Privacy Statement

This Privacy Statement explains how we collect, use, and protect your personal data when you visit our website or interact with us, in accordance with UK GDPR and the Data Protection Act 2018.

Our delivery operations are based in Sri Lanka. Where your data is processed there, appropriate safeguards are in place as described in Section 6 of this statement.

1. Who We Are

Scientia Innovation Ltd (“Scientia Innovation”, “we”, “us” or “our”) is a technology and operations outsourcing company registered in England and Wales. We provide software engineering, AI and automation, cyber security, data engineering, technical support, and finance and accounting services to business clients.

Our registered and head office is in the United Kingdom. Our service delivery teams are based in Sri Lanka. We are the data controller responsible for personal data collected through this website. If you have questions about your personal data or wish to exercise your rights, please contact us using the details in Section 13.

2. Personal Data We Collect

2.1 Data You Provide Directly

• Contact details, including your name, email address, telephone number, job title, and company name;
• enquiry or message content submitted via our contact form or email;
• information provided when registering for events, webinars, or newsletters; and
• any other information you choose to share with us directly.

2.2 Data Collected Automatically

• Technical data including your IP address, browser type and version, operating system, and platform;
• usage data including pages visited, links clicked, referring URLs, and time spent on pages; and
• cookies and similar tracking technologies — see Section 10 for full details.

2.3 Data from Third Parties

• Publicly available professional information (e.g. from LinkedIn or company websites) where we contact you in a business-to-business context;
• analytics data from providers such as Google Analytics; and
• data from marketing or events platforms where you have consented to sharing your information.

3. How We Use Your Personal Data

The table below summarises the main ways we use your personal data and the legal basis under UK GDPR:

Where we rely on “legitimate interests” as our legal basis, we have assessed that our interests are not overridden by your rights and freedoms. You may request details of this assessment by contacting us.

4. Marketing Communications

We may send you information about our services, insights, events, and other business content of potential interest to you. As a B2B service provider, we may contact you at your business email address on the basis of legitimate interests, provided you have not opted out.

You may opt out at any time by clicking “unsubscribe” in any email or by contacting us directly. We will update our records promptly upon receipt of an opt-out request.

5. Sharing Your Personal Data

We do not sell your personal data. We may share it with third parties only in the following circumstances:

• Service delivery teams: our Sri Lanka-based professionals may access personal data as necessary to deliver the services you have engaged us to provide. Such access is governed by internal data handling policies and contractual obligations.
• Service providers: trusted third-party suppliers supporting our operations (including CRM platforms, email marketing tools, cloud infrastructure, and analytics services), who act as data processors under our instruction.
• Professional advisers: including solicitors, accountants, and insurers, where necessary.
• Regulatory or legal authorities: where required by law, regulation, or court order.
• Business transfers: in connection with any merger, acquisition, or sale of all or part of our business, with prior notice to you where required.

6. International Data Transfers

Scientia Innovation’s service delivery teams are based in Sri Lanka. Personal data may therefore be transferred to and processed in Sri Lanka in the course of providing our services. Sri Lanka is not currently the subject of a UK adequacy decision.

Where we transfer your personal data to Sri Lanka or any other country outside the UK, we ensure that appropriate safeguards are in place, including:

• the use of UK International Data Transfer Agreements (IDTAs) or equivalent standard contractual clauses with our Sri Lanka entity and relevant service providers;
• internal data handling policies and access controls that restrict what data our delivery teams can access and how it may be used; and
• regular review of international transfer arrangements to ensure ongoing compliance.

You may request further details of the safeguards applicable to any specific transfer by contacting us using the details in Section 13.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, and in accordance with our legal obligations. Our general retention periods are:

• Enquiry and contact data: up to 3 years from the date of last contact, unless an ongoing business relationship exists.
• Client and service delivery data: for the duration of the engagement and for up to 7 years thereafter, in line with legal and accounting obligations.
• Marketing data: until you opt out, after which we retain a suppression record to prevent future contact.
• Website analytics data: as determined by the settings of the relevant platform, typically up to 26 months.

When personal data is no longer required, it is securely deleted or anonymised in both our UK and Sri Lanka environments.

8. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to ask us to correct inaccurate or incomplete data.
• Right to erasure: to request deletion of your personal data in certain circumstances.
• Right to restrict processing: to ask us to pause processing in certain circumstances.
• Right to data portability: to receive your data in a structured, machine-readable format in certain circumstances.
• Right to object: to object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making: not to be subject to solely automated decisions that significantly affect you.

To exercise any right, please contact us using the details in Section 13. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

9. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures in both our UK and Sri Lanka environments, including:

• encrypted data transmission using SSL/TLS;
• role-based access controls and authentication requirements for all internal systems;
• segregated access controls ensuring Sri Lanka-based team members access only data relevant to their role;
• regular security reviews and data protection training for all staff; and
• data processing agreements with all third-party suppliers.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) without undue delay and, where required, inform affected individuals.

10. Cookies

Our website uses cookies and similar technologies to improve your experience, analyse site traffic, and support our marketing activities.

We use the following types of cookies:

• Strictly necessary cookies: essential for the website to function and cannot be disabled.
• Performance and analytics cookies: help us understand how visitors use our site (e.g. Google Analytics). These are placed only with your consent.
• Functionality cookies: enable enhanced features and personalisation.
• Marketing and targeting cookies: used to deliver relevant content and track campaign effectiveness. These are placed only with your consent.

You can manage cookie preferences at any time via the cookie consent banner on our website or through your browser settings. Disabling certain cookies may affect site functionality.

11. Third Party Websites

Our website may contain links to third party websites. This Privacy Statement applies only to our own website. We are not responsible for the privacy practices of any third party sites and encourage you to review their privacy policies before providing any personal data.

12. Changes to This Privacy Statement

We may update this Privacy Statement from time to time to reflect changes in our practices, technology, or legal requirements. The “Last Updated” date at the top of this document shows when it was most recently revised. Where changes are material, we will take reasonable steps to notify you.

13. Contact Us and How to Complain