Legal

Data Protection

Last updated: 29 July 2026 · UK GDPR / Data Protection Act 2018

This page sets out how Contractiv8 governs the personal data it handles, and how to reach us about it. It sits alongside our Privacy Policy, which explains in detail what we collect, how we use it, and your rights.

Privacy is architectural, not just a promise.

Uploaded contracts are analysed by deterministic pattern matching, not by AI. They are never processed by a large language model, never used to train any model, and never leave our secured database. Because there is no model-training path in the way the platform is built, our data-minimisation and confidentiality commitments are properties of the system's design.

Data controller

Contractiv8 is operated by Performance Driven Digital Limited, which is the data controller for the personal data described in our Privacy Policy.

Registered address: 124 City Road, London, England, EC1V 2NX

Data protection contact: support@contractiv8.com

As a founder-led business we are not required to appoint a statutory Data Protection Officer. The founder acts as our data protection point of contact and owns our data-protection governance.

ICO registration

ICO registration number: ZC208933

Performance Driven Digital Ltd is registered with the Information Commissioner's Office (ICO), the UK's data protection regulator. Registered 28 July 2026. You can verify our registration on the ICO register of fee payers.

How we govern data protection

We hold ourselves to the seven UK GDPR principles and build the product around them. In practice this means:

  • Records of processing. We maintain a record of what personal data we process, why, and on what lawful basis.
  • Data protection by design and default. Analytics use a pseudonymous identifier only, error logs are scrubbed of personal data, and contract content never enters an analytics event or a model-training pipeline.
  • Data protection impact assessment. We completed a DPIA for the contract-scanning engine and review it when the engine or data flows materially change.
  • Security. Row-level security, least-privilege access, multi-factor authentication on production systems, and encryption in transit and at rest. See the Privacy Policy for detail.
  • Breach response. We log every suspected breach and, where required, report to the ICO without undue delay and within 72 hours.
  • Retention and deletion. We keep data only as long as needed and delete it securely, with defined retention periods set out in the Privacy Policy.

Your rights

You have the right to be informed about, access, correct, erase, restrict, port, and object to our use of your personal data. Our Privacy Policy explains each right and how to exercise it. To make a request, email support@contractiv8.com and we will respond within one month.

Complaints

If you have a concern about how we handle your data, please contact us first at support@contractiv8.com. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.