Privacy Notice

How legal.avantwerk.co.uk processes personal data. UK GDPR Art. 13 + Art. 14 information obligation. Data Protection Act 2018.

1. Who is the controller?

The controller of personal data processed in connection with the Avantwerk Legal AI service is:

Bennovate spółka z ograniczoną odpowiedzialnością
ul. Christiana Andersena 25, 94-118 Łódź, Poland
KRS: 0000597272 · NIP: 7272799328 · REGON: 363700466
Registered at the District Court for Łódź-Śródmieście, XX Commercial Division of the National Court Register

Operating in the United Kingdom under the trading name Avantwerk Legal AI.

Support and service contact: support@avantwerk.com · Legal notices: legal@avantwerk.com · Phone: +44 20 4538 7989

(the "Controller", "we", "us", "our")

2. Data protection contact

Data-protection contact. You can contact our data-protection contact about this notice, our use of personal data or your data-protection rights. This functional contact is not a claim that a statutory data protection officer has been appointed:

Email: dpo@avantwerk.com

Contacting this person is not a prerequisite for exercising your data-subject rights. Rights requests may be made directly using the procedure in Section 11.

3. Who does this notice apply to?

This Privacy Notice, given in accordance with UK GDPR Art. 13 (information provided at the time personal data are collected) and Art. 14 (information provided where personal data are not obtained directly from the data subject), applies to personal data relating to:

1. Firm contacts: individuals who register a trial account, subscribe to the Service, or are named billing or technical contacts for a subscribing firm;
2. Fee-earners and solicitors: individuals at a subscribing firm who use the Service under a seat licence;
3. Enquirers: individuals who contact us through our website, email or phone with a query or for information about the Service; and
4. Prospective customers: individuals who receive marketing communications from us about the Service.

What this notice does not cover. The Customer remains controller of client data and Matter Content used in its legal practice. The canonical case record is held in the encrypted Customer-Controlled Vault: on the solicitor's computer in Solo, on a firm-controlled host reached over authenticated HTTPS on the firm's LAN or VPN in Practice, or on dedicated customer-controlled infrastructure in Enterprise. The browser is a replaceable interface and disposable cache. Content can leave on three documented event categories: (1) automatic upload processing, including document summary/analysis and matter-fact extraction; (2) user-requested AI work, including an operator-confirmed in-app screenshot question whose pixels are sent as-is; and (3) optional AI-assisted dictation clean-up, which sends the transcript and selected matter vocabulary. Verbatim dictation sends nothing. External processing is governed by the Data Processing Agreement.

4. What personal data do we process?

We process only the personal data needed to operate the Service and fulfil our legal and contractual obligations. On managed-key plans this can include content sent during automatic upload processing, user-requested AI work (including an operator-confirmed screenshot question whose pixels are sent as-is), or optional AI-assisted dictation clean-up; see Section 10 and the Data Processing Agreement.

Information obtained indirectly. Where Article 14 applies, we provide this notice within a reasonable period and no later than one month after obtaining the data, or earlier at our first communication with you or before first disclosure to another recipient. We identify the applicable source and do not use indirectly obtained contact data for electronic marketing unless PECR permits it. Statutory exceptions to the Article 14 notice duty apply only where their conditions are met and are documented.

We do not ask for special-category or criminal-offence data during ordinary registration. Such data may appear in support or legal correspondence, or in content processed on a managed-key plan through automatic upload processing, user-requested AI work or optional AI-assisted dictation clean-up. Where Bennovate acts as controller, processing requires an Article 6 basis and, where applicable, an Article 9 condition such as Article 9(2)(f) for the establishment, exercise or defence of legal claims, together with the safeguards required for Article 10 data. For managed-key Matter Content, the Customer is controller and must establish the relevant Article 6, Article 9 and Article 10 conditions; Bennovate processes only on documented instructions under the DPA.

5. Why do we process your data and on what legal basis?

5.1 Performance of contract: UK GDPR Art. 6(1)(b)

Where you contract with us as an individual, we process account identity, contact details and billing data as necessary to enter into and perform that contract. Where the Customer is a firm or other organisation, Article 6(1)(b) does not automatically apply to its employees or representatives; their business contact and account data are processed under the legitimate interests described in Section 5.3 or, where applicable, a legal obligation.

Retention: During the subscription, for performance of the contract. After it ends, core account and contract records are normally kept for six years where reasonably necessary to establish, exercise or defend contractual claims. Section 5 Limitation Act 1980 does not impose a retention duty: it generally bars an action founded on simple contract six years after the cause of action accrued. Post-contract retention is therefore based on our legitimate interests under Art. 6(1)(f), subject to review against the actual claim-accrual date, any legal hold and any separate statutory duty.

5.2 Compliance with a legal obligation: UK GDPR Art. 6(1)(c)

We process invoicing data, transaction records and certain security logs to comply with: (a) accounting and tax obligations under applicable law (UK and Polish); (b) accounting and tax record-keeping obligations under the Companies Act 2006 and HMRC record-keeping rules; (c) obligations to assist data subjects and the Information Commission.

Retention: Financial and tax records, 6 years from the end of the relevant financial year. Security logs, 90 days routine; longer if related to a confirmed incident.

5.3 Legitimate interests: UK GDPR Art. 6(1)(f)

We process business contact, account-administration, technical and service-usage data for legitimate interests: (a) administering and supporting organisational customer accounts; (b) maintaining security, integrity and availability of the Service; (c) detecting and preventing fraud and unauthorised access; and (d) improving the Service through aggregated usage analysis where configured. Aggregation is not described as anonymisation unless the result has been assessed as no longer relating to an identified or identifiable person; otherwise it remains personal data and is handled under this notice. We balance those interests against the rights and reasonable expectations of the individuals concerned and maintain a Legitimate Interests Assessment.

Retention: Technical data: 90 days, except where retained longer for active security investigation.

5.4 Consent: UK GDPR Art. 6(1)(a)

Where you have given consent, we process: (a) your email address for marketing communications; (b) personal data you voluntarily provide in surveys or feedback; (c) website measurement data for audience analytics; and, only where separately chosen, (d) advertising and audience data for Google Ads campaign measurement or remarketing and (e) Meta campaign measurement or remarketing. We rely on the PECR regulation 22(3) soft opt-in only where all statutory conditions are met: we obtained the details during a sale or genuine negotiation for a sale, market only our own similar products or services, and provided a simple free opt-out when the details were collected and in every message.

For cookies and similar technologies, PECR reg. 6 consent governs storage or access on your device and UK GDPR Art. 6(1)(a) is the lawful basis for the resulting personal-data processing. We do not switch that processing to legitimate interests if consent is refused or withdrawn. Consent can be withdrawn at any time through Cookie settings, an applicable unsubscribe link or by writing to dpo@avantwerk.com.

Retention of consent records: 3 years from consent or withdrawal.

6. Cookies and tracking technologies

Our use of cookies, pixels, tags, local storage and similar technologies is governed by PECR reg. 6 and UK GDPR. Full details are in our Cookies Policy. Strictly necessary technologies do not require consent. Optional functional services, audience analytics, Google advertising and Meta advertising are separate purposes and remain off unless the corresponding choice is made. Google Ads and Meta Pixel are described on an off-ready basis and are not active merely because they appear in this notice.

7. Who receives your personal data?

We share personal data only where necessary and on an appropriate legal basis. Transfers to third parties are subject to written data-processing agreements as required by UK GDPR Art. 28.

The table above identifies recipients used for Bennovate's own controller purposes as well as recipients that may process Customer-instructed data under the DPA. A recipient is a Customer sub-processor only to the extent Bennovate engages it to process personal data on the Customer's behalf; a controller-side sales, billing, account-security, analytics or office supplier does not become a Customer sub-processor merely because it appears here. A conditional entry is not evidence that its tag is active. Before activation we verify the live configuration, contractual role, material onward recipients and transfer mechanism. You may request information about the applicable international-transfer safeguard, including a copy where the law permits, by emailing dpo@avantwerk.com. The Customer sub-processor register is published in Annex A of our Data Processing Agreement.

We may also disclose personal data to: courts, regulators and law-enforcement authorities where required by law; and to professional advisers under duties of confidentiality.

Note on the AI Provider. Starter and Practice describe the managed-route design, but that route is closed for real Matter Content until the required account, DPA, retention, training-use, region and transfer evidence is complete. Enterprise is intended for BYOK. Whenever BYOK applies, the Customer contracts with the provider directly, but the provider's role follows its actual purposes and contract; Bennovate remains processor for any transient relay and Hetzner remains in that relay chain. A configured provider credential is encrypted in the supported customer-controlled credential store and is not intentionally retained by a transient relay.

8. International transfers

Where we transfer personal data to countries outside the United Kingdom, we do so under one of the following mechanisms recognised under UK GDPR Chapter V:

1. Adequacy regulations: transfers to EEA countries and other adequate countries (UK GDPR Art. 45);
2. International Data Transfer Agreement (IDTA): the transfer agreement published by the Information Commission under s.119A of the Data Protection Act 2018;
3. UK Addendum to EU Standard Contractual Clauses: the UK International Data Transfer Addendum published by the Information Commission.

For each restricted transfer, including conditional Google, Meta and HighLevel processing and any managed AI onward transfer, the applicable destination, recipient role, contracting entity and transfer instrument must be evidenced by the then-current account, order and executed terms. Where reliance is placed on the UK Extension to the EU–US Data Privacy Framework, the recipient and covered data must fall within that adequacy instrument. Otherwise we execute the appropriate UK Addendum or IDTA and document the UK GDPR data protection test before the transfer.

9. Retention: summary table

10. Customer-Controlled Vault and selected external processing

The canonical Matter Content is held in the encrypted Customer-Controlled Vault. Solo places it on the solicitor's computer in a chosen local folder; Practice places it on a firm-controlled host reached over authenticated HTTPS on the firm's LAN or VPN; Enterprise places it on dedicated customer-controlled infrastructure. The browser is a replaceable interface and disposable cache, not the authoritative matter store.

Content can leave on three documented event categories: (1) automatic upload processing, including document summary/analysis and matter-fact extraction; (2) user-requested AI work, including an operator-confirmed in-app screenshot question whose pixels are sent as-is; and (3) optional AI-assisted dictation clean-up, which sends the transcript and selected matter vocabulary. Verbatim dictation sends nothing.

1. on Starter and Practice, unless the firm has configured its own supported provider credential, content from the three event categories above transits Bennovate's managed broker and an authorised AI sub-processor;
2. on Enterprise, or where another eligible firm has configured its own supported provider credential, the Customer appoints its provider directly; where Bennovate infrastructure is used, Bennovate processes the credential, request and response transiently as processor for relay;
3. the Customer remains controller of personal data in Matter Content and is responsible for its lawful basis, professional duties, instructions and endpoint security; and
4. Bennovate remains responsible for the processing it actually performs and for the safeguards and sub-processors described in the DPA.

This is a structural privacy-by-design measure under UK GDPR Art. 25.

11. Your data-subject rights

Under UK GDPR Chapter III you have the following rights:

How to exercise your rights: A request may be made verbally or in writing, including by email to dpo@avantwerk.com; no special form or reference to UK GDPR is required. We normally respond within one month and may ask for information reasonably needed to confirm identity. We may extend by up to two further months for a complex request or multiple requests and will explain this within the first month. Requests are normally free. A reasonable fee may be charged, or action refused, only where a request is manifestly unfounded or excessive; a reasonable fee may also be charged for further copies.

12. Right to complain to the Information Commission

If you believe we have processed your personal data unlawfully, you may lodge a complaint with the Information Commission under UK GDPR Art. 77:

Information Commission
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk

You also have the right to an effective judicial remedy under UK GDPR Art. 79.

We would welcome the opportunity to address any concern before you contact the Information Commission. You may contact us at dpo@avantwerk.com.

UK representative: Art. 27 UK GDPR. Bennovate is established in Poland and repeatedly offers this service to people and firms in the United Kingdom, so the relevant processing falls within Art. 3(2). The service involves recurring processing; it is not occasional processing within the narrow Art. 27(2)(a) exception. Bennovate must therefore designate a UK representative in writing under Art. 27 and publish the representative's verified identity and contact details. No representative has yet been appointed. The contact details above are Bennovate's direct contact details and do not identify an Art. 27 representative.

13. Security

We implement technical and organisational measures to protect personal data under UK GDPR Art. 32:

• TLS 1.2/1.3 encryption in transit; HSTS preloading;
• configured provider credentials encrypted in the supported customer-controlled credential store;
• Server-side access controls and audit logging on account data;
• fail2ban brute-force protection;
• Regular dependency auditing and vulnerability scanning.

14. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. Material changes will be notified to registered users by email at least 30 days before they take effect.

AI Addendum: BYOK architecture

A.1 The BYOK model

BYOK is used by Enterprise and by any other eligible firm that has configured its own supported provider credential. Starter and Practice otherwise use Bennovate's managed AI route. A configured credential is encrypted in the supported customer-controlled credential store. Where a configured route uses Bennovate infrastructure, the credential is used only for transient authentication and relay and is not intentionally retained.

A.2 Who processes matter content when AI is enabled? (BYOK)

When the Customer submits matter extracts to their chosen AI Provider under BYOK:

1. the Customer acts as controller of the personal data contained in the submission;
2. the AI Provider acts as the Customer's own processor under the Customer's own agreement with that AI Provider;
3. where Bennovate infrastructure relays the operation, Bennovate is the Customer's processor for the transient credential, request, selected content and response;
4. the Customer's UK GDPR obligations in respect of that processing are the Customer's sole responsibility.

A.3 Egress gate

The Service applies request-specific egress controls. Recognised identifiers in structured text are pseudonymised before transport where that route is registered as tokenised. The operator-confirmed screenshot-help route sends screenshot pixels as-is after the displayed warning, and AI-assisted dictation clean-up sends dictated text and selected matter vocabulary without tokenisation; verbatim mode sends nothing. This is risk reduction, not anonymisation. The Customer must review the complete route-and-class limits in the DPA taxonomy annex and must not treat these controls as a substitute for professional judgment.

A.4 Customer's data-protection checklist for BYOK

Before enabling BYOK, the Customer should: (a) review the AI Provider's data-processing terms; (b) ensure a written controller-processor agreement is in place with the AI Provider; (c) assess whether the use requires a DPIA under UK GDPR Art. 35; (d) consider whether client consent or notification is required under professional obligations; (e) assess cross-border transfer implications.

A.5 Sub-processor status of the AI Provider, per plan

Whenever BYOK applies, the chosen AI Provider is the Customer's own processor and not Bennovate's sub-processor for provider-side processing; Bennovate remains processor for any transient relay it performs. Starter and Practice otherwise use the managed route and authorised managed sub-processors listed in §7 and Annex A of the DPA.

A.6 AI outputs and the lawyer-model

Every AI-generated output produced by the Service is a draft that requires review by a solicitor admitted in England and Wales who holds a current practising certificate before use. The Customer must not treat an AI-generated output as authoritative legal analysis.