Jojan One Privacy Notice

Jojan One Technologies Ltd is company number 17348476. Our registered office is 66 Paul Street, London, England, United Kingdom, EC2A 4NA. For privacy questions, requests or complaints, email support@jojanone.com and mark your message Privacy, or write to our registered office. Our website is www.jojanone.com.

We are a controller when we decide why and how to use information for our own account administration, customer relationships, billing, security and legal obligations. Applicable law includes the UK GDPR and Data Protection Act 2018 as amended, and the EU GDPR where it applies.

For personal data that a business customer places in its workspace and instructs us to process, the customer is normally the controller and we act as its processor under our separate Data Processing Agreement (DPA). If the customer is itself a processor, we may be its sub-processor. The customer determines the lawful basis and provides its own notice for that processing. Contact the relevant organisation about its employee, customer or other business records; we will assist it as required by the DPA and law.

This notice covers website visitors, prospects, subscribers, workspace administrators, authorised users and people who contact us. Records uploaded by customers may also concern employees, applicants, contractors, clients, suppliers, directors, shareholders or other people connected with their business.

Depending on your interaction, information may include your name, work email, role, employer, business contact details, account identifiers, authentication records, workspace permissions, subscription and transaction details, correspondence, support requests and consent or acceptance records. Technical and activity information may include IP address, browser and device details, login events, features used, timestamps and security or audit logs.

Workspace content may include contracts, policies, HR and governance records, risk and compliance information, documents, attachments, prompts, AI responses and information obtained through integrations the customer enables. Avoid sending unnecessary personal data. Sensitive information requires the additional safeguards described in section 5.

We receive information directly when you register, purchase, enter information, upload files, use Jova, contact us or make choices. Your employer or workspace administrator may invite you, provide your business contact details and assign your role. Customers and other authorised users may upload records that mention you.

Information is also generated when you use the website or platform. Payment providers supply transaction confirmations and billing status; authentication and infrastructure providers generate access and security records. Integrations provide the information that the customer authorises them to share. These sources depend on the services you or your organisation choose to use.

Account and subscription administration: we use identity, account, contact, subscription and transaction information to create accounts, deliver subscriptions and manage payments. We rely on contractual necessity where the contract is with you personally, including a sole trader. Where your organisation holds the contract, we rely on our legitimate interests in providing and administering the business service and communicating with its representatives.

Support and service communications: we use contact information, messages and relevant records to answer questions, resolve issues, send essential service notices and manage our relationship. Our basis is contractual necessity where you are the contracting individual, or our legitimate interests in providing effective support and operating the service for business customers.

Security, abuse prevention and accountability: we use authentication records, technical information, audit events and relevant account data to investigate incidents, control access, prevent fraud and evidence acceptance and permissions. We rely on legitimate interests in safeguarding users, customers and systems, and legal obligations where a specific legal duty requires the processing.

Product maintenance and improvement: we use proportionate technical and usage information to diagnose faults, measure service performance and improve usability. We rely on legitimate interests in maintaining a useful, reliable service, subject to balancing those interests against your rights. Where device storage or access requires consent, we obtain it separately. We use anonymous information where practical.

Legal compliance and disputes: we keep necessary invoices, tax and accounting information, respond to lawful requests, manage privacy rights and establish or defend legal claims. We rely on applicable legal obligations, or legitimate interests in protecting legal rights where no specific duty requires the activity.

Optional marketing: we use the contact details and preferences you provide to send marketing where you have consented. You may withdraw consent using the unsubscribe link or by emailing us. Service and security messages necessary for an existing account are separate from optional marketing.

We assess necessity and the impact on individuals before relying on legitimate interests. You can ask about that assessment and object as explained in section 12. Customer-controlled workspace processing follows the customer's instructions and lawful basis; our service contract with a business does not itself supply a lawful basis for all personal data it uploads.

Workspace records may contain special category information, such as health or trade union information, or criminal offence information, such as relevant background-check records. Customers must establish the necessary lawful basis, additional legal conditions and safeguards before providing such data. These categories are not required merely to register for an account. Do not put sensitive information in general support messages unless necessary and an appropriate channel has been arranged.

We require enough identity, contact, account and billing information to provide the service requested and comply with applicable legal duties. If required information is not supplied, we may be unable to open or secure an account, process a payment or deliver support. Optional marketing and optional cookie choices are not a condition of subscribing. We do not design the service for children or invite children to create accounts.

Jova uses relevant prompts, business context and workspace records to produce guidance, draft documents, identify issues and support risk and compliance analysis. Inputs and responses can contain personal data. The customer controls whether and how its users use these features and must minimise the information submitted.

Relevant information is sent to the AI providers used for the requested feature. Our published provider information identifies Anthropic for Jova. AI processing can involve access outside the UK and EEA. Any additional routing intermediary that handles personal data must be disclosed and authorised through the DPA arrangements before it is used.

We do not use Customer Content to train general-purpose AI models or permit our AI providers to do so as part of providing Jova. Processing requests may nevertheless involve provider security checks and limited operational retention under the applicable provider arrangements; a restriction on training does not mean that providers never process or retain requests.

Jova outputs and business scores support human judgement. They are not intended to be the sole basis for decisions with legal or similarly significant effects on individuals, such as hiring, dismissal or access to essential services. AI may produce inaccurate or inferred information. Ask the relevant controller to correct source records and review outputs affecting you. Any future use of significant solely automated decision-making would require appropriate advance information and safeguards.

Information is accessible to authorised personnel and service providers only as needed for the applicable purpose. Provider categories include application hosting and delivery, database and file storage, authentication, AI processing, payment processing, transactional email and technical support. Our published provider information names Vercel, Supabase, Anthropic, Stripe and Resend. The DPA provider schedule describes the relevant service functions.

Workspace administrators and other users can access information according to their permissions. Customers may share outputs or connect third-party services. Those recipients may have their own responsibilities and notices. Payment providers can act as independent controllers for activities such as payment regulation and fraud prevention, as explained in their own notices.

We may disclose necessary information to professional advisers, insurers, auditors, regulators, law enforcement or courts where justified by law or protection of legal rights, and to a successor in a business transaction with suitable safeguards and notice where required. We do not sell personal data or allow Customer Content to be used for unrelated advertising.

Our published infrastructure information places primary business-record storage in a European region. This does not mean all processing remains in Europe: hosting delivery, AI requests, email services, support access and supplier operations can involve other locations, including the United States. Relevant suppliers and locations must be reflected in the maintained provider register.

Where a transfer is restricted under applicable data protection law, we require a valid transfer mechanism. Depending on the destination and recipient, this may be an applicable adequacy decision or regulations, or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. EU transfers require safeguards valid under EU law where that law applies.

Where required, we assess the destination risks and implement supplementary safeguards. A statement that data is stored in Europe does not replace these requirements. Contact support@jojanone.com to ask about relevant locations and obtain information about applicable safeguards or a copy, with proportionate redactions for confidential information.

Account and contact information is kept while needed to operate the account and manage the relationship. Following closure, we retain only information needed for outstanding matters, applicable record-keeping duties or legal claims. Limited contractual, billing and transaction evidence may be retained for up to seven years where justified by those purposes; this is not a blanket seven-year period for every account or usage record.

Customer-controlled workspace data is processed for the subscription and any agreed export period. Under the DPA, customers choose return or deletion. Ordinary workspace access may end with the subscription; the Terms normally provide at least 30 days to request export. Remaining copies are returned or deleted within 90 days of closure, subject to lawful retention and the agreed treatment of protected backups. A valid earlier deletion instruction is handled under the DPA.

Support correspondence, security and usage records are retained for a period proportionate to the issue, investigation, service operation or claim they support, rather than indefinitely. Marketing records are kept while consent remains valid; a minimal suppression record may be kept to honour an opt-out. Cookie lifetimes are identified in the cookie information presented on the website.

In deciding retention, we consider the purpose, sensitivity and amount of data, whether a shorter period would meet the need, customer instructions, statutory requirements, unresolved disputes and relevant limitation periods. We delete or anonymise information when it is no longer needed. Data retained for legal reasons is access-restricted. Backup copies are isolated from ordinary use and removed through the documented deletion cycle.

Cookies and similar technologies can support authentication, security, preferences and measurement. The website's Cookie Policy and controls must explain the actual technologies, providers, purposes and durations. Where consent is required, optional technologies remain off until you choose to allow them, and you can change your choice through the available cookie controls. An exception from consent is used only where its legal conditions are met. Accepting the Terms or acknowledging this notice is not cookie consent.

We use technical and organisational safeguards proportionate to the risks, including access restrictions, protection of information in transit and storage, monitoring and incident handling. The DPA sets out contractual security requirements for customer-controlled data. No internet service is completely secure. Protect your credentials and devices, use available security controls and report suspected compromise promptly.

Depending on the law, processing purpose and applicable exceptions, you may request access to personal data and information about its use; correction of inaccurate or incomplete data; deletion; restriction of processing; and a portable copy of data you provided where processing is automated and based on consent or your contract. You may withdraw consent at any time without affecting processing that was lawful before withdrawal.

Your right to object

You can object at any time to direct marketing, including related profiling, and we will stop that use. You can also object on grounds relating to your situation where processing relies on legitimate interests. We will stop that processing unless we demonstrate compelling overriding grounds or need it for legal claims. Contact support@jojanone.com to object.

To exercise rights, email support@jojanone.com. We may request proportionate information to verify identity and locate records. We normally respond without undue delay and within one calendar month, subject to lawful extensions or adjustments; we will explain these where applicable. Requests are normally free. We explain any lawful refusal or fee and your complaint options.

If a request concerns records controlled by your employer or another customer, contact that organisation first. If it reaches us, we will direct it to the relevant controller and assist as required. We will not disclose another organisation's confidential records merely because a person asks.

If you are concerned about our handling of personal data, email support@jojanone.com with Privacy complaint in the subject, or write to our registered office. Explain the concern and the outcome you seek. We will acknowledge a data protection complaint within 30 days, investigate and keep you informed, and communicate the outcome without undue delay.

You may complain to the Information Commissioner's Office at www.ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to complete our process before contacting the ICO, although allowing us an opportunity to resolve the concern can help. Where EU law applies, you may also complain to the competent supervisory authority, including in the EEA country where you live or work or where the alleged infringement occurred.

We will update this notice when our processing changes and identify the revision date. We will take appropriate steps to draw material changes to your attention and obtain fresh consent where the law requires it. A revised notice does not itself authorise a new incompatible use of information.

Jojan One Technologies Ltd Company number 17348476 66 Paul Street, London, England, United Kingdom, EC2A 4NA Website www.jojanone.com Privacy contact support@jojanone.com