Civic Privacy Notice

Really Helpful Products Limited operates Civic. Company number 14704244. Registered office: 84 Stanier Street, Newcastle under Lyme, ST5 2SY, United Kingdom.

For privacy questions or to exercise your rights, email hello@civic.ltd and use “Privacy request” as the subject.

Our legal role can differ by service. We act as controller for our own website, enquiries, account administration, marketing and market-intelligence activity. Where a customer asks us to process contract or participant information strictly on its behalf, we may instead act as its processor. CivicProof verification may involve controller and processor responsibilities depending on the service arrangement.

Depending on how you use Civic, we may process names, work contact details, organisation and role information, account and access records, enquiry details, public procurement and supplier-contact information, contract and evidence records, verification participation records, structured verification evidence, technical logs, delivery records and preference or objection records.

CivicProof voice verification can process live audio for transcription. Civic is designed not to retain raw audio as the durable record, and not to keep a durable verbatim participant transcript. The durable verification record is focused on structured evidence that the participant can review, correct or withdraw before finalisation.

We use personal information to provide and secure Civic services; administer organisations and users; respond to enquiries; analyse public-sector opportunities and supplier markets; support contract delivery and assurance; gather independent verification evidence; communicate service messages; improve reliability and security; meet legal obligations; and, where permitted, send relevant business marketing.

We do not use CivicProof verification as an automatic employee performance or disciplinary decision-maker. Civic evidence is intended to support accountable human judgement.

We rely on different lawful bases according to purpose. These can include performance of a contract, legitimate interests, compliance with legal obligations and consent where consent is the appropriate basis. Our legitimate interests can include operating and securing Civic, responding to business enquiries, developing public-sector market intelligence and conducting proportionate business-to-business activity.

Where special-category information is processed, we also need an applicable condition under data-protection law. Civic is designed to avoid collecting special-category information unless it is necessary for the stated purpose.

Civic Prospect uses public procurement and related public records, including Find a Tender information. Those records may contain named business contacts or other identifiable professional information. We use such information to understand public-sector demand, suppliers and commercial relationships.

If we obtain your personal information from a public source rather than directly from you, this notice provides the general privacy information for that processing. Where required, we will provide further Article 14 information directly, including at or before first contact, unless a lawful exception applies.

Verification participants receive a short purpose notice before the interview begins. Participation evidence is kept out of the normal supplier workspace and is subject to evidence-governance and visibility rules. Participants can review, correct or withdraw evidence statements before finalisation and can opt out of further reminders for a checkpoint.

Verification may use AI services to transcribe, structure and analyse responses. The AI is not the final authority on what happened: evidence remains subject to participant review and governed human use.

We use service providers to operate Civic, including application hosting, cloud/database, authentication, email-delivery, AI and voice technology providers. Current technology used within Civic can include Lovable and Lovable Cloud, Supabase infrastructure, OpenAI, ElevenLabs, Resend or Postmark, depending on the feature and configuration in use.

We aim to limit provider access to what is required for the service and to put appropriate contractual and technical safeguards in place for the processing involved.

Some technology providers may process information outside the United Kingdom. Where this constitutes a restricted transfer, we assess the transfer and use an applicable UK adequacy regulation or appropriate safeguard where required, such as the UK International Data Transfer Agreement or UK Addendum, together with any required transfer-risk assessment.

We keep personal information only for as long as it is needed for the purpose for which it was collected, legal or contractual requirements, dispute handling and proportionate security/audit needs. Different records have different retention periods.

For example, transient CivicProof turn summaries are designed with a 30-day retention period. Raw verification audio is not intended to be retained as a durable record. Other contract, account, enquiry and evidence records are retained according to the applicable customer, legal and operational schedule and are then deleted or anonymised where appropriate.

Depending on the circumstances, you may have rights to access your personal information, correct it, request erasure, restrict processing, object to processing, obtain portable information, and withdraw consent where consent is relied upon.

You have an absolute right to object to direct marketing. We will keep the minimum suppression information needed to honour such an objection.

To exercise a right, email hello@civic.ltd with “Privacy request” in the subject. We may need proportionate information to confirm identity before disclosing or changing personal information.

Civic uses necessary browser storage to operate parts of the service and may use limited anonymous service analytics where configured. See our Cookies and browser storage notice for more detail.

Please contact us first if you have a privacy concern so we can investigate it. You also have the right to complain to the UK Information Commissioner's Office.