Privacy

Who We Are

Veriplane is operated by Norven Group Ltd, a company registered in England and Wales under company number 13127599. For the purposes of UK data protection law, Norven Group Ltd is the controller for personal information submitted through the platform unless a separate written agreement states otherwise.

Information We Collect

We may collect and process the following categories of information:

• Contact details, including name, work email address, organisation, role, and professional contact information.
• Engagement details, including assessment context, regulatory deadlines, jurisdictions, AI system descriptions, and governance requirements.
• Platform records, including account activity, submitted evidence, dashboard interactions, document status, and audit trail metadata.
• Technical information, including browser, device, IP address, access times, and security logs used to protect the platform.

How We Use It

We use information to respond to enquiries, administer access, support governance workflows, organise evidence and attestation records, maintain security, and improve the reliability of the platform.

Where an engagement proceeds, information may be used to prepare assessments, coordinate named experts, support board or supervisory records, and maintain a defensible audit trail.

Legal Bases

We process personal information where necessary to take steps before entering into a contract, perform a contract, comply with legal obligations, pursue legitimate interests in operating a secure governance platform, or where consent has been provided for a specific purpose.

Sharing Information

We only share information where needed to provide the platform, support an engagement, meet legal obligations, or protect security. This may include trusted infrastructure providers, professional advisers, independent experts involved in an assessment, or regulators and competent authorities where disclosure is required.

Retention

We retain personal information for as long as needed for the purposes described in this notice, including enquiry handling, contractual records, governance evidence, audit trails, legal compliance, and dispute management. Retention periods may vary where records form part of an institutional governance file.

Security

We apply administrative, technical, and organisational safeguards designed to protect platform information against unauthorised access, alteration, disclosure, or loss. No system can be guaranteed to be completely secure, but we work to maintain controls proportionate to the sensitivity of governance and assessment records.

Your Rights

Depending on your location and the nature of the processing, you may have rights to access, correct, delete, restrict, object to, or request a copy of your personal information. You may also have the right to complain to the UK Information Commissioner's Office or another relevant supervisory authority.

Contact

For privacy questions or rights requests, contact privacy@veriplane.com.