Privacy Policy

This policy explains how COVAILENT LTD, trading through its 2 Report service, handles personal information when you visit this public website, contact us, or choose to communicate with 2 Report. It does not create an account or service agreement.

1. Who we are and how to contact us

The controller responsible for this processing is COVAILENT LTD, a private limited company registered in England and Wales (company number 14828679). Our registered office is 71–75 Shelton Street, London, England, WC2H 9JQ.

For privacy questions, requests or data-protection complaints, email info@covailent.com or write to our registered office, marked “Privacy — 2 Report”.

2. Personal information we handle

• Website access: technical information handled to deliver and secure pages, which may include IP address, browser and device details, pages requested, date and time, and error or security events. Our hosting infrastructure may process or retain technical access records.
• Enquiries and communications: if you choose to contact us, your name, contact details, organisation, message content and related correspondence.
• Opt-in messages: where you choose to receive 2 Report updates via WhatsApp or another channel, your contact details, channel preference, consent/opt-in evidence, communications and delivery or response information. This processing applies only when that channel is used.

The public landing site currently has no sign-up form, login, payment function, visitor profiling or embedded behavioural analytics. If other 2 Report functions collect additional data, we will provide applicable privacy information before that processing takes place.

3. Why we use information and our lawful bases

• Operate, troubleshoot and protect the website: our legitimate interests in providing a reliable, secure public website.
• Respond to enquiries and manage relevant relationships: our legitimate interests in handling communications and providing information about the service, or taking steps requested before entering a contract where applicable.
• Send requested service communications: performance of an applicable contract, or our legitimate interests in corresponding about a request or service, as the circumstances require.
• Send promotional messages: where required by electronic-marketing rules, only after obtaining suitable consent or another legally available permission. You can withdraw consent or object to direct marketing at any time.
• Keep records of preferences, requests and legal compliance: our legitimate interests in respecting your choices, addressing disputes and demonstrating compliance, or compliance with a legal obligation.

We do not use this public website to make solely automated decisions that produce legal or similarly significant effects about visitors.

4. Service providers, sharing and overseas processing

We use service providers as needed to host and secure the website and support communications. These may include Amazon Web Services (AWS) for hosting and operational infrastructure, and Meta/WhatsApp and applicable messaging intermediaries when you communicate through WhatsApp. Each provider processes information in accordance with its role and applicable agreements. We may also share necessary information with professional advisers, authorities or others where legally required.

Some services may process personal information outside the UK. Where UK law requires safeguards for such transfers, we use applicable UK adequacy arrangements or approved transfer mechanisms, as appropriate. You can contact us for information about relevant arrangements. We do not sell visitor or subscriber personal information.

5. How long we keep it

Where website request or security logs are retained, our intended maximum retention for routine records is 90 days, unless an incident requires longer preservation. We normally retain ordinary enquiries and related correspondence for up to 24 months after the last relevant contact, unless the matter, an agreement or legal requirements justify a different period. Consent evidence and opt-out/suppression records are kept for as long as reasonably necessary to respect choices and demonstrate compliance. We securely delete or anonymise information when no longer needed.

6. Cookies and similar technologies

This public website is designed as a static information page. The published HTML does not set cookies, use browser storage, load advertising pixels or run analytics scripts. Depending on the deployed infrastructure, technical tools strictly necessary for delivering or protecting the website may be used. Such tools do not need an optional-cookie consent banner, but any applicable information is provided here.

If we introduce optional tracking or other non-essential storage/access technologies, we will update this policy and provide any consent or objection mechanism required by UK law before enabling them.

7. Your data-protection rights and complaints

Subject to applicable law and exceptions, you can ask us for access to your personal information, to correct or erase it, to restrict its use, or to provide a portable copy where applicable. You can object to processing based on legitimate interests and always object to direct marketing. Where we rely on consent, you can withdraw it without affecting earlier lawful processing.

To exercise a right or raise a data-protection complaint, contact info@covailent.com or write to the address above. We acknowledge data-protection complaints within 30 days, investigate them and communicate the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner’s Office (ICO). We would welcome the opportunity to resolve concerns directly first.

8. Changes to this policy

We may revise this policy to reflect changes in the website, communications, suppliers or applicable law. The date above shows the current version. Where a material change affects how we process personal information, we will give appropriate further notice before applying it where required.