Privacy Statement
1. Data Controller
Percival is a governance, risk and compliance platform owned and operated by Sinan Augustus. All organisations using Percival run on infrastructure held by the owner, who acts as Data Controller for the platform and holds the underlying data. Contact details are provided in Section 14.
2. How We Collect Your Data
Percival is invite-only. The owner invites organisations onto the platform; that organisation's administrator then creates and invites its own users — there is no public self-registration at any level. Account data is entered by the administrator at setup, or by you when you first sign in and complete your profile. Governance data (risks, controls, incidents, policies and related records) is collected only through your direct use of the platform.
3. What We Collect
Percival processes account data (name, email address, role) for every user provisioned on this instance, together with the records users create in the course of their work; risk entries, controls, incidents, policies, assessments, audit trail entries and related governance data. No data is collected from visitors who do not hold an account.
4. How We Use Your Data
Data is processed to operate the platform: authenticating users, enforcing access control, recording governance decisions, and maintaining the audit trail required for compliance purposes. The legal basis is the legitimate interest of the controller in operating its governance, risk and compliance function, and/or performance of the employment or contractual relationship between the controller and each user.
5. How We Store Your Data
Access is role- and capability-gated, enforced server-side. Credentials are never stored in plain text. Multi-factor authentication is available on every account. Data is held on infrastructure managed by the controller and is retained for as long as the controller's compliance obligations require. Ephemeral personal data - session state, saved filters, favourites and notifications - is retained only for as long as it remains useful to the user and can be cleared via account settings.
6. Marketing
Percival does not send marketing communications and your data is never shared with third parties for marketing purposes. Any in-app or email notifications you receive relate solely to governance activity you are involved in (reviews, approvals, assigned actions) and are opt-in/opt-out via account settings where applicable.
7. Your Data Protection Rights
Depending on your jurisdiction, you may have the right to access, correct, or request erasure of your personal data, and to object to or restrict certain processing. Requests should be directed to your system administrator or the Data Controller identified in Section 1.
8. What Are Cookies
Cookies are small text files placed on your device to let a website remember information between requests, most commonly that you are signed in.
9. How We Use Cookies
Percival uses a single cookie to keep you signed in and to enforce your session timeout. It is not used for tracking, profiling, or advertising.
10. What Types of Cookies We Use
One strictly necessary session cookie (PERCIVAL_SID).
It is cleared when your browser is closed or your session expires,
whichever comes first. No analytics, advertising, or third-party
cookies are set.
11. How to Manage Your Cookies
Because the session cookie is strictly necessary to sign in and stay signed in, blocking it will prevent Percival from working. You can clear it at any time via your browser's site settings, which will sign you out.
12. Privacy Policies of Other Websites
Percival does not link out to third-party websites and this statement covers this instance only. If your organisation embeds or links to other services alongside Percival, their own privacy policies apply to those services.
13. Changes to This Privacy Policy
This statement may be updated from time to time. The "Last updated" date at the top reflects the most recent revision. We encourage you to review it periodically.
14. How to Contact Us
For questions about this statement or how your data is handled, contact your organisation's Percival administrator or the data controller identified in Section 1.
15. How to Contact the Appropriate Authority
Should you wish to report a complaint or if you feel your data protection rights have not been addressed by the controller, you can contact the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection: ico.org.uk. Users outside the UK should contact their local data protection authority.