Privacy policy

Last updated 28 February, 2024

‍Important information and who we are

‍Ayora Technologies Limited (“Ayora”, “we”, “our”, or “us”) respects your privacy and is committed to protecting your personal data. This privacy policy will inform you how we treat your personal data when using our services and website. This policy does not apply to third-party websites, products or services.

Additionally, there are references to “You” and “Your”. In these instances, “You” may be a visitor to our site, a customer that is an individual, an employee of a corporate customer (in each case, a “Customer”), or a user of our Customer’s products or services (“End User”).

This privacy policy is issued on behalf of Ayora Technologies Limited, so when we use the terms “Ayora”, “we”, “us”, or “our” in this privacy policy, we are referring to the company.

‍BACKGROUND:

‍Ayora understands that your privacy is important to you and that you care about how your data is used. We respect and value the privacy of everyone who visits this website, http://www.ayora.ai and will only collect and use personal data in ways that are described here and in a way that is consistent with our obligations and your rights under UK law.

Please read this Privacy Policy carefully and ensure that you understand it. Acceptance of this Privacy Policy is requested when visiting our site or using our products and services.

‍1. Definitions and Interpretation

‍In this Policy, the following terms shall have the following meanings:
Account means an account required to access and/or use certain areas and features of Ayora services
Cookie means a small text saved within the browser when you visit certain parts of our Site and/or when you use certain features of our services
Cookie Law means the relevant parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003

‍2. Information About us

‍Our site is operated by Ayora Technologies Limited, a private limited company registered in England under company number 14284631.Registered address: The Broadgate Tower, 20 Primrose Street, London, EC2A 2ES, United Kingdom.

Data Protection Officers: dpo@ayora.ai‍

3. What Does This Policy Cover?

‍This Privacy Policy applies only to your use of our site. Our site may contain links to other websites. Please note that we have no control over how your data is collected, stored, or used by other websites, and we advise you to check the privacy policies of any such websites before providing any data to them.

‍4. What Is Personal Data?

‍Personal data is defined by the UK GDPR and the Data Protection Act 2018 (collectively, “the Data Protection Legislation”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.

Personal data is, in simpler terms, any information about you that enables you to be identified. It does not include data from which the individual’s identity cannot be discerned (anonymous data). Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

‍5. What Are Your Rights?

‍Under the Data Protection Legislation, you have the following rights, which we will always work to uphold:
- The right to be informed about our collection and use of your data. This Privacy Policy should tell you everything you need to know about how we collect and use your data, but you can always contact us to find out more or ask any questions.
- The right to access the personal data we hold about you.
- The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete.
- The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we hold.
- The right to restrict (i.e. prevent) the processing of your personal data.
- The right to object to us using your personal data for a particular purpose or purposes.
- The right to withdraw consent. If we rely on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.
- The right to data portability. This means that if you have provided personal data to us directly, we are using it with your consent or for the purpose of a contract and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.

Rights relating to automated decision-making and profiling. We do not use your personal data in this way.

Please contact us for more information about our use of your personal data or exercising your rights as outlined above. Please be aware that restricting consent or the process of personal data may negatively impact your experience of using our services.

Your personal data must be kept accurate and up-to-date. If any of the personal data we hold about you changes, please keep us informed.

Further information about your rights can be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.

If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. However, we would welcome the opportunity to resolve your concerns, so please contact us first.

6. Consent

‍We require consent provided by you to access any of your Account Information and any other personal data.

You can withdraw consent at any time by emailing our DPO.

‍7. Deletion of Personal Data

‍We will delete your personal data within 30 days of your request.

‍8. Other data we collect

- Contact details such as your name, email address and phone number
- The IP address used to connect your computer or access device to the internet
- Your geographic location
- Information about the device you used to access our services includes your operating system and device details

‍9. Security

‍Please see Appendix 1 below for a detailed summary of our security measures to protect Customer data.

‍10. Changes to this policy

‍We reserve the right to change this privacy policy at any point in time and will also post the revised policy on our website (ayora.ai). We will notify you via email or by posting a notice on our website.

‍11. Your Requests

‍Subject Access Requests

You have the right to request any personal data we have stored related to you. Should you wish to do so, please email dpo@ayora.ai to make a subject access request detailing:
- Your full legal name
- Your address
- Your email used to create an account with us.

If, however, you are dissatisfied with the response, you have the right to make a formal complaint to the ICO at https://ico.org.uk/

‍12. Implementation of policy

‍This Policy shall be deemed effective as of 28/10/2022. No part of this Policy shall have a retroactive effect and shall thus apply only to matters occurring on or after this date.

Appendix 1

Measures of pseudonymisation and encryption of personal data

Ayora has deployed secure methods and protocols for transmission of confidential or sensitive information over public networks. Databases housing sensitive Customer data are encrypted at rest. Ayora uses only recommended secure cipher suites and protocols to encrypt all traffic in transit and Customer data is securely encrypted with strong ciphers and configurations when at rest.

Measures for ensuring ongoing confidentiality, integrity and availability of processing systems and services

Ayora’s Customer agreements contain strict confidentiality obligations. Additionally, Ayora carries out detailed security and confidentiality reviews of all potential subprocessors prior to entering into a commercial relationship.

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

Regular backups of production environments are taken. Backups are periodically tested in accordance with information security and data management policies.

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing

Ayora has successfully undergone an ISO27001 audit that includes data security criteria.

Measures for user identification and authorisation

Ayora uses secure access protocols and processes and follows industry best-practices for authentication, including Multifactor Authentication and Single Sign On (SSO). Further, Ayora makes available a sophisticated in-app permissioning system that allows for privilege management and limitation of user access to selected data and/or environments.

Measures for the protection of data during transmission

Ayora has deployed secure methods and protocols for transmission of confidential or sensitive information over public networks. Ayora uses only recommended secure cipher suites and protocols to encrypt all traffic in transit (i.e. TLS 1.2)

Measures for the protection of data during storage

Encryption-at-rest is automated using AWS’s transparent disk encryption, which uses industry standard AES-256 encryption to secure all volume (disk) data. All keys are fully managed by AWS.

Measures for ensuring physical security of locations at which personal data are processed

All Ayora processing occurs in physical data centres that are managed by AWS.https://aws.amazon.com/compliance/data-center/controls/

‍Measures for ensuring events logging

Ayora monitors access to applications, tools, and resources that process or store Customer data, including cloud services. Monitoring of security logs is managed by the security and engineering teams. Log activities are monitored and investigated when necessary and escalated appropriately. Further, Ayora makes available an in-app logging system allowing you to track your users’ activity.

Measures for ensuring system configuration, including default configuration

Ayora adheres to a change management process to administer changes to the production environment for the services, including changes to its underlying software, applications, and systems. All production changes are automated through CI/CD tools to ensure consistent configurations.

Measures for internal IT and IT security governance and management

Ayora maintains an ISO 27001-compliant risk-based information security governance program. The framework for Ayora’s security program includes administrative, organisational, technical, and physical safeguards reasonably designed to protect the Services and confidentiality, integrity, and availability of Customer data.

Measures for certification/assurance of processes and products

Ayora undergoes an annual ISO27001 audit.

Measures for ensuring data minimisation

You unilaterally determine what data you route through our services. As such, Ayora operates on a shared responsibility model. Ayora gives its Customers control over exactly what data enters the platform.

Measures for ensuring data quality

Ayora has a multi-tiered approach for ensuring data quality. These measures include: (i) unit and integration testing to ensure quality of logic used to process API calls, (ii) database schema validation rules which execute against data before it is saved to our database. Ayora applies these measures across the board, both to ensure the quality of any Usage Data that Ayora collects and to ensure that Ayora Platform is operating within expected parameters. Ayora ensures that data quality is maintained from the time a Customer sends Customer Data into the Services and until that Customer Data is presented or exported.

Measures for ensuring limited data retention

You unilaterally determine what data you route through our platform. As such, Ayora operates on a shared responsibility model. Ayora deletes your personal data upon your written request, within the timeframe specified in this Policy and in accordance with applicable data protection law. All personal data is deleted from the platform following service termination.

Measures for ensuring accountability

Ayora has adopted measures for ensuring accountability, such as implementing data protection and information security policies across the business, recording and reporting personal data breaches, and formally assigning roles and responsibilities for information security and data privacy functions. Additionally, Ayora conducts regular third-party audits to ensure compliance with our privacy and security standards.

Measures for allowing data portability and ensuring erasure

Personal data is incidental to Ayora’s services. Based on Privacy by Design and Data Minimization principles, Ayora severely limits the instances of Personal Data collection and processing within the platform. Most use cases for porting personal data from Ayora are not applicable. However, Ayora will respond to all requests for data porting in order to address your needs.

Technical and organisational measures of sub-processors

Ayora enters into Data Processing Agreements with its subprocessors with data protection obligations substantially similar to those contained in this privacy policy.