GDPR & Data Protection

ABIS Consulting Limited, trading as CholaVerse, is committed to UK GDPR and Data Protection Act 2018 compliance. This page summarises our approach to data protection. For full detail, see our Privacy Policy.

1. Our role

When you use the CholaVerse Services, we act in two distinct roles depending on the data:

• Data controller for personal data we collect about you directly (e.g. account information, billing data, communications).
• Data processor for personal data you upload to the Services about your customers, employees, or contacts. You remain the data controller for that data.

2. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data ("right to be forgotten").
• Right to restriction — limit how we use your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time.
• Rights related to automated decision-making — request human review of decisions that significantly affect you.

To exercise any of these rights, email admin@cholaverse.com. We will respond within one month of receipt.

3. Data Processing Agreement (DPA)

If you are a CholaVerse customer and we process personal data on your behalf, our standard Data Processing Agreement applies. The DPA sets out the terms required by Article 28 UK GDPR, including:

• The subject matter and duration of processing
• The nature and purpose of processing
• The types of personal data and categories of data subjects
• The obligations and rights of the controller
• Sub-processor arrangements
• International data transfer safeguards

Request our current DPA from admin@cholaverse.com.

4. Sub-processors

We use third-party sub-processors to provide parts of the Services (e.g. cloud hosting, email delivery, payment processing, AI models). We require all sub-processors to provide adequate data protection guarantees. A current list of sub-processors is available on request.

5. International transfers

Where personal data is transferred outside the UK or EEA, we use approved transfer mechanisms — including the UK International Data Transfer Agreement (IDTA), Standard Contractual Clauses, and adequacy decisions made by the UK Government — to ensure your data remains protected.

6. Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (TLS) and at rest
• Role-based access controls and the principle of least privilege
• Regular security reviews and dependency monitoring
• Audit logs of access to sensitive data
• Staff training on data protection

7. Breach notification

If a personal data breach occurs, we will notify the UK Information Commissioner's Office (ICO) within 72 hours where required, and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

8. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account legal obligations (such as tax records, which we keep for up to 7 years), legitimate business needs, and your instructions.

9. Complaints

If you believe we have not complied with UK GDPR, you can lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Helpline: 0303 123 1113

10. Contact us

For any data protection questions or to exercise your rights:

Email: admin@cholaverse.com
Postal address: ABIS Consulting Limited, 20-22 Wenlock Road, London, N1 7GU, UK