Legal
Privacy Policy
Last updated: 8 July 2026
This Privacy Policy explains how Ayok IT Solutions Limited (trading as PilotVantage) ("PilotVantage", "we", "us") collects, uses and protects personal data when you visit pilotvantage.com, sign up for an account, or use the PilotVantage governance, risk and compliance ("GRC") platform. We are committed to handling your data lawfully, transparently and in line with the UK GDPR and the Data Protection Act 2018.
1. Who we are
Ayok IT Solutions Limited (trading as PilotVantage) is a company registered in England & Wales (company number 13640465), with its registered office at 124 City Road, London, England, EC1V 2NX. We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC039605.
For any questions about this policy or your personal data, contact our privacy team at privacy@pilotvantage.com.
2. Controller and processor roles
Your relationship with us determines our role under data protection law:
- When we are the controller. For personal data about our website visitors, prospects, account administrators and billing contacts, we decide how and why the data is processed — so we are the data controller. This policy governs that processing.
- When we are the processor. The information you and your colleagues enter into the platform (your risk register, incidents, policies, evidence, vendor records, staff details and so on) is controlled by your organisation. Your organisation is the data controller and we process it on your behalf under our Data Processing Agreement.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account & identity | Name, work email, job title, organisation name, hashed password, 2FA device details | You, at sign-up and in settings |
| Billing | Billing contact, subscription tier, plan history. Card details are handled directly by Stripe — we never see or store full card numbers. | You / Stripe |
| Usage & technical | IP address, browser type, pages viewed, feature usage, session and audit logs, timestamps | Automatically, as you use the service |
| Support & communications | Messages you send us, enquiry details, correspondence | You |
| Customer content | Data you enter into the platform (processed on your organisation's behalf — see section 2) | You / your colleagues |
4. How we use your data
- To create and administer your account and organisation workspace;
- To provide, maintain and improve the platform and its features;
- To authenticate you and keep your account secure (including two-factor authentication and account-lockout protection);
- To process subscriptions, trials and payments;
- To send service messages (e.g. security alerts, billing notices, important changes) and, where permitted, relevant product updates;
- To provide customer support;
- To detect, prevent and investigate security incidents, fraud and misuse;
- To comply with our legal and regulatory obligations.
5. Our legal bases
- Contract — to provide the service you have signed up for and to manage billing.
- Legitimate interests — to secure, operate and improve the platform, and to communicate with you about it, balanced against your rights.
- Consent — for non-essential cookies and any optional marketing, which you can withdraw at any time.
- Legal obligation — to meet accounting, tax and other statutory requirements.
6. Who we share data with
We do not sell your personal data. We share it only with trusted service providers ("sub-processors") that help us run the platform, and only as needed. Our current sub-processors are listed in our Data Processing Agreement and include our hosting provider (DigitalOcean, LLC) and payment processor (Stripe). We may also disclose data where required by law, to enforce our terms, or in connection with a merger or acquisition (with notice).
7. International transfers
We host customer data in the United Kingdom. Where a sub-processor processes data outside the UK, we ensure an appropriate safeguard is in place — such as UK adequacy regulations or the International Data Transfer Agreement (IDTA) / Addendum to the EU Standard Contractual Clauses.
8. How long we keep it
We keep account and identity data for the duration of your subscription and while your account remains active. After your account is closed, we retain personal data up to 90 days after account closure, after which personal data is deleted or anonymised (backups purge on a rolling 35-day cycle). We keep billing records for as long as required by law (typically six years). Customer content is retained and deleted in line with your organisation's instructions under the DPA.
9. How we protect your data
We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS), tenant isolation, role-based access control, enforced two-factor authentication, audit logging, and least-privilege administrative access. See our Security page for detail.
10. Your rights
Under UK data protection law you have the right to: access your data; correct inaccurate data; erase data; restrict or object to processing; data portability; and to withdraw consent. To exercise any of these, email privacy@pilotvantage.com. We will respond within one month.
If we process your data as a processor on behalf of your employer, please direct rights requests to your organisation's account administrator, who is the controller.
11. Cookies
We use a small number of essential cookies and, only with your consent, Google Analytics on our public website, documentation and blog to understand aggregate usage. Analytics never runs unless you opt in via our cookie banner, is not used inside the signed-in application, and you can withdraw consent at any time. See our Cookie Policy for the full list of cookies and how to control them.
12. Children
PilotVantage is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children.
13. Changes to this policy
We may update this policy from time to time. We'll post the new version here and update the "last updated" date above; material changes will be notified to account administrators.
14. Contact us
Privacy enquiries: privacy@pilotvantage.com
Data protection contact: Micheal Opayemi — micheal.opayemi@pilotvantage.com
Post: Ayok IT Solutions Limited (trading as PilotVantage), 124 City Road, London, England, EC1V 2NX