Privacy Policy

Careva is a communications practice registered in London, at 145–157 St John Street, London EC1V 4PW, United Kingdom. For the purposes of UK data protection law we are the data controller for the personal data described here.

Questions, requests and complaints about data protection go to privacy@careva.uk. A person, not a ticketing system, reads that inbox.

From the enquiry form or an email: your name, your organisation if you give it, your email address, the topic you select, and whatever you write in the message field.

From a job application: your name, your email address, your location and stated working-hours overlap, and the material you send us — a note, links, or a CV if you choose to attach one.

From a client engagement: the contact details and business information needed to do the work, which may include material you share with us in confidence about your own organisation.

From visiting the site: aggregate statistics only — page views, referrers, and broad country and device type — through a cookieless analytics provider that assigns you no identifier. We run no advertising, we do not track visitors between sites, and we do not buy contact data from anyone.

To answer your enquiry and decide whether we are the right practice for it. Our lawful basis is legitimate interests: you contacted us and expect a reply.

To assess a job application and run the hiring steps described on the Careers page. Our lawful basis is legitimate interests, and for a paid written exercise, the performance of a contract.

To deliver and administer a client engagement, including invoicing. Our lawful basis is performance of a contract, and for tax and accounting records, legal obligation.

To understand which pages are read, through the aggregate analytics described in the Cookie Policy. Our lawful basis is legitimate interests: the processing is limited to statistics that identify nobody. We do not send marketing emails, so there is no mailing list to join or unsubscribe from.

Enquiries that do not become engagements: twelve months from your last message, then deleted.

Job applications: twelve months from your application, as stated on the Careers page, so we can come back to you when a relevant role opens. Ask us to delete it sooner and we will.

Client records: for the duration of the engagement and then six years, which is the period UK tax and accounting rules require for financial records. Confidential client material we no longer need is deleted at the end of the engagement.

Correspondence that has no ongoing purpose is deleted rather than archived indefinitely.

Our email, file storage and accounting providers process data on our behalf under contract. They are not permitted to use it for their own purposes.

The enquiry form is delivered by FormSubmit, which receives what you type into it and forwards it to us by email. It is a processor acting on our instructions and does not use the content for its own purposes.

Senior associates working on your engagement see what they need to do the work, and are bound by the same confidentiality terms we are.

Because the practice works remotely and associates may be based outside the United Kingdom, your data may be accessed from other countries. Where that happens we rely on the UK government's adequacy regulations or, failing that, the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

We do not sell personal data, and we do not share it with advertisers.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to our using it on the basis of legitimate interests, or ask for it in a portable format.

Write to privacy@careva.uk. We will respond within one month, which is the statutory deadline, and usually a good deal sooner.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you raised it with us first, but that is your right either way.

Access to client and applicant material is limited to the people working on it. Devices are encrypted, accounts use two-factor authentication, and confidential material is not shared over channels we do not control.

No system is perfect. If a breach affects your rights we will tell you and the Information Commissioner's Office within the timescales the law sets.

If this policy changes materially we will update the date at the top and, where the change affects an active engagement or application, tell the people concerned directly.