.
• Google Analytics event data: according to the retention period configured for our Analytics property; Analytics cookies may remain for up to two years unless you withdraw consent or clear them sooner.
• Unsuccessful recruitment applications: normally up to six months after the relevant process ends, unless you ask us to consider you for future opportunities, in which case normally up to 12 months.
• Marketing records and suppression preferences: until consent is withdrawn or the record is no longer needed; a minimal suppression record may be retained to respect an opt-out.

We may keep information longer where required by law, a dispute, fraud prevention or a regulatory request. Data may persist briefly in protected backups before being overwritten.

8Security

We apply measures appropriate to the risk, including access controls, authentication, row-level database security, encrypted connections, restricted administrator access, backups and service monitoring. No internet service can guarantee absolute security. If a breach creates a reportable risk, we will follow applicable notification requirements.

9Your rights

Depending on the circumstances, UK data-protection law gives you rights to be informed; access your information; correct inaccurate information; request erasure or restriction; object to processing; receive portable information; withdraw consent; and raise concerns about certain automated processing. These rights are not absolute.

Email privacy@unoui.co.uk to exercise a right. We normally respond within one month and may need to verify your identity. You may also complain to the Information Commissioner's Office.

10Cookies and website storage

Details of storage used by the website and your choices are in our Cookie Notice. Google Analytics is blocked until you consent. You can reject it without losing access to the site and change your choice at any time through “Cookie settings” in the footer.

11Updates

We may update this notice when our services, suppliers or legal obligations change. Material changes will be highlighted where appropriate. The date at the top identifies the current version.