Privacy Policy

1) Information we collect

• Contact details you provide, such as name, work email, phone number, company, and role.
• Information submitted in deployment application forms, including operational context and project goals.
• Information submitted when you enquire about a funded programme we deliver, such as your name, company, contact details, and the role you are considering.
• With analytics consent, first-party journey information such as pages and named sections viewed, pricing-builder choices, application steps reached, video starts, stops, completion milestones and playback failures, referring origin, and the allowlisted campaign fields UTM source, medium, campaign, term, and content. Video events contain only the listed opaque asset identifier, page, bounded playback position, and event reason. Arbitrary query parameters, URL fragments, free-text form values, precise location, and IP addresses are not retained in journey events.
• Communication records when you contact us by form or email.

2) How we use your information

• To respond to enquiries, assess deployment fit, and manage onboarding discussions.
• To operate, maintain, and improve website performance, security, and reliability.
• To communicate updates relevant to your request, partnership status, or legal/compliance obligations.
• To administer funded programmes we deliver, including assessing eligibility, arranging visits or calls, and reporting delivery to the funder and our delivery partner.
• To produce aggregated, non-identifying service insights for internal planning.
• With analytics consent, to understand the website journey from arrival to enquiry and improve the deployment application experience.

3) Legal basis and data sharing

We process website journey capture and the optional join to a submitted enquiry only with analytics consent. Enquiry handling has its own stated purpose and continues whether analytics consent is granted or refused. We do not sell personal data.

AWS provides website hosting and data processing, and our existing anti-abuse provider verifies public forms. We do not add a separate third-party analytics processor for this first-party journey service.

Where we deliver a publicly funded programme, we may share delivery and participation information with the funder, our delivery partner, and their auditors, to evidence that the programme was delivered. We keep commercially sensitive information to a minimum.

4) Funded programmes and customer platform data

When you take part in a funded programme, such as our AI hire onboarding programme, we act as controller for the enquiry and relationship data described above.

Separately, where we build and host onboarding or guidance content for your business, the personal data inside that content, such as your staff progress, evidence, and sign-off records, is processed by us on your instructions. For that data your business is the controller and we are the processor, and the terms are set out in the agreement between us rather than in this policy.

Content you provide about how your business works, and the guided workflows and holographic assets we build for you, are held in your own tenant and are not shared with other customers.

5) Data retention and security

We retain personal data only for as long as needed for the purpose collected, legal obligations, and legitimate business requirements.

Pseudonymous raw website journey events are deleted after 13 months. Separately produced anonymous daily aggregates may be retained for long-term comparison because they can no longer identify a visitor or lead.

If an analytics-consented visitor submits an enquiry, the server may link the preceding journey to that lead for up to the stated attribution window. The browser cannot choose or supply the visitor identifier.

Where data relates to a publicly funded programme, we may be required to retain records for a defined period after the programme ends so that delivery can be audited and evaluated.

We apply technical and organisational safeguards designed to protect data against unauthorised access, disclosure, alteration, or loss.

6) Your rights

Depending on applicable law, you may have rights to access, correct, delete, restrict, object to, or request portability of your personal data.

You may also withdraw consent where processing depends on consent.

Withdrawing analytics consent stops capture, deletes the first-party visitor identifier, starts deletion of that visitor's raw journey events, and severs any lead journey link. Anonymous aggregates already produced are unaffected.

An erasure request covers journey events and any per-lead journey projection, together with the applicable queue, backup, and deletion cycles.

7) Contact and complaints

For privacy requests, contact hello@holovast.com. You may also raise concerns with your local data protection authority if you believe your data has not been handled appropriately.