Legal

Privacy Policy

Last updated: 21 August 2026 · Effective: 21 August 2026 · Version 2.0

Plain English summary: Proviso collects the minimum data needed to track your firm's compliance obligations. We store it securely in Ireland, we never sell it, and you can request its deletion at any time. The full legal detail is below.

1. Who we are

Proviso is operated by Proviso Compliance Limited (trading as Proviso.ie), a company registered in Ireland. Our registered address is Co. Kildare, Ireland.

For the purposes of the GDPR and the Data Protection Act 2018, Proviso Compliance Limited is the data controller for data we collect directly. Where you use Proviso to manage adviser compliance data, you are the data controller and we are your data processor. Contact us: privacy@proviso.ie

2. What data we collect

Account and firm data

Firm name, CBI registration number, and sector (financial planning, general insurance, mortgage broking, or mixed practice)
Principal's full name and email address
Billing information (processed by Stripe — we do not store card details)
Account login credentials (passwords are hashed and never stored in plain text)
Plan tier, subscription status, and access expiry dates (including one-off pack access windows)

Adviser compliance data

Adviser names, email addresses, roles, and professional designations (QFA, APA, CIP, CFP etc.)
Controlled Function (CF) and Pre-Approval Controlled Function (PCF) roles held
CPD records: event titles, providers, accreditation references, hours, MCC categories, and completion dates
CPD certificate files uploaded for AI parsing (stored securely, accessible only by the uploading firm)
Fitness and Probity declaration records including signing dates, attestation responses, and IP addresses
Pre-appointment due diligence confirmation records for CF and PCF holders
IAF Responsibility Maps, Business Area Statements, and reporting lines
AML training completion records and AML business risk assessments
Complaints log records including complainant names and resolution details
Client file audit records
Regulatory return filing records
Conflicts of interest declarations

One-off pack and concierge onboarding data

For one-off Compliance Evidence Pack purchasers: firm name, contact details, purchase date, and 7-day access window timing
For White-Glove Concierge Onboarding requests: firm name, contact details, adviser count, and any compliance documents voluntarily uploaded to our secure folder
Documents uploaded for concierge onboarding are used solely for data entry purposes. Extraction is AI-assisted: document content is processed in real time by the Claude API (Anthropic) to convert it into structured compliance records, which are then reviewed by Proviso before import. Source documents are deleted within 30 days of onboarding completion (see Sections 5 and 6)

Diagnostic tool data

For the free pre-audit diagnostic: email address, firm name, answers to the 10 compliance questions, and resulting score
This data is used to personalise follow-up communications and is retained for 12 months
Completing the diagnostic notifies our team of your results so we can follow up. If you press the button requesting a full compliance review, we use your contact details and answers to arrange that review
Diagnostic data is never sold or shared with third parties

RFI Insurance claims data

For firms claiming under the CBI RFI Insurance Guarantee: email address, CBI notification details, and support interaction records
This data is used solely to provide the guarantee service and is retained for 3 years

Usage data

Log data including IP addresses, browser type, pages visited, and timestamps
Audit trail of actions taken within the platform
Compliance notifications generated by the platform (January deadline alerts, PCF pre-approval prompts)
Cookie data (see our Cookie Policy)

What we do not collect

Client or customer data belonging to your firm — Proviso is for internal staff compliance only
Financial account details (Stripe handles all payment processing)
Sensitive personal data as defined under GDPR Article 9 (health, biometric, racial or ethnic origin, political opinions, etc.)

3. Legal basis for processing

Data type	Legal basis
Account, firm, and subscription data	Contract (Article 6(1)(b) GDPR) — necessary to provide the service
Adviser compliance records (CPD, F&P, IAF, AML, complaints, audits, returns, conflicts, pre-appointment)	Contract and legitimate interests (Article 6(1)(b) and (f) GDPR) — helping regulated firms meet CBI obligations
One-off pack access and expiry data	Contract (Article 6(1)(b) GDPR) — necessary to enforce the one-off access terms
Concierge onboarding documents	Contract and consent (Article 6(1)(a) and (b) GDPR) — you voluntarily upload these for the service
Diagnostic tool data	Consent and legitimate interests (Article 6(1)(a) and (f) GDPR)
RFI Insurance claim data	Contract (Article 6(1)(b) GDPR) — necessary to deliver the guarantee
Billing and invoice records	Legal obligation (Article 6(1)(c) GDPR)
Usage and log data	Legitimate interests (Article 6(1)(f) GDPR) — security and service improvement
Compliance notification triggers	Legitimate interests (Article 6(1)(f) GDPR) — helping firms meet their regulatory deadlines

4. How we use your data

To provide and operate the Proviso compliance tracking platform
To enforce one-off pack access windows and expiry terms
To deliver concierge onboarding services where requested
To provide the CBI RFI Insurance Guarantee support service
To send automated compliance deadline alerts (January CPD deadline, F&P signing reminders, PCF pre-approval prompts)
To generate compliance reports and Compliance Evidence Packs on your request
To process subscription payments via Stripe
To send transactional emails via Resend (account setup, adviser invitations, nudge reminders, deadline alerts)
To use AI document parsing (Claude API by Anthropic) on CPD certificates you upload and on documents you submit for White-Glove Concierge Onboarding — content is processed in real time and is not retained by Anthropic beyond the API call, nor used to train AI models
To respond to support queries and RFI Insurance claims
To improve and develop the platform
To detect and prevent fraud or security incidents
To comply with our own legal and regulatory obligations

We do not use your data for advertising, profiling, or automated decision-making that produces legal effects on you.

Automated notifications: Proviso generates in-platform and email notifications based on your compliance data — for example, alerting you when CPD hours are short or an F&P declaration is unsigned. These are automated triggers based on your own data and are not profiling. You can dismiss notifications within the platform.

5. Who we share data with

Provider	Purpose	Location
Supabase Inc.	Database hosting, authentication, and edge function execution	EU West (Ireland)
Vercel Inc.	Website and application hosting	EU region
Stripe Inc.	Payment processing for subscriptions, additional packs, and one-off purchases	EU (Irish entity)
Resend Inc.	Transactional email delivery (welcome emails, adviser nudges, deadline alerts)	EU region
Anthropic PBC	AI parsing of CPD certificates and concierge onboarding documents you choose to upload. Content processed in real time; not retained by Anthropic after the API call and not used for AI model training.	USA (Standard Contractual Clauses)
Microsoft Ireland Operations Ltd	Business email (Microsoft 365). Enquiries, concierge requests, and diagnostic notifications you send us arrive in our Microsoft-hosted mailboxes.	EU data residency

We never sell, rent, or trade your personal data. We do not share data with the Central Bank of Ireland or any regulatory body unless compelled by law.

External consultants invited by your firm: if your firm's principal invites an external compliance consultant to its account, that consultant can view and manage your firm's compliance data for as long as the access link remains active. This sharing happens under your firm's direction and control — your principal can revoke consultant access at any time.

6. International transfers

Your data is stored and processed primarily in Ireland. Where we use services that transfer data outside the EEA (Anthropic for AI parsing of certificates and concierge documents), we ensure Standard Contractual Clauses are in place. Anthropic processes certificate data in real time during the parsing API call only — no certificate content is retained by Anthropic after the call completes.

7. How long we keep your data

Data type	Retention period
Account and firm data	Duration of subscription plus 12 months after cancellation
One-off pack purchaser data	7-day active access period, then data retained for 30 days in case of conversion to subscription, then deleted
CPD records	7 years (matching CBI regulatory record-keeping requirements)
F&P declarations	7 years
Pre-appointment due diligence records	7 years
IAF records	7 years
AML records (training and risk assessments)	7 years
Complaints records	7 years
Client file audit records	7 years
Regulatory return records	7 years
Generated compliance reports and Compliance Evidence Packs	Duration of your account, so previously generated packs remain available for re-download; deleted with your account data
Conflicts of interest records	7 years
Concierge onboarding documents	30 days after onboarding completion, then deleted
Diagnostic tool results	12 months
RFI Insurance claim records	3 years
Audit logs	7 years
Billing records	7 years (Irish company law requirement)
Usage and log data	90 days

The 7-year retention period for compliance records reflects the CBI's standard regulatory expectation and mirrors your own record-keeping obligations as a regulated firm.

8. Your rights under GDPR

Right of access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate data
Right to erasure — request deletion, subject to the 7-year regulatory retention requirement for compliance records
Right to restriction — request that we limit processing
Right to data portability — receive your data in a machine-readable format
Right to object — object to processing based on legitimate interests, including automated notification triggers
Right to withdraw consent — where processing is based on consent (diagnostic tool, marketing), you may withdraw at any time

To exercise any right, email privacy@proviso.ie. We will respond within 30 days. You also have the right to complain to the Data Protection Commission.

9. Data security

All data encrypted at rest (AES-256) and in transit (TLS 1.2+)
Row-level security enforced at the database level — no firm can access another firm's data
Authentication using industry-standard JWT tokens with automatic expiry
Passwords hashed using bcrypt — never stored in plain text
One-off pack access enforced at the application layer with hard expiry timestamps
CPD certificates stored in a private storage bucket — not publicly accessible
All data stored in EU-based infrastructure (Ireland)
Access to production data restricted to authorised personnel only

In the event of a data breach likely to result in risk to your rights, we will notify you and the Data Protection Commission within 72 hours as required by GDPR Article 33.

10. Automated decision-making and notifications

Proviso uses automated logic to generate in-platform notifications and, where Resend is configured, email alerts. These include:

January deadline alerts when CPD hours are short or F&P declarations are unsigned within 60 days of year end
PCF pre-approval prompts when a principal navigates to the pre-appointment due diligence section
Compliance Evidence Pack upsell prompts when compliance gaps are detected for Growing Firm and Multi-Branch subscribers

These notifications are informational — they do not make decisions about you or produce legal effects. They are based solely on your own data and can be dismissed within the platform. You can object to receiving them by contacting privacy@proviso.ie.

11. Cookies

See our Cookie Policy for full details.

12. Children's data

Proviso is a business-to-business service for regulated financial services professionals. We do not knowingly collect data from anyone under 18.

13. Changes to this policy

We will notify you by email of material changes at least 30 days before they take effect and update the version number at the top of this page.

14. Contact

Proviso Compliance Limited (trading as Proviso.ie)
Co. Kildare, Ireland
Email: privacy@proviso.ie