Srivantage (KVK: 42027730), Eindhoven, Netherlands, is the data controller for personal data collected through our websites and products. Contact: [email protected].
Srivantage products are architected with data sovereignty as a foundational principle. This means:
| Data type | When collected | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Email address | Voluntarily provided via contact form, eval download, or demo booking | Responding to enquiries, sending product updates (if consented), fulfilling download requests | Legitimate interest / Consent | Until withdrawal of consent or 3 years from last interaction |
| Name and company | Voluntarily provided via contact or demo booking form | Personalising responses to enquiries and demo bookings | Legitimate interest | 3 years from last interaction |
| Form submission content | Questions or messages submitted via contact forms | Responding to your enquiry | Legitimate interest | 3 years from submission |
| IP address and access logs | Automatically by Cloudflare when visiting srivantage.com, capvanta.ai, or regvanta-ai.com | Security, fraud prevention, service delivery | Legitimate interest | Per Cloudflare's data retention policy (typically 30 days) |
Our websites are hosted on Cloudflare Pages and served via Cloudflare's global CDN. Cloudflare processes IP addresses and access logs as a data processor on our behalf. Cloudflare is certified under the EU-US Data Privacy Framework. See Cloudflare's Privacy Policy.
Contact and demo booking forms on our websites use Formspree to process and forward form submissions to us by email. Formspree receives form submission data as a processor. See Formspree's Privacy Policy.
When a user chooses to use AI narrative enrichment, a prompt is sent directly from the user's browser to their chosen LLM provider. Srivantage infrastructure is not involved and receives no copy of this data.
Organisational users — where AI enrichment is used in a business or professional context, the organisation is solely responsible for: (a) ensuring compliance with its AI usage policies and data governance framework; (b) ensuring compliance with GDPR, the EU AI Act, and any applicable sector-specific regulation; (c) its contractual relationship with the chosen LLM provider. Srivantage is not party to that relationship and accepts no responsibility for any data protection, regulatory, or contractual consequence.
Individual users in personal capacity — where AI enrichment is used by an individual personally (not on behalf of an organisation), that individual bears full personal responsibility for their choice of LLM provider, any personal data transmitted, and compliance with all applicable laws. Srivantage makes no representation as to the suitability of any LLM provider for any individual's specific circumstances and accepts zero liability for any consequence of an individual's decision to use AI enrichment features.
Srivantage strongly recommends activating the company name masking feature to minimise identifying information in all AI prompts, regardless of user type.
Our website links to a demonstration video hosted on YouTube (Google LLC). When you click to watch the video, you are directed to YouTube where Google's privacy policy applies. We do not embed YouTube iframes that load tracking cookies automatically.
Srivantage websites do not use marketing or analytics cookies. The only browser storage used is:
As a data subject within the European Economic Area, you have the following rights:
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl.
Form submission data processed by Formspree may be transferred to servers outside the EEA. Formspree maintains Standard Contractual Clauses (SCCs) for such transfers. Cloudflare operates under the EU-US Data Privacy Framework. Where LLM providers are located outside the EEA, users are responsible for ensuring appropriate transfer mechanisms are in place under their organisation's data governance framework.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. Given the browser-native architecture of our products, the primary security perimeter for assessment data is your own device and browser — we encourage users to follow standard device security practices.
Srivantage products are intended for business use by adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently collected such data, contact us immediately at [email protected].
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. The effective date at the top of this document will reflect the most recent revision. For material changes, we will endeavour to provide notice via our website.
Notwithstanding any other provision of this Privacy Policy or any other agreement, the following applies unconditionally and cannot be waived or modified:
Srivantage never processes your assessment data. The architecture of all Srivantage products is designed so that no assessment input, company data, strategy information, or regulatory response ever reaches Srivantage infrastructure. This is a technical fact, not merely a policy commitment. Any claim arising from alleged data processing by Srivantage of tool input data shall be void, as no such processing occurs.
User responsibility for third-party transmissions — absolute. Where a user initiates an AI narrative enrichment call: (a) an organisational user's responsibility is governed by their organisation's policies, contracts, and applicable regulation — Srivantage is not party to any of those; (b) an individual user in personal capacity bears full personal legal responsibility for that transmission, the data it contains, and all consequences. In neither case does Srivantage bear any responsibility, liability, or duty of care arising from the transmission or its consequences. This is not a limitation of liability — it is an accurate characterisation of Srivantage's technical position: the transmission does not pass through Srivantage infrastructure and Srivantage has no knowledge of, control over, or participation in it.
Maximum liability for privacy claims. To the fullest extent permitted by law, Srivantage's total liability for any privacy or data protection claim shall not exceed EUR 500 (five hundred euros) in aggregate. This ceiling applies regardless of the number of claims, claimants, or legal theories advanced.
This clause survives termination of any agreement between the parties and remains in effect indefinitely.
Srivantage
Eindhoven, Netherlands · KVK: 42027730
Email: [email protected]
Data Protection enquiries: [email protected]