Privacy Policy

SevHas Systems is the controller of personal data collected through this website, the enquiry form, and related correspondence. This notice explains what we collect, why we use it, and the rights you have. It is written for the UK General Data Protection Regulation and the Data Protection Act 2018. Corporate details are not published on this site. Email partners@sevhassystems.com if you need them.

Who this notice covers. It covers visitors to this website, people who submit an enquiry, and people who correspond with us about a possible engagement. It does not cover staff. A separate notice is used for recruitment if we open applications.

What we collect. From the enquiry form: your name, organisation, official email address, telephone number, country, the type of requirement, and the message you write. From correspondence: anything you later send by email or telephone, including attachments. From the website: IP address, browser type, device type, pages viewed, referring address, and the date and time of the visit. From cookies: the data described in the Cookie Policy. We do not ask for special-category data, and we do not want it. Do not put health information, political opinions, or similar material in an enquiry.

Why we use it, and the lawful basis. We use enquiry and correspondence data to receive and assess a request, decide whether we can deal with the organisation, carry out customer qualification, due diligence and end-use checks, reply to you, and keep a record of that assessment. The lawful bases are steps taken before a contract, our legitimate interest in screening counterparties before we discuss a defence capability, and legal obligation where export control, sanctions or another duty applies. We use technical data to run and secure the site, to diagnose faults, and to understand which pages are used. The lawful basis is legitimate interest. We do not use enquiry data for marketing, and we do not send newsletters, unless you have asked us in writing to contact you for that purpose.

Who we share it with. We share personal data with professional advisers, IT and hosting providers, and email providers, each acting on our instructions or under their own legal duty. We share it with a competent authority where the law requires it, including an export-control or sanctions authority. We do not sell personal data. We do not pass enquiry data to unrelated commercial partners. If a supplier processes data outside the United Kingdom, we use an approved transfer mechanism, such as the UK extension to EU standard contractual clauses or a UK adequacy regulation, before the transfer is made.

How long we keep it. An enquiry that does not proceed is kept for 24 months from the last contact, then deleted or reduced to a non-identifying record. Records that support an export-control, sanctions or due-diligence decision are kept for up to 6 years after the engagement ends, or longer if a legal hold, investigation or claim requires it. Server logs are kept for 12 months. Cookie lifetimes are set out in the Cookie Policy.

Security. Access to enquiry records is limited to people who need them for assessment or compliance. We use access control, encryption in transit, and supplier terms that require confidentiality. No method of transmission is perfectly secure. Do not send classified or export-controlled technical data through the enquiry form.

Your rights. You may ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict its use, and object to processing based on legitimate interests. You may also ask for portability where the processing is based on a contract and carried out by automated means. We will respond within one month, or tell you if we need longer. Some records cannot be deleted while a legal duty applies, including export-control and sanctions records. To exercise a right, email partners@sevhassystems.com with the subject “Data protection request”. We may need to confirm you are the person the data relates to.

Complaints. You may complain to the Information Commissioner’s Office at ico.org.uk. We ask that you contact us first so we can try to resolve it.

Children. This site is not directed at children. We do not knowingly collect their data. If you believe a child has submitted an enquiry, email us and we will delete it.

Changes. We will change the “last updated” date when this notice changes. A material change to how we use enquiry data will be stated on this page.