AIVORALegal
Data Processing
Last updated: 15 September 2026
1. Scope
This Data Processing statement describes how AIVORA HC (“AIVORA”, the “Processor”) processes personal data contained in Customer Data on behalf of its customers (each a “Controller”) when they use the AIVORA platform. It supplements our Terms of Service and forms the basis of the data processing agreement we enter into with customers subject to the GDPR, UK GDPR, the UAE Personal Data Protection Law or similar legislation.
2. Roles and instructions
The Controller determines the purposes and means of processing the personal data it uploads. AIVORA acts as Processor and processes that data only on the Controller's documented instructions - which include the Terms, the configuration choices made in the platform and any written instructions agreed between the parties - unless required otherwise by law, in which case we will inform the Controller where legally permitted. We will promptly inform the Controller if we believe an instruction infringes applicable data protection law.
3. Details of processing
- Subject matter - provision of the AIVORA HC advisory platform.
- Duration - the term of the customer agreement plus the export and deletion period described below.
- Nature and purpose - collection, storage, structuring, analysis and AI-assisted interpretation of workforce evidence to produce Human Capital diagnostics, benchmarks and deliverables.
- Categories of data subjects - the Controller's employees, contractors and candidates; the Controller's authorised platform users.
- Categories of personal data - identifiers (name, email, employee ID), employment data (role, grade, tenure, location, compensation bands, performance and engagement indicators), organisational data and any other data the Controller chooses to include in uploaded evidence. Controllers should avoid uploading special-category data unless necessary and lawful.
4. Confidentiality of personnel
AIVORA ensures that personnel authorised to process Customer Data are bound by confidentiality obligations, receive appropriate data protection and security training, and access personal data only where necessary to perform their role.
SecurityHow we protect your data
As Processor, AIVORA implements the technical and organisational measures below, which are appropriate to the risk of processing workforce data and are reviewed regularly.
- Encryption in transit. All traffic to the website and platform is served over HTTPS/TLS with certificates that renew automatically. Plain HTTP is redirected.
- Encryption of stored secrets. Integration credentials, API keys and similar sensitive values are encrypted at the application layer before being written to the database; passwords are never stored - only salted bcrypt hashes.
- Tenant isolation. Every organisation's data is stored with a tenant identifier and every query is scoped to the caller's tenant, so one customer's evidence, benchmarks and deliverables are never visible to another.
- Authentication and access control. Sign-in uses short-lived signed tokens with support for single sign-on (SSO/OAuth). Role-based permissions restrict what each user can view, upload, generate or administer.
- Audit logging. Administrative and data-changing actions are recorded in an audit log that records who did what and when, so activity can be reviewed and investigated.
- Abuse protection. Rate limiting, request validation and strict cross-origin rules protect the API from brute-force and automated abuse.
- Backups and recovery. The production database is backed up on a schedule with a defined retention window, allowing point-in-time restoration if data is lost or corrupted.
- Least privilege operations. Production infrastructure is isolated in containers, accessed only by named administrators over key-based SSH, with secrets injected from environment configuration rather than committed to code.
- AI model handling. Content sent to third-party AI models is limited to what is needed to produce the requested output, is transmitted over encrypted connections, and is not used by AIVORA to train models. See the sub-processor section for the providers involved.
- Segregation of environments. Production, staging and development environments are separated; production data is not copied into non-production environments.
- Incident response. Security events are logged and monitored. If we become aware of a personal data breach affecting Customer Data we will notify the Controller without undue delay, provide the information reasonably needed to meet its own notification obligations, and cooperate in the investigation and remediation.
Detailed descriptions of these controls, and evidence of them, can be provided to customers under NDA on request.
5. Sub-processors
The Controller authorises AIVORA to engage the following categories of sub-processor. Each is bound by written terms imposing data protection obligations no less protective than those in this statement, and AIVORA remains responsible for their performance.
- Cloud hosting and storage - virtual servers, managed databases, object storage and backup storage for the platform.
- Website hosting and CDN - delivery of the public website.
- AI model providers - large language model APIs used to interpret evidence and draft deliverables. Only the content needed to fulfil a specific request is sent, over encrypted connections, under terms that prohibit the provider from using it to train their models.
- Email delivery - transactional email such as invitations, password resets and notifications.
- Payment processing - subscription billing; receives billing contact details only, never Customer Data.
We will give Controllers at least 30 days' notice before adding or replacing a sub-processor, during which they may object on reasonable data-protection grounds. A current named list is available on request at the address below.
6. Data subject requests
Taking into account the nature of the processing, AIVORA will assist the Controller through appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights (access, rectification, erasure, restriction, portability and objection). If we receive such a request directly we will not respond except to direct the data subject to the Controller, unless legally required to act.
7. Assistance with compliance
AIVORA will assist the Controller in ensuring compliance with its obligations regarding security of processing, breach notification, data protection impact assessments and prior consultation with supervisory authorities, taking into account the information available to us.
8. International transfers
AIVORA operates from the United Arab Emirates and uses sub-processors in other jurisdictions, including the European Union and the United States. Where Customer Data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) or another lawful transfer mechanism, together with supplementary measures such as encryption in transit.
9. Return and deletion
On termination or expiry of the customer agreement, the Controller may export Customer Data from the platform for 30 days. After that period AIVORA will delete Customer Data from live systems, and it will be removed from backups as those backups expire in the normal retention cycle, unless retention is required by law. We will confirm deletion in writing on request.
10. Audits
AIVORA will make available the information necessary to demonstrate compliance with this statement and, no more than once per year (or following a breach), allow for and contribute to audits or inspections conducted by the Controller or an independent auditor mandated by it, subject to reasonable notice, confidentiality and scope limitations.
11. Contact
Data protection enquiries, sub-processor lists, security documentation and incident reports: email info@aivorahc.com.