Privacy policy
ventive.ai Ltd · Version 1.0 · 6 September 2026
This is the privacy policy of ventive.ai Ltd. It explains what personal data we collect, why we collect it, what we do with it and what rights you have. It applies to our website at ventive.ai, to the way we deal with the people we work with, and to our own use of the software products we make. We have tried to write it plainly. If anything is unclear, email hello@ventive.ai and a person will answer.
Who we are
ventive.ai Ltd is a company registered in England and Wales under company number [●], with its registered office at 28 Howard Drive, Farnborough, Hampshire, GU14 9TQ. We are the controller of the personal data described in this policy, which means we decide why and how it is used. We are registered with the Information Commissioner's Office (ICO) under registration number [●].
You can contact us about anything in this policy at hello@ventive.ai, or by post at the address above. We do not have a statutory data protection officer; our director, Toby Russell, is responsible for data protection.
Who this policy covers
| Who you are | What this means for you |
|---|---|
| A visitor to ventive.ai | We hold very little about you. See "Our website" below. |
| Someone who contacts us or asks about our services | Your enquiry goes into our own CRM so that we can respond and follow up. |
| A prospective customer or partner we approach | We may hold business contact details gathered from public sources so that we can introduce ourselves. |
| A customer, or someone who works for one | We hold the details we need to run the account, deliver the work, invoice and support you. |
| A supplier, subcontractor or adviser | We hold the details we need to work with you and pay you. |
| A user of one of our software products, where your organisation is our customer | Your organisation controls that data. We process it on their instructions. See "When we are a processor" below. |
When we are a processor, not a controller
Our software products (such as leadily, SupportHive, kanbanic, hopfrog, Ledgra, digitill, quickcodes, Azzetica and epostle) are used by our customers to run their own businesses. The information those customers and their staff enter into a product, including personal data about their own customers, contacts and employees, belongs to them. For that data we act as a processor: we store and process it only to provide the service, on our customer's instructions, under the data processing terms in our Standard Terms and Conditions. If you have a question about how one of our customers uses your data inside a product we host, please contact that organisation. Their privacy policy applies, and we will help them respond to you.
This policy covers the data for which we are the controller: the personal data we hold to run our own business, including the account details of the people who administer our products on behalf of a customer.
The personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, job title, employer, email address, telephone number, postal address | You, your organisation, or public sources such as your organisation's website, LinkedIn or Companies House |
| Enquiry and correspondence | The content of contact-form submissions, emails, messages, meeting notes and calls | You |
| Commercial | Proposals, quotes, contracts, orders, invoices and payment history relating to your organisation | Our dealings with you |
| Account and usage | Login details for our products where you administer a customer account, product settings, support requests, audit and activity logs | Your use of our products |
| Technical | IP address, browser type, the pages requested and the time of the request, recorded in web server logs | Automatically, when you visit our website or use our products |
| Marketing preferences | Whether you have asked us not to contact you | You |
We do not knowingly collect special category data (such as health, religion or political opinions) or data about criminal convictions, and we ask that you do not send it to us. Our website and services are for businesses and are not directed at children; we do not knowingly collect data from anyone under 18.
Our website
Our website is a static site. It sets no cookies, runs no analytics or advertising scripts, and loads no third-party embeds; fonts and images are served from our own servers. The only data recorded when you visit is the standard web server log: your IP address, browser type, the address requested and the time. We use those logs to keep the site secure and working, and they are deleted on a rolling basis within 90 days. Our separate Cookie Policy describes this in more detail.
When you use the contact form, the details you enter (name, email address, company and message) are sent to our CRM, which we host ourselves, so that we can answer you. If the CRM cannot be reached, the enquiry is emailed to us instead so that it is not lost. We do not use the form to sign you up to anything.
How we use personal data, and why we are allowed to
UK data protection law requires us to have a lawful basis for each use of personal data. The table below sets out what we do and the basis we rely on.
| What we do | Data involved | Lawful basis |
|---|---|---|
| Respond to enquiries and discuss whether we can help | Identity, contact, enquiry | Legitimate interests: responding to people who have contacted us. Where you are a sole trader, also steps taken at your request before entering a contract |
| Introduce ourselves to businesses we think we could help | Identity, contact from public sources | Legitimate interests: promoting our services to businesses. You can object at any time and we will stop |
| Prepare proposals, quotes and contracts | Identity, contact, commercial | Steps taken at your request before entering a contract; legitimate interests where the contract is with your employer |
| Deliver services, run customer accounts, provide support and invoice | Identity, contact, commercial, account and usage | Performance of a contract with you or your employer; legitimate interests in running our business |
| Keep accounts and tax records | Identity, contact, commercial | Legal obligation |
| Keep our website and products secure, prevent abuse and investigate incidents | Technical, account and usage | Legitimate interests: protecting our systems and our customers' data; legal obligation in respect of security |
| Send service messages, such as maintenance notices, security alerts and changes to terms | Identity, contact | Performance of a contract; legitimate interests |
| Tell existing customers and contacts about our products and services | Identity, contact, marketing preferences | Legitimate interests: business-to-business marketing, in accordance with the Privacy and Electronic Communications Regulations. Every message lets you opt out |
| Establish, exercise or defend legal claims | Any of the above | Legitimate interests; legal obligation |
Where we rely on legitimate interests we have considered the effect on you and concluded that the use is proportionate and within what you would reasonably expect. You have the right to object to any use based on legitimate interests; see "Your rights" below.
Marketing
We only send marketing to people in a business context: people who have enquired about our services, existing customers, and business contacts whose roles suggest our services may be relevant. We do not buy marketing lists and we do not send marketing to personal email addresses. Every marketing email tells you how to stop receiving them, and you can also simply reply or email hello@ventive.ai. We keep a record of your preference so that we do not contact you again by mistake.
How we use AI tools
We use AI-assisted tools in our work, for example to draft proposals, summarise notes, research organisations and write software. Some of those tools are our own products; some are third-party model services. When personal data is involved we use providers under contractual terms that prohibit them from using our inputs to train their models, and we review AI-generated content before it is used. We do not use your personal data to train AI models ourselves. Automated decisions that have a legal or similarly significant effect on you are never made without human involvement.
Who we share personal data with
We do not sell personal data. We share it only as follows:
- Service providers who process data on our behalf and under our instructions: hosting and infrastructure providers, email delivery providers, our accounting and banking providers, AI model providers as described above, and providers of the productivity tools we use to run the business. Each is bound by a written contract with data protection obligations.
- Professional advisers such as accountants, insurers and lawyers, where necessary.
- Subcontractors who help us deliver services to a customer, under confidentiality and data protection obligations, and only the data they need.
- Authorities, regulators and courts where the law requires it or to protect our rights or someone's safety.
- A buyer or successor if we sell or transfer our business, under an obligation to use the data only as this policy allows.
We publish a list of our current sub-processors for our software products on request and at ventive.ai.
Where personal data is kept
We keep personal data in the United Kingdom. Our website, our CRM and our software products run on servers located in the United Kingdom. Some of the service providers we use, such as email and AI model providers, are based in or process data in the United States or the European Economic Area. Where personal data leaves the United Kingdom we rely on the UK Government's adequacy regulations for the destination country, or on the International Data Transfer Agreement or UK Addendum approved by the ICO, together with any additional safeguards that are needed. You can ask us for details of the safeguards that apply to a particular transfer.
How long we keep it
| Data | How long |
|---|---|
| Web server logs | Up to 90 days |
| Enquiries that do not lead to work | Up to 3 years after our last contact with you, so that we can pick the conversation up if you come back |
| Prospect contact details gathered from public sources | Up to 2 years after we last contacted you, or immediately if you object |
| Customer contract, account and correspondence records | For the length of the contract and 6 years afterwards, which is the limitation period for contract claims in England |
| Invoices, payments and other accounting records | 6 years after the end of the financial year they relate to, as required by tax law |
| Marketing opt-outs | Indefinitely, so that we honour them |
| Customer data inside a software product where we are the processor | As set out in our Standard Terms and Conditions: exported or deleted within 30 days of the contract ending, then removed from backups in the ordinary rotation |
When data is no longer needed we delete or anonymise it. Data held in backups is deleted when the backup is rotated.
How we protect it
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and of backups and stored credentials, access limited to the people who need it and protected by individual accounts and multi-factor authentication, separation of each customer's data within our products, secure development practices with dependency scanning, daily backups, logging and monitoring, and an incident response process. No system is completely secure; if we become aware of a personal data breach that is likely to put you at risk we will tell you and the ICO as the law requires.
Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify data that is inaccurate or incomplete;
- erase your data in certain circumstances, for example where we no longer need it;
- restrict how we use your data while a question about it is resolved;
- object to processing based on legitimate interests, including direct marketing, which we will always stop on request;
- portability of data you have given us and that we process by automated means on the basis of a contract or consent, in a machine-readable form; and
- withdraw consent at any time where consent is the basis for processing, without affecting what was done before.
To exercise any of these rights, email hello@ventive.ai. We will respond within one month, or tell you if we need longer for a complex request. We may ask you to confirm your identity first. There is no charge unless a request is clearly unfounded or excessive.
If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Links to other websites
Our website and products may link to third-party websites. We are not responsible for their content or privacy practices, and this policy does not apply to them.
Changes to this policy
We will update this policy when our practices or the law change. The version and date at the top tell you when it was last revised, and material changes will be announced on our website or, for customers, by email. Earlier versions are available on request.
ventive.ai Ltd · 28 Howard Drive, Farnborough, Hampshire, GU14 9TQ · hello@ventive.ai · +44 (0)7798 652542
Privacy Policy v1.0, 6 September 2026. Replaces the policy dated 26 May 2024.