How Trisova handles personal data

Your organisation's records. When your organisation uses Trisova, it decides what goes in: suppliers and their contacts, staff, incidents, contracts and so on. For that data your organisation is the controller and Trisova is its processor: we handle it only on your organisation's instructions, under the data processing agreement. Questions about that data, including requests from the people in it, go to your organisation first; we'll help it answer.

Running our own business. For the accounts of the people who sign in, billing contacts, people who write to us and visitors to our website, Trisova is the controller. The rest of this page is mainly about that.

• Account details: name, work email, organisation, role, and the areas you can see.
• Sign-in and security: two-factor sign-in settings, when you signed in, and the audit log of important actions (who did what, and when).
• Settings you choose, such as your time zone, language and alert preferences.
• Messages you send us, and billing contacts for your organisation.
• Technical details needed to keep the service working and secure: device and browser type, IP address in server logs, and error reports (we remove the personal details we know about, such as account details, cookies and sign-in details).

We don't use advertising cookies or sell personal data. Trisova only uses the cookies it needs to keep you signed in and remember your language.

• To provide Trisova to your organisation under its contract with us (contract).
• To keep accounts and data secure, prevent misuse and fix faults (legitimate interests).
• To send service emails: alerts you've chosen, password and security messages, and important changes (contract and legitimate interests).
• To meet legal duties such as keeping invoices (legal obligation).

Some features use AI to read documents and draft text. A person always decides what happens next. AI is never used to make decisions about people. Details: how we use AI.

Trisova's database and files are stored in the European Union (Ireland). A few outside services help run Trisova; they are listed, with what each gets and where, on the sub-processors page. Where a service is outside the UK or EU (for example the AI provider in the United States), the transfer is covered by safeguards recognised under UK and EU data-protection law, such as standard contractual clauses.

• Account details: while your account is active; deleted with your organisation's data when its contract ends, or earlier on request.
• Your organisation's records: for the contract, then deleted or returned as the data processing agreement says.
• Audit logs and security records: for as long as your organisation's contract runs, so misuse can be investigated.
• Invoices: as long as tax law requires (in the UK, 6 years).

You can ask to see, correct or delete your personal data, to restrict or object to how it's used, or to receive it in a portable form. Write to hello@trisova.com; we reply within one month. If your data is in your organisation's records, we'll pass the request to your organisation. You can also complain to your data-protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority where you live or work.

Trisova, hello@trisova.com. We'll post changes to this policy here and tell account owners about significant ones by email.