GDPR

For enquiries, job applications and client contact data, Careva is the data controller. Our registered address is 145–157 St John Street, London EC1V 4PW, United Kingdom, and the contact point for all data protection matters is privacy@careva.uk.

Where a client shares personal data with us so that we can do work on their behalf — a press list they own, employee contact details for internal communications — we act as a processor on that client's instructions, under the terms of the engagement.

We are not required to appoint a Data Protection Officer: we are a small practice, we do not process special category data at scale, and we do not carry out large-scale monitoring. Responsibility sits with the practice lead.

Legitimate interests, for replying to an enquiry you sent us and for assessing a job application you sent us. In both cases you initiated the contact and expect a response; the processing is limited to what that requires.

Performance of a contract, for delivering a client engagement, for invoicing, and for paying an associate for a written exercise or a piece of work.

Legal obligation, for retaining financial records for the period UK tax and accounting rules require.

Legitimate interests also cover the aggregate site analytics described in the Cookie Policy, which are cookieless and identify nobody. We rely on consent for nothing, because we store nothing on your device and do no marketing, profiling or advertising. There is no mailing list.

The enquiry form asks for a name, an email address, an optional organisation, a topic and a message. There is no phone number field, no budget field and no dropdown asking how you heard about us, because we do not need any of it to reply.

The site sets no cookies at all. Analytics are cookieless and aggregate: no identifier is assigned, and IP addresses are used to derive a country and then discarded. Nothing here profiles you or follows you between sites. See the Cookie Policy.

Enquiries that do not become engagements: 12 months from your last message.

Job applications: 12 months from application, as stated on the Careers page.

Client engagement records: the duration of the engagement plus six years for financial records; confidential client material no longer needed is deleted at the end of the engagement.

These periods match the Privacy Policy. If the two ever appear to differ, the shorter period applies and we would like to know about the discrepancy.

The practice works remotely and engages senior associates who may be based outside the United Kingdom, so personal data may be accessed from countries other than the UK.

Where the destination is covered by UK adequacy regulations, we rely on those. Where it is not, we put in place the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, and assess the transfer before it happens.

Our email and file storage providers are contracted on the same basis.

You have the right to be informed, of access, to rectification, to erasure, to restrict processing, to data portability, and to object to processing based on legitimate interests. There is no automated decision-making here, so the associated right does not arise.

Send the request to privacy@careva.uk. We do not require a particular form of words, and we do not charge a fee. We will ask enough to be confident you are who you say you are, and no more.

We respond within one month. If a request is genuinely complex we may extend that by up to two further months, and we will tell you why within the first month.

We keep an internal record of any personal data breach. Where a breach is likely to result in a risk to people's rights and freedoms, we report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and we tell the people affected without undue delay where the risk is high.

If you are not satisfied with how we have handled your data or your request, you can complain to the Information Commissioner's Office — ico.org.uk, or 0303 123 1113. You do not have to come to us first, though we would prefer the chance to put it right.