Privacy Statement

• Data controller. For personal data you give us directly, for example when you use this website, contact us, book a demo or have an Advise user account.
• Data processor. For data our clients load into their Advise environment, including any personal data in it. The client is the controller, and our processing is governed by our Data Processing Agreement with them and their own privacy notices, not by this statement.

What you give us. Your name, business contact details, company and job title when you fill in a form, book a demo, register for an Advise product or write to us. We ask only for what we need to respond or provide the service.

What we collect automatically. Technical and usage information such as IP address, browser type, access times, pages visited and referring page. In the Advise platform, we use it to run the service securely, including access logging and security monitoring. In aggregate, we use it to understand and improve our website and products.

Cookies. Only essential cookies run until you choose otherwise. Analytics cookies run only with your consent, and you can change your choice at any time.

Only service providers who process it on our behalf, principally Microsoft (Azure, including Azure OpenAI Service for private AI model instances), which hosts the Advise platform in European data centre regions. Each is bound by data protection obligations consistent with this statement. We also use a small number of tools to run this website and our sales process, such as forms, meeting booking and email. We may disclose personal data where the law requires it. Subprocessors

Personal data we control is processed and stored within the EU/EEA. We don't transfer it outside the EU/EEA. If that changes, we'll do so only under a valid transfer mechanism under Chapter V of the GDPR, with appropriate safeguards.

For as long as we need it for the purposes above. For platform users, that's the length of your organisation's subscription. After it ends, data is permanently erased from active systems within 30 days, and encrypted backups expire through the standard rotation cycle. Security and access logs are kept for the length of the subscription and erased under the same rules. We may keep some data longer where the law requires it.

You have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have data erased where there's no lawful basis to keep it
• restrict or object to processing in certain circumstances
• receive your data in a portable format
• withdraw consent at any time, where processing is based on consent

Contact us using the details below. We'll respond within one month of a valid request. For complex or numerous requests we may extend this by up to two further months, and we'll tell you if we do. We may ask for information to verify your identity.

If you're not satisfied with how we've handled your data, you can complain to the Data Protection Commission in Ireland (dataprotection.ie) or to the supervisory authority where you live or work.

We protect personal data with industry-standard technical and organisational measures, including AES-256 encryption at rest, TLS 1.2+ in transit, role-based access control and access logging. See the Trust Centre.

This website links to other websites. They have their own privacy policies, and we're not responsible for them. Please read their policies before giving them personal data.

We'll post any changes here with a new version date. We'll tell platform users about material changes in the application or by email.

This statement, this website and the Advise application are governed by Irish law and subject to the jurisdiction of the Irish courts.

• Privacy questions and requests: info@advisecpg.com
• Platform users: you can also use Support Request inside Advise
• Post: Recommender X DAC, Suite 139, Guinness Enterprise Centre, Taylors Lane, Dublin 8, D08 NFX6, Ireland