Privacy Policy

1. About this policy

YAVA London Ltd is committed to protecting the privacy of everyone whose personal data we handle. This policy explains what personal data we collect, how and why we use it, who we share it with, how long we keep it, and the rights available to you. It applies to our website at www.yava.com, to enquiries and business dealings with us, to recruitment, and to our marketing.

We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and other applicable law. Where we operate outside the United Kingdom, we also comply with local requirements that apply to us.

2. Who we are

YAVA London Ltd (we, us, our) is the data controller for the personal data described in this policy. We are a company registered in England and Wales under company number [company number], with our registered office at 8 Oakfield Street, London SW10 9JB, United Kingdom. We are registered with the Information Commissioner’s Office under registration number [ICO registration number].

3. Scope

This policy covers personal data for which we decide the purposes and means of processing. Where we handle personal data on behalf of a client as a processor, for example when delivering a project, that processing is governed by our contract with the client and by the client’s own privacy notices, not by this policy.

4. Personal data we collect

Depending on your relationship with us, we may collect the following categories of personal data:

• Identity and contact data, such as name, job title, employer, email address, telephone number and country.
• Enquiry and correspondence data, such as the content of your messages and the area of enquiry you select.
• Recruitment data, such as your CV, work history, qualifications, right to work information, references and other details you provide when applying for a role.
• Business relationship data, such as the contact details and roles of representatives of clients, suppliers, partners and associates.
• Due diligence and compliance data, such as information needed for identity, sanctions, export control, anti-bribery and integrity checks.
• Technical and usage data, such as IP address, device and browser type, and information about how you use our website, collected through cookies and similar technologies.
• Marketing data, such as your email address and your marketing preferences.
• Visitor and event data, such as your name, organisation and reason for visiting, collected when you visit our offices or attend our events, for security, access and record keeping.

We do not seek to collect special category data through our website. Where recruitment or compliance checks require it, we process such data only where a lawful basis and an appropriate condition under the Data Protection Act 2018 apply.

5. How we collect personal data

We collect personal data directly from you, for example when you complete a form, email us, apply for a role or meet with us. We collect some data automatically through cookies when you use our website. We also receive data from third parties, such as referrals, publicly available sources, screening and verification providers, and referees.

6. Purposes and lawful bases for processing

We only process personal data where the law allows. The main purposes and lawful bases are set out below.

• Responding to enquiries and providing information: to take steps at your request before entering a contract, and our legitimate interests in dealing with enquiries.
• Providing our services and managing business relationships: performance of a contract, and our legitimate interests in running and developing our business.
• Recruitment: to take steps before entering a contract, our legitimate interests in assessing candidates, and legal obligations such as confirming the right to work.
• Due diligence, sanctions, export control, anti-bribery and vetting: our legal obligations, and our legitimate interests in operating lawfully, safely and with integrity.
• Marketing: your consent, or our legitimate interests where we are permitted to contact existing business contacts.
• Operating, securing and improving our website: our legitimate interests, and, for non-essential cookies, your consent.
• Complying with law and establishing or defending legal claims: our legal obligations and our legitimate interests in protecting our position.

Where we rely on legitimate interests, we do so only where those interests are not overridden by your interests and rights. You may ask us for information about the balancing we have carried out.

7. Marketing communications

We send marketing communications only where we are permitted to do so. You can opt out at any time by using the unsubscribe link in our emails or by contacting help@yava.com. Opting out of marketing does not stop us sending you messages that relate to a service or enquiry.

8. Cookies

Our website uses cookies and similar technologies. Details of the cookies we use, and how you can manage your preferences, are set out in our Cookie Policy.

9. Disclosure of personal data

We share personal data only where necessary, and with appropriate safeguards, with the following types of recipient:

• Service providers who process personal data on our behalf, such as hosting, IT, communications, analytics and recruitment providers, under written contracts that require them to protect it.
• Professional advisers, such as legal, accountancy, audit and insurance advisers.
• Partners and subcontractors, where needed to deliver a service, under confidentiality obligations.
• Government bodies, regulators, courts and law enforcement, where we are required or permitted by law to do so.
• Parties to a corporate transaction, such as a merger, acquisition, reorganisation or financing, subject to confidentiality.

We do not sell personal data.

10. International transfers

We operate internationally, including from bases in the United Kingdom, Switzerland, Kenya, India and the United Arab Emirates, and we may transfer personal data to countries outside the United Kingdom. Where we do, we ensure a lawful transfer mechanism is in place, such as UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the European Commission Standard Contractual Clauses, together with appropriate safeguards. You may request details of the safeguards we use.

11. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this policy, including to meet legal, regulatory, accounting and contractual requirements, and to establish or defend legal claims. Retention periods depend on the type of data and the reason we hold it.

Recruitment data for unsuccessful applicants is held for 6 months and then deleted, unless you agree that we may keep it on file for future opportunities, in which case we hold it for up to 12 months.

When personal data is no longer needed, we securely delete or anonymise it.

12. How we protect personal data

We maintain technical and organisational measures appropriate to the risk, including access controls, encryption where appropriate, vetting of personnel, supplier due diligence, and procedures for handling security incidents. Our personnel are bound by confidentiality obligations and receive data protection training.

While we take security seriously, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Your rights

Subject to certain conditions and exemptions, you have the right to: request access to your personal data; request correction of inaccurate data; request erasure; request restriction of processing; object to processing; request portability of data you provided to us; and withdraw consent where we rely on it. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise a right, contact help@yava.com. We will respond within one month of receiving your request. We may extend this by up to two further months where a request is complex or where we receive a number of requests, in which case we will let you know and explain why. We may need to verify your identity before acting.

These rights are not absolute and may not apply in every case, and we will explain our reasons if we cannot act on a request.

Individuals in the EU, Switzerland and other countries

We operate internationally. Where the data protection law of another country applies to our processing, for example the EU General Data Protection Regulation or the Swiss Federal Act on Data Protection, we comply with that law and you may have additional or equivalent rights under it.

If you are located outside the United Kingdom and wish to exercise your rights, contact us at help@yava.com and we will handle your request appropriately.

14. Automated decision making

We do not make decisions that produce legal or similarly significant effects based solely on automated processing. If this changes, we will update this policy and provide the information required by law.

15. Due diligence and compliance screening

Because of the sectors and regions in which we work, we carry out checks on relevant individuals and organisations, which may include identity, sanctions, export control, anti-bribery and integrity screening. We process the personal data needed for these checks on the basis of our legal obligations and our legitimate interests in operating lawfully and safely.

Some of this work, and some assessments and investigations we carry out, involves processing personal data where giving notice to the individual, or acting on certain requests, would prejudice the purpose of the work, prejudice the prevention or detection of crime, breach a duty of confidentiality, or conflict with a legal, regulatory or national security obligation. In those circumstances, and only to the extent permitted by law, we may rely on the exemptions available under data protection law and may be unable to provide information about, or act on a request relating to, that processing.

16. Third party links

Our website may contain links to third party websites and services. We are not responsible for the content or privacy practices of those sites, and we encourage you to review their privacy notices.

17. Children

Our website and services are directed at organisations and professionals, not children. We do not knowingly collect personal data from children.

18. Changes to this policy

We may update this policy from time to time. The current version is always available on our website, with the date of the latest update shown at the top. Where changes are material, we will provide notice by appropriate means.

19. How to contact us and complaints

If you have any question or concern about this policy or how we handle your personal data, contact us at help@yava.com or at our registered office.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office at ico.org.uk. We would, however, appreciate the opportunity to address your concerns before you approach the regulator.