Privacy policy

1. Data controller

The website innovacg.com operates under the brand INNOVA Consulting Group (“INNOVA”, “we”, “us”). The controller of personal data collected through this website, and of the personal data of clients in the United Kingdom and the European Union, within the meaning of the EU General Data Protection Regulation (GDPR) and the UK GDPR, is INNOVA CG LTD, a company registered in England and Wales (company number 17390819, registered office: 124-128 City Road, London, EC1V 2NX, United Kingdom).

For engagements contracted with INNOVA CONSULT LTD. (Canadian federal corporation number 1522612-1, registered office: 2164 Montreal Road, Unit 5, Ottawa, Ontario K1J 1G4, Canada), that company is the controller of the engagement data, and Canada’s PIPEDA also applies to that processing.

For all questions about personal data processing and the exercise of your rights, contact privacy@innovacg.com.

2. What data we collect

We collect the minimum data needed to respond to your enquiry and keep the site secure:

• Enquiry form data — name, email address and message text, plus the optional fields company, WhatsApp or Telegram contact and jurisdiction of interest. You provide them voluntarily when submitting the “Discuss a project” form or a consultation request. The page and source the enquiry was sent from (including UTM parameters) are stored with it.
• Technical data — IP address and browser User-Agent string. These are processed by our enquiries API for rate-limiting, spam protection and abuse prevention.
• AI assistant queries — the text of your question in the on-site assistant, the selected jurisdiction and the interface language. They are sent for processing to the language-model provider connected at the time (Anthropic or Ollama Cloud). Do not enter personal or confidential data into the assistant.
• Paid consultation booking — the booking window opens on the paid consultation tab, so the embedded Cal.com scheduler loads as soon as you open the window from a booking button, before you pick a time or type anything (when the window is opened on the request tab, the scheduler loads when you switch to the paid consultation tab). The details you enter in the scheduler (name, email address, chosen time, notes) are processed by Cal.com under its own privacy policy; when the scheduler loads, Cal.com receives technical data from your browser, including your IP address. We issue the invoice after the booking is confirmed; no card data is collected on the site.
• Messengers — if you write to us on WhatsApp or Telegram, we receive your phone number or username and the text of your message. The conversation runs through those services under their own terms.
• Analytics data — anonymised visit statistics via Google Analytics 4. Analytics cookies are set only after your explicit consent in the cookie banner in the European Economic Area (the 27 EU states, Iceland, Liechtenstein and Norway), the United Kingdom, Switzerland and Quebec; until consent is given there, analytics sets no cookies on your device and receives only anonymised signals without cookies. Everywhere else analytics cookies are on by default and you can switch them off with “Essential only” in the banner. Advertising cookies and advertising signals are off everywhere.

We do not collect special-category data and do not use data for ad targeting or selling to third parties.

3. Legal bases for processing

• Consent (Art. 6(1)(a) GDPR) — for analytics cookies (Google Analytics) in the EEA, the United Kingdom, Switzerland and Quebec. You may withdraw consent at any time.
• Pre-contractual steps (Art. 6(1)(b) GDPR) — for processing enquiry form data in order to respond to your request and prepare possible cooperation.
• AI assistant queries and consultation booking (Art. 6(1)(b) and 6(1)(f) GDPR) — to answer your question, arrange the consultation and keep the site working.
• Legitimate interest (Art. 6(1)(f) GDPR) — for processing IP address and User-Agent for security, protection and abuse prevention.

4. Processors and data transfers

We use a limited set of processors acting on our instructions and under appropriate data processing agreements:

• Resend — email delivery of notifications about your enquiries.
• Postgres / Payload CMS — storage of enquiry content in our database.
• Language-model providers (Anthropic or Ollama Cloud) — processing of the questions you ask the on-site AI assistant.
• Cal.com — the embedded scheduler for booking the paid consultation.
• Google Analytics — anonymised web analytics (in the EEA, the UK, Switzerland and Quebec only with consent).

WhatsApp (Meta Platforms) and Telegram are independent services: we use them to talk to you at your initiative, and their operators process data under their own terms.

Some processors may be located outside the EEA / UK. In such cases, transfers are made on the basis of appropriate safeguards (for example, Standard Contractual Clauses).

5. Retention periods

Enquiry data is retained for as long as necessary to process the request and related business correspondence, after which it is deleted or anonymised. Technical logs for security and rate-limiting are retained for a limited time and then deleted. Analytics data is retained according to the Google Analytics retention settings. Specific periods can be confirmed on request at privacy@innovacg.com.

6. Your rights

As a data subject under GDPR / UK GDPR you have the right to:

• access your personal data;
• rectification of inaccurate data;
• erasure of data (the “right to be forgotten”);
• restriction of processing;
• data portability;
• objection to processing based on legitimate interest;
• withdraw consent at any time (for processing based on consent).

To exercise any of these rights, write to privacy@innovacg.com. You also have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction; in the United Kingdom, this is the Information Commissioner’s Office (ICO).

7. Cookies

Strictly necessary cookies enable basic site operation. Analytics cookies (Google Analytics) work like this: in the EEA (the 27 EU states, Iceland, Liechtenstein and Norway), the United Kingdom, Switzerland and Quebec they are set only after your consent in the cookie banner; in all other regions they are on by default until you choose “Essential only”. The banner shows for everyone. Your choice is saved in your browser and overrides the default in both directions. You can change it by clearing the site’s cookies and data in your browser settings; the banner will reappear on your next visit. Advertising cookies are never set.

8. Changes to this policy

We may update this policy from time to time to reflect changes in our data practices or in the law. The current version is always available on this page.