Privacy Policy
This policy explains how Convolink Ltd handles personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Last updated: 25 September 2026
1. Who we are
Convolink Ltd ("Convolink", "we", "us") is a company registered in England and Wales (company number 15385901, registered office: 167-169 Great Portland Street, London, England, W1W 5PF). We are the data controller for personal data relating to visitors to this website and holders of Convolink accounts. For video content, transcripts and other material uploaded by our business customers, we act as a data processor on their behalf under our Data Processing Agreement.
Contact: privacy@convolink.co.uk. We are registered with the Information Commissioner's Office (ICO).
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password hash, organisation, job title | You |
| Billing data | Billing address, VAT number, last four digits of card (payment card data is handled by our PCI-DSS compliant payment provider) | You / payment provider |
| Content data | Video and audio recordings, screen captures, transcripts, comments, reactions | You / your organisation |
| Usage data | Pages visited, features used, device and browser type, IP address, approximate location | Automatically |
| Communications | Support tickets, emails, survey responses | You |
3. Why we use your data and our lawful bases
- Providing the service (creating your account, hosting and streaming videos, generating transcripts) — performance of a contract (Art. 6(1)(b)).
- Billing and accounting — contract and legal obligation (Art. 6(1)(c)), including HMRC record-keeping requirements.
- Security, fraud prevention and service improvement — legitimate interests (Art. 6(1)(f)). We balance these against your rights and freedoms.
- Analytics cookies and marketing emails — consent (Art. 6(1)(a)), which you may withdraw at any time. See our Cookie Policy.
- Responding to legal requests — legal obligation.
We do not use your content to train AI models without your explicit, opt-in consent. AI transcription is performed by processors bound by contract to use content solely to deliver the service.
4. Who we share data with
We share personal data only with processors who help us run Convolink — cloud hosting (UK regions), payment processing, email delivery, customer support tooling and AI transcription providers — each under a written contract meeting Article 28 UK GDPR. We may also disclose data where required by law, or to a buyer in the event of a merger or acquisition (you will be notified).
We never sell personal data.
5. International transfers
Your data is stored in the United Kingdom. Where a processor operates outside the UK, we rely on UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.
6. How long we keep data
- Account data: for the life of your account and 12 months after closure.
- Content data: until you or your organisation deletes it, or per your organisation's retention settings. Deleted content is removed from live systems within 30 days and backups within 90 days.
- Billing records: 6 years after the end of the financial year, as required by UK tax law.
- Usage logs: 13 months.
7. Your rights
Under the UK GDPR you have the right to:
- access a copy of your personal data;
- have inaccurate data rectified;
- have data erased ("right to be forgotten");
- restrict or object to processing, including direct marketing;
- data portability;
- withdraw consent at any time; and
- not be subject to solely automated decisions with legal or similarly significant effects.
To exercise any right, email privacy@convolink.co.uk. We respond within one month (extendable by two further months for complex requests). If you are a user of a customer's workspace, we may direct your request to that customer as controller.
You have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would appreciate the chance to resolve your concern first.
8. Security
We use encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access, logging and regular penetration testing. In the unlikely event of a personal data breach that risks your rights, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by Articles 33 and 34 UK GDPR.
9. Children
Convolink is a business tool and is not directed at children under 13. We do not knowingly collect data from children; contact us if you believe we have done so.
10. Changes to this policy
We will post any changes on this page and, for material changes, notify account holders by email at least 14 days before they take effect.