You provide
Your name, work email, phone and job title; profile details; billing information; anything you send us through forms, email or support; and the content your team creates in the platform.
How Drova handles personal data
Most of what sits in Drova is your organisation's governance data, and we process it only on your instruction.
The plain-English guide to our Privacy Policy, which remains the binding document: what we collect, why, who sees it, how long we keep it, and how to exercise your rights.
Doing your due diligence? Good.
Leave your work email and we will come back to you with the certificate, policies and answers your IT or procurement review needs.
The basics
Two kinds of data, two roles
- Your governance data is yours. Risks, controls, obligations, evidence and anything else your team puts into Drova is processed on your behalf and on your instruction. We do not decide what it is used for, and requests about personal data inside it go to your organisation, which owns it.
- Account and contact data is ours to protect. The personal data we collect to run the service, such as your name, work email, role, login and billing details, is handled by Drova as the responsible party under the Privacy Policy.
- Automated processing assists, people decide. We use automated processing, including AI, to generate recommendations and keep the service secure. It is not used to make decisions with legal or similarly significant effects on a person without human involvement. How that works is on AI trust.
What we collect and why
This is the personal data we collect to run the service. Your organisation's governance data is yours and is not part of it.
Automatically
Standard technical data when you use the service: IP address, browser and device details, date and time of access, language, cookie data and crash reports.
Integrations
If you connect a third-party service, we may receive account details from it. We never collect or store the password for that service.
Why we use it
To provide, operate, secure and improve the service, respond to support requests, process billing, send operational notices, send marketing where permitted, and meet our legal obligations.
Retention and protection
How long we keep it, and how it is protected
- Kept while there is a reason. We hold personal data while we need it to provide the service, while a legal, tax or accounting obligation requires it, or while a customer contract allows it.
- Then deleted or anonymised. When it is no longer needed it is deleted or anonymised. Where it sits in a backup, it is held securely until that backup is deleted.
- Protected throughout. Encryption in transit and at rest, two-factor authentication, notifications when a new device or app connects to your account, and access restricted to authorised people, inside our ISO/IEC 27001 certified management system. The detail is on Security.
Your rights and how to use them
Use the settings in the platform where they exist, or contact us using the details in the Privacy Policy. For personal data inside your organisation's content, contact your organisation.
Ask for a copy of the personal data we hold about you, and have it corrected or updated.
Ask us to delete your personal data. We will say if a legal or legitimate reason means we have to keep some of it.
Object to processing based on our legitimate interests, or ask us to pause processing while a question is resolved.
Where you are in the UK or EEA, receive your personal data in a structured, commonly used format, or have it sent to another provider.
Unsubscribe from marketing with the link in any email, and withdraw consent at any time where processing relies on it.
Raise a complaint with the privacy regulator in your country if you are not satisfied with how we have handled your data.
Start a free trial, or tell us what your review needs.
See it for yourself
Trust Centre
More from Drova's Trust Centre
Data residency
Where your data is held and what leaves the region.
Security
Hosting, encryption, access, testing and recovery.
AI trust
How our AI works, what it does with your data, and the safeguards in place.
Certifications and compliance
What we are certified to, and what we build to.
Your questions answered
Security, privacy, compliance and AI questions, answered plainly.
