Data Privacy & GDPR Policy

Who we are: Diligio is operated by Navjeet Singh Gill, trading as Diligio ("Diligio", "we", "us"). For personal data about website visitors, account holders and enquirers, Diligio is the data controller. For content our customers upload to the platform, Diligio acts as data processor on the customer's behalf, under our Data Processing Agreement.

Governance: We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact: For any data-protection enquiry, Subject Access Request (SAR), or deletion request, email our data protection contact at dpo@diligio.co.

Complaints:You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, although we would welcome the chance to resolve any concern first.

Account & enquiry data (we are controller): We collect names, work email addresses and basic account details to provide the service, respond to demo requests, and manage the customer relationship. The lawful bases are performance of a contract and our legitimate interest in operating and marketing the service to business users.

Customer content (we are processor):Documents, knowledge-base entries and questionnaire content that customers upload are processed only to provide the platform's features (ingestion, AI-assisted drafting and verification, collaboration and export), on the customer's instructions. The customer is the controller of this content; Diligio is the processor under our Data Processing Agreement.

No AI training: Customer content is never used to train AI foundational models, and we do not sell personal data.

Our public website uses cookieless, privacy-friendly analytics (Cloudflare) that record aggregate page metrics only, with no advertising cookies and no cross-site tracking. Because we set no non-essential cookies on the website, no cookie-consent banner is required.

The application itself uses only the strictly necessary cookies needed to keep you signed in and to secure your session. We do not sell analytics or personal data.

Tenant isolation:Each organisation's documents and knowledge-base content are isolated at the database layer using PostgreSQL Row-Level Security, so users can only access their own organisation's data.

Encryption at rest: All records and database volumes are encrypted at rest with AES-256 across our AWS and Supabase infrastructure.

Encryption in transit: All data in transit is encrypted using TLS 1.2 or higher over HTTPS.

Sub-processors: We use a small set of vetted sub-processors to run the service, some located outside the UK/EEA (for example, AI inference and email delivery). The current list, with each provider's purpose and location, is published on our Sub-processors page.

Transfer safeguards: Where personal data is transferred outside the UK/EEA, we rely on the European Commission's Standard Contractual Clauses and/or the UK International Data Transfer Addendum, as described in our Data Processing Agreement.

Diligio retains customer data for the duration of the active contract. On termination, or on a verified deletion request, all related organisational data, raw documents, and vector embeddings are deleted from our active databases, and from backups on their ordinary rotation cycle, in any event within 30 days. Account and enquiry data we hold as controller is kept only for as long as needed for the relationship and to meet our legal obligations.

In the unlikely event of a structural data breach exposing personally identifiable information (PII) or proprietary corporate data, Diligio is committed to notifying the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the incident, in strict compliance with UK GDPR Article 33. Affected enterprise data controllers will be notified without undue delay to allow for appropriate internal mitigation.

Your rights: Under the UK GDPR you have the right to access, correct, restrict or object to the processing of, port, and request erasure of the personal data we hold about you.

How to exercise them: Email dpo@diligio.co and we will respond within the statutory time limit (normally one month). Where Diligio processes content on a customer's behalf, we will refer requests to that customer (the controller) and assist them in responding.