UK GDPR & Data Privacy Policy

Who we are: Diligio is operated by Diligio Ventures Private Limited (Corporate Identity Number: U62010RJ2026PTC117054), a private limited company incorporated in India, trading as Diligio ("Diligio", "we", "us"). For personal data about website visitors, account holders and enquirers, Diligio is the data controller. For content our customers upload to the platform, Diligio acts as data processor on the customer's behalf, under our Data Processing Agreement.

Governance: We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where it applies to our processing in India, the Digital Personal Data Protection Act 2023.

Contact: For any data-protection enquiry, subject access request (SAR), or deletion request, email our data protection contact at dpo@diligio.co.

Complaints:You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, although we would welcome the chance to resolve any concern first.

Account & enquiry data (we are controller): We collect names, work email addresses and basic account details to provide the service, respond to demo requests, and manage the customer relationship. The lawful bases are performance of a contract and our legitimate interest in operating and marketing the service to business users.

Customer content (we are processor):Documents, knowledge-base entries and questionnaire content that customers upload to Diligio Respond, and the compliance evidence, control statuses, attestations and framework records that customers maintain in Diligio Compliance, are processed only to provide the platform's features (ingestion, AI-assisted drafting, verification and certification support, collaboration and export), on the customer's instructions. The customer is the controller of this content; Diligio is the processor under our Data Processing Agreement.

No AI training: Customer content is never used to train AI foundational models, and we do not sell personal data.

Our public website uses cookieless, privacy-friendly analytics with no advertising cookies and no cross-site tracking. Because we set no non-essential cookies on the website, no cookie-consent banner is required.

The application itself uses only the strictly necessary cookies needed to keep you signed in and to secure your session. We do not sell analytics or personal data.

Tenant isolation:Each organisation's documents and knowledge-base content are isolated at the database layer using PostgreSQL Row-Level Security, so users can only access their own organisation's data.

Encryption at rest: All records and database volumes are encrypted at rest with AES-256 across our AWS and Supabase infrastructure.

Encryption in transit: All data in transit is encrypted using TLS 1.2 or higher over HTTPS.

Sub-processors: We use a small set of vetted sub-processors to run the service, some located outside the UK/EEA (for example, AI inference and email delivery). The current list, with each provider's purpose and location, is published on our Sub-processors page.

Transfer safeguards: Where personal data is transferred outside the UK/EEA, we rely on the European Commission's Standard Contractual Clauses and/or the UK International Data Transfer Addendum, as described in our Data Processing Agreement.

Diligio retains customer data for the duration of the active contract. Upon closure of the account by the client, all related organisational data, raw documents and vector embeddings are deleted within 30 days, unless the client has specifically requested that we retain the data or we are legally required to keep it. Backups follow their ordinary rotation cycle and are purged within the same 30-day period. Account and enquiry data we hold as controller is kept only for as long as needed for the relationship and to meet our legal obligations.

If a personal data breach affects customer content for which Diligio acts as processor, we will notify the affected customer (the data controller) without undue delay after becoming aware of it, so they can meet their own reporting obligations under UK GDPR Article 33. If a personal data breach affects data for which Diligio is the controller (such as website visitor or account data), we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, as required under Article 33.

Your rights: Under the UK GDPR you have the right to access, correct, restrict or object to the processing of, port, and request erasure of the personal data we hold about you.

How to exercise them: Email dpo@diligio.co and we will respond within the statutory time limit (normally one month). Where Diligio processes content on a customer's behalf, we will refer requests to that customer (the controller) and assist them in responding.