Privacy Notice

REVIENT PRIVACY NOTICE

Version: 1.1
Effective date: (EFFECTIVE DATE)
Last updated: (LAST UPDATED DATE)

This Privacy Notice explains how (COMPANY LEGAL NAME) LIMITED, trading as Revient (Revient, we, us, our), collects, receives, uses, stores, discloses and otherwise processes personal information.

Company number: (COMPANY REGISTRATION NUMBER)
Registered in: (JURISDICTION OF INCORPORATION)
Registered office: (REGISTERED OFFICE ADDRESS)
Privacy email: (PRIVACY EMAIL)
Support email: (SUPPORT EMAIL)
ICO registration number: (ICO REGISTRATION NUMBER, IF APPLICABLE)
Website: (WEBSITE URL)

1. Who this Notice applies to

This Notice applies to personal information relating to:

• Merchant account holders and Merchant team members;
• prospective Merchants;
• collection-agency and institutional-buyer representatives;
• Partner applicants and Partner users;
• visitors to Revient websites and applications;
• people who contact Revient for support, sales, privacy or other purposes;
• individuals whose information appears in a Merchant Case, including Merchant customers, delivery recipients and other people connected with a transaction;
• individuals whose information appears in Merchant-authorised order, transaction, fulfilment, delivery, refund, return, correspondence or Evidence records; and
• other identifiable people whose personal information is lawfully processed in connection with Revient.

A person does not need to create a Revient Account for this Notice to apply to information about them.

2. What Revient does

Revient provides B2B technology for post-chargeback evidence intelligence, Case management, workflow, recovery routing and receivable-sale facilitation.

Revient may help a Merchant identify or import post-chargeback Cases, organise and assess Evidence, identify contradictions or missing information, obtain AI-assisted recovery indicators, and route an authorised Case to an independent collection agency or institutional buyer.

Revient does not itself contact Merchant customers to demand payment under the Recovery service. A collection agency independently decides whether to accept a Case and is responsible for its own collection communications and conduct.

3. Our roles under data-protection law

Revient's role depends on the particular processing activity.

Revient as a Processor

Revient may act as a Processor where it processes personal information solely on behalf of a Merchant and in accordance with that Merchant's documented instructions to provide the Services. Depending on the feature used, this may include hosting Merchant-controlled Case Data, importing authorised commerce records, storing Evidence, performing Merchant-requested evidence processing, carrying out case-targeted mailbox searches, and transmitting an authorised Case according to the Merchant's configured workflow.

Where Revient acts as Processor, the Merchant is generally the Controller of that processing and is responsible for its own Controller obligations, including identifying an appropriate lawful basis and providing required privacy information. Revient's Processor obligations are set out in the Revient Data Protection & GDPR document.

Revient as a Controller

Revient acts as a Controller where we determine our own purposes and essential means for processing. This includes processing for Account administration, subscription and billing administration, platform security, fraud and misuse prevention, Terms enforcement, Partner onboarding and verification, compliance, complaints, legal claims, corporate accounting and Revient's own operational records.

Revient may also act as Controller for limited Case-related processing where we independently determine that processing is necessary for security, fraud prevention, platform integrity, legal compliance or protection of Revient's rights.

Recovery Partners and Buyers

An independent collection agency will ordinarily determine its own purposes and means when deciding whether to accept a Case and conducting collection activity. An institutional buyer will ordinarily determine its own purposes and means when conducting purchase due diligence and, following a completed purchase, managing the acquired receivable. Those organisations may therefore act as independent Controllers for their own activities.

4. Data-protection principles

Where applicable data-protection law applies, Revient seeks to process personal information lawfully, fairly and transparently; for specified purposes; in a manner limited to what is reasonably necessary; accurately; for no longer than necessary; and with security appropriate to the risk.

5. Categories of personal information we may process

The information Revient processes depends on your relationship with us and the Services used.

We do not necessarily collect every category about every person.

6. Information relating to Merchant customers and Case subjects

A significant part of the Revient service involves information that may be obtained indirectly rather than directly from the individual concerned.

For example, a Merchant may submit a Case or authorise Revient to access records relating to a transaction with one of the Merchant's customers. Depending on the Case, Revient may therefore process the person's name, contact information, addresses, order information, transaction references, payment or dispute information, Chargeback reason, fulfilment records, delivery/tracking information, refunds, returns, correspondence and supporting Evidence.

Where Revient acts as Processor for the Merchant, the Merchant remains responsible for the privacy information and lawful basis required of it as Controller. Where Revient acts as Controller for a particular activity, Revient is responsible for the Controller obligations applicable to that activity.

7. Where personal information comes from

Personal information may come from:

• you directly;
• your employer or organisation;
• a Merchant using Revient;
• a Merchant-authorised commerce integration;
• a Merchant-authorised payment or dispute source;
• a Merchant-authorised mailbox;
• manual Case entry;
• CSV or other Merchant imports;
• files or Evidence uploaded by a Merchant;
• fulfilment, shipping, courier or delivery records made available through an authorised source;
• Collection Agencies or Buyers participating in a Case;
• Stripe and other payment/billing service providers;
• authentication, security and technical service providers;
• platform and system logs; and
• public corporate, regulatory or professional registers used for Partner or business verification.

8. Connected commerce platforms

A Merchant may choose to connect a supported commerce platform. Revient processes information made available under the permissions granted by the Merchant and required for the enabled functionality.

Revient seeks to avoid importing unrelated customer information merely because a connected platform technically makes that information available.

Unless a feature expressly states otherwise, Revient does not use commerce connections to modify Merchant orders, issue refunds, alter products or contact Merchant customers through the connected store.

For the Evidence Engine, a commerce connection is used to obtain, where the platform exposes them: a confirmed lost dispute; order identity and totals; payment authorisation and capture, including an address-verification or card-verification result letter, wallet or gateway error when the platform returns one; refunds; returns; and fulfilment with tracking numbers. Card number, BIN, expiry and cardholder name are not requested. A fact the platform does not expose stays unknown. Pending and won disputes are not taken in as new cases. Proof of delivery is requested from the carrier after a tracking number is known. Customer correspondence is searched only in a mailbox the Merchant connects, using case-specific identifiers or customer email. Messages are retained by manual selection or the separate workspace automatic-evidence authorization described below.

9. Shopify

If a Merchant connects Shopify, Revient may process Shopify-derived Merchant Data relevant to the Revient service. Depending on the connection, permissions and store configuration, this may include:

• store and connection identifiers;
• relevant order IDs, numbers, dates, statuses and values;
• currency and transaction references;
• relevant customer identity/contact information;
• billing and shipping information required for the Case;
• fulfilment and tracking information, including the scopes used for fulfilment updates;
• refunds, kept separate from returns;
• return status and quantities where return access is granted;
• payment authorisation and capture, including AVS and CVV result letters, wallet and gateway error where Shopify returns them;
• the IP address the order was placed from, where Shopify recorded it; and
• confirmed lost Shopify Payments disputes. Pending and won disputes are not taken in as new cases.

Revient does not request the card number, BIN, expiry or cardholder name from Shopify. Orders older than the platform's default window, and Shopify-held dispute files, are read only when Shopify has granted those separate permissions.

IP location. Where the order records the IP address it was placed from, Revient looks that address up in an IP geolocation database to find an approximate place (city, region and country, coordinates rounded to about 1 km, the accuracy radius and, where the database reports it, whether the address belongs to a VPN, proxy or hosting network) and compares it with the order's billing and delivery addresses as identity evidence for the Case. IP location is approximate and is never treated as proof on its own. The IP address and the derived place are kept with the Case evidence and shown to the Merchant whose store recorded them; Recovery Partners see the IP address masked. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Revient does not use Shopify to bill the Merchant for the Revient subscription. Revient billing is handled separately through Revient and Stripe.

Revient may change or restrict Shopify processing where required to comply with Shopify's applicable platform or data requirements.

10. WooCommerce / WordPress

If a Merchant connects WooCommerce, Revient may process information made available through Merchant-authorised WooCommerce API credentials or a supported export, including relevant order identifiers, dates, status, amount, currency, customer/contact details, billing and shipping information, payment/transaction metadata, refund information and fulfilment or shipping metadata.

The data available can vary according to WooCommerce version and installed extensions.

Revient does not require the Merchant's ordinary WordPress administrator password where a dedicated integration credential can be used.

11. BigCommerce

Where a Merchant connects BigCommerce, Revient may process Merchant-authorised order records, relevant customer information, billing and shipping details, order totals, currency, shipping or consignment information, transaction metadata, refunds and other Case-relevant records available within the granted permissions.

12. Magento and Adobe Commerce

Where a Merchant connects Magento Open Source or Adobe Commerce, Revient may process relevant commerce records such as order IDs, customer/contact information, billing and shipping details, order values, currency, payment metadata, order status, shipments, invoices, credit memos and refund information.

The authentication mechanism and available information may differ by platform edition and deployment model.

13. Squarespace

Where a Merchant connects Squarespace, Revient may process relevant Commerce information including order identifiers, customer information, billing/shipping details, order totals, payment status, refund information, fulfilment, shipment and tracking information. Where authorised webhooks are used, Revient may also receive relevant order-created or order-updated events.

14. Wix

Where Wix is supported through manual import, Revient processes the fields the Merchant chooses to include in the Wix order export and maps into Revient. The Merchant controls which available export fields it uploads.

If Revient introduces a Wix API connection in the future, the information and permissions used by that feature will be described before production use.

15. Custom API

Where a Merchant uses a Custom API connection, Revient processes the data the Merchant sends or authorises Revient to retrieve under the configured connection. Depending on the implementation, this may include order, transaction, customer, dispute, fulfilment, delivery, refund, return and Evidence information.

Revient may log limited technical information about API requests for authentication, security, reliability and troubleshooting.

16. Manual Cases, CSV imports and uploaded Evidence

A Merchant may manually create Cases or upload CSV files, PDFs, images and other supported Evidence. Revient processes the information the Merchant chooses to submit, subject to applicable file and data restrictions.

Merchants are instructed not to upload passwords, authentication secrets, CVV/CVC values, unnecessary full payment-card details, malware or unrelated sensitive information.

17. Gmail evidence connection

If a Merchant chooses to connect Gmail, Revient may use Google's OAuth authorisation process to obtain the mailbox access presented during connection.

The intended purpose of the Gmail connection is to locate business correspondence relevant to existing Revient Cases. Revient may perform targeted searches using identifiers such as order numbers, transaction IDs, customer email addresses, tracking numbers or other Case references.

Depending on the permissions granted and the Merchant's use of the feature, Revient may process:

• the connected Google account identifier and email address;
• OAuth connection information;
• Gmail message and thread identifiers;
• sender and recipient information;
• message dates;
• subject lines;
• message bodies or excerpts relevant to a Case; and
• selected attachment information or attachments where the Merchant uses attachment evidence functionality.

Revient's evidence feature does not require permission to send Gmail messages to Merchant customers.

Revient seeks to avoid retaining irrelevant messages merely because they appeared in an initial search result. Unretained candidate content is processed transiently; automatic discovery persists coverage and candidate counts rather than an archive of unrelated correspondence.

A Workspace member with case-management permission may separately enable automatic discovery, retention and AI assessment for a connected mailbox. Revient records the authorizing identity, mailbox, disclosure version, activation and revocation. The current automatic matching rule requires an exact Case/order identifier and matching customer participation, with no conflicting order reference. Email-only matches, mixed-order correspondence and ambiguous matches require review. Automatic retention does not retain attachments automatically, grant staff access to raw correspondence, authorize contact, or permit general model training. Disabling this setting, disconnecting the mailbox or losing the authorizing permission stops future automatic retention and AI use under that authorization; it does not erase prior retained evidence or completed assessments. Gmail incremental checks use history cursors, with a fresh case-specific historical search if the cursor expires.

For newly retained selected messages, the implemented workflow stores a minimized text-only representation containing message identifiers, date, sender and recipients, subject and plain text. It does not retain the original provider JSON, arbitrary headers, HTML data URLs or unselected inline attachment bytes. Only selected attachment metadata is retained with the message; selected attachment files are stored separately through private storage and malware scanning. This describes the current retention path and does not claim that historical records have been automatically rewritten or deleted.

Revient's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements.

Connecting Gmail is optional and can be disconnected by the Merchant.

18. Microsoft 365 / Outlook evidence connection

If a Merchant chooses to connect Microsoft 365 or Outlook, Revient may use Microsoft authorisation and Microsoft Graph to search the signed-in user's authorised mailbox for Case-relevant correspondence.

Depending on the permissions granted and feature used, Revient may process:

• the connected Microsoft account and tenant identifiers;
• OAuth connection information;
• message identifiers;
• sender and recipient information;
• message dates;
• subject lines;
• message bodies or previews relevant to a Case; and
• attachment information or selected attachments where supported.

The intended evidence feature uses delegated read access and does not require permission to send messages to Merchant customers.

Revient seeks to perform case-targeted searches rather than copying the Merchant's entire mailbox into Revient.

The selected-message minimization and separate attachment-storage approach described in section 17 also applies to Microsoft mailbox evidence.

Connecting a Microsoft mailbox is optional and can be disconnected by the Merchant.

19. Stripe and payment/billing information

Revient uses or intends to use Stripe to process Revient subscription billing and certain Revient charges.

Stripe may process payment-method information, billing details, transaction amounts, payment status, device/network information, fraud-prevention information and other information required to provide its services.

Revient generally receives Stripe customer, subscription, invoice and payment identifiers and limited payment-method metadata rather than needing to store complete raw payment-card credentials.

Stripe may act as a Processor for some activities and as an independent Controller for other activities, including aspects of fraud prevention, compliance and operation of its payment infrastructure.

20. Information Revient does not seek

Unless specifically requested through a lawful and secure workflow, Revient does not seek and you should not provide:

• passwords for another service;
• authentication secrets;
• CVV/CVC values;
• unnecessary complete payment-card details;
• unrelated government identifiers;
• information unrelated to a legitimate Revient purpose; or
• unnecessary sensitive personal information.

Revient may redact, remove, restrict or quarantine information that should not have been supplied.

21. Special-category and highly sensitive information

Revient is not designed to routinely require information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic information, biometric information used for unique identification, health information, sex life or sexual orientation.

Such information could occasionally appear incidentally in Merchant correspondence or uploaded documents. Revient seeks to minimise or remove information that is not required for the Case.

Where processing of special-category personal data is necessary, the relevant Controller is responsible for ensuring that an appropriate lawful basis and any additional legal condition are satisfied.

22. Criminal-offence information and fraud allegations

Revient does not treat a Chargeback, Evidence contradiction or Evidence Engine recommendation as proof that an individual committed fraud or another criminal offence.

The Evidence Engine is designed to assess records and recovery signals, not to make criminal determinations.

Where actual criminal-offence information is processed, Revient and the relevant Controller will apply additional legal requirements where applicable.

23. Why we process personal information

Where Revient acts as Controller, the principal purposes and typical UK/EEA lawful bases are set out below. The lawful basis may differ where another law applies.

Where Revient acts solely as Processor, Revient processes the relevant personal information on the Merchant's documented instructions and the Merchant is responsible for determining the lawful basis for the underlying Controller processing.

24. Legitimate interests

Where Revient relies on legitimate interests, relevant interests may include operating a secure B2B platform, supporting Merchants in assessing legitimate commercial receivables, maintaining reliable Case records, preventing duplicate or inaccurate recovery activity, preventing fraud and misuse, protecting Revient and its users, handling business communications, improving service reliability, and establishing or defending legal claims.

Revient considers whether the processing is necessary for the stated interest and whether the individual's rights and interests override that purpose.

25. Evidence Engine processing

Revient may process Case information using deterministic rules and AI-assisted analysis. Inputs may include order records, dispute reason, transaction information, fulfilment, delivery, refund and return information, tracking, correspondence and Merchant-supplied Evidence.

Outputs may include evidence completeness, evidence strength, identified contradictions, missing information, risk indicators, recovery potential and a recommended next step.

Revient seeks to retain provenance showing where material Evidence came from and to distinguish facts from machine-generated assessments.

Connection, synchronization, imports and relevant evidence changes collect and validate source facts. Only a confirmed LOST dispute is eligible for recovery evidence scoring or a Revient AI assessment; the AI path also requires an approved configuration and permitted data access. Open, won, unknown and unsupported outcomes retain source records without being treated as lost disputes. Incomplete disputes remain visible as Needs evidence; an ordinary order does not become a dispute merely because it was imported.

The assessment record includes source and evidence references, hashes, normalization and ruleset versions, selected and omitted evidence, model and prompt/schema configuration, message-consent references where relevant, token usage, estimated processing cost and completion state. New AI input/output traces are encrypted in Revient's application storage and scoped to the authorised Workspace. Historical assessments remain available when current evidence is corrected or superseded.

For confirmed lost disputes, the configured AfterShip service may receive a carrier and tracking number and the minimum shipment details required to locate or register tracking. Registration is allowed only after the operator verifies customer notifications are disabled; customer contact fields are omitted. Carrier checkpoints, event dates, timestamp precision and retrieval dates are retained as evidence. Separate parcels, replacements and returns have separate records. Where available, proof photographs, signatures or delivery documents are stored privately, scanned and served only through authorised Case access. A provider reference without a retained asset is labelled unavailable. Store-supplied destination information is not presented as independent carrier verification.

A Merchant-requested evidence refresh can read current connected-store records, refresh previously selected mailbox messages and request carrier evidence before reassessment. It does not select additional mailbox messages or grant new staff/AI permissions. Recheck stored evidence uses retained facts. Existing sources and prior findings remain available while queued work runs, and source availability or failure is recorded rather than replaced by an assumed fact. Retained Test records remain marked and retain their external-action restrictions even when displayed beside ordinary Cases.

Revient AI support receives the authorised Case summary, the question submitted by the user and versioned Revient help. It has no tools for customer contact, Case release, sale, payment or deployment. Mailbox content requires item-specific AI permission, granted manually or through the separately authorized automatic-evidence setting for a strong match; authorization is rechecked before each provider attempt. Revocation prevents further permitted uses but cannot undo a transmission already completed.

26. Automated decisions and human review

Revient's intended workflow uses the Evidence Engine as decision support. A Merchant controls whether to release a Case unless it has expressly configured a standing instruction, and an independent Collection Agency or Buyer makes its own acceptance decision.

Revient does not intend the Evidence Engine alone to make a final decision that automatically causes collection communications to be sent to an individual without an independent Partner acceptance step.

Where Revient introduces processing that constitutes a solely automated decision producing legal or similarly significant effects under applicable law, Revient will implement the safeguards required by that law, which may include information about the decision, an opportunity to make representations, human intervention and a way to challenge the decision.

27. Who we share personal information with

Depending on the Service and context, Revient may disclose personal information to:

• authorised users within the relevant Merchant or Partner Workspace;
• the specific Approved Collection Agency selected or authorised for a Case;
• an Approved Buyer where a Merchant chooses or authorises Sell Now;
• Stripe and other payment/billing providers;
• hosting, database, storage, authentication, email, monitoring, security, support and AI service providers;
• professional advisers such as lawyers, accountants, auditors and insurers;
• courts, regulators, tax authorities, law-enforcement bodies and other competent authorities where disclosure is lawfully required or permitted; and
• prospective or actual participants in a merger, financing, acquisition, reorganisation or sale of Revient's business or assets, subject to appropriate confidentiality and legal protections.

The current Processor/Subprocessor framework is described in the Revient Data Protection & GDPR document.

28. Recovery Partners

Revient does not make all Merchant customer information available to all Collection Agencies.

Where a Merchant instructs Revient to release a Case for Recovery, Revient may disclose the Case Data and Evidence reasonably required by the selected Approved Collection Agency to assess the Case and, if accepted, conduct Recovery.

This may include identity/contact information, transaction and order information, addresses relevant to the Case, dispute details, fulfilment/delivery information, correspondence and supporting Evidence.

The Collection Agency is responsible for its own privacy obligations where it acts as an independent Controller for its collection activity.

29. Sell Now and Approved Buyers

Revient does not make full Case Data generally available to every Buyer.

Where a Merchant chooses or authorises Sell Now, Revient may disclose information reasonably required by an Approved Buyer to assess a potential receivable purchase. Where feasible, Revient may initially provide minimised or pseudonymised opportunity data and disclose additional information when required for due diligence or completion.

Following a completed assignment, the Buyer is responsible for its own processing as owner of the receivable.

30. Service providers and processors

Revient may use service providers to host and operate the platform, store data, authenticate users, deliver service email, process billing, monitor reliability and security, provide customer support, and process information through AI or other software services.

Where a provider acts as Revient's Processor or Subprocessor, Revient requires appropriate contractual data-protection obligations. Where a provider acts as an independent Controller, its processing is governed by its own legal responsibilities and privacy information.

31. Legal and regulatory disclosures

Revient may disclose personal information where reasonably necessary to comply with law, a binding legal process or a competent authority; protect the security and integrity of Revient; investigate fraud or abuse; enforce the Terms; or establish, exercise or defend legal claims.

Revient does not disclose information merely because a person asks for it where there is no appropriate authority or lawful basis.

32. Corporate transactions

If Revient is involved in a merger, financing, restructuring, acquisition, sale of assets or similar transaction, personal information may be disclosed to relevant advisers and prospective or actual transaction participants under appropriate confidentiality and legal protections.

Any successor processing personal information remains subject to applicable data-protection law.

33. No unrelated personal-data marketplace or behavioural-advertising sale

Revient's business model is not to collect unrelated personal information and sell lists of individuals to advertisers, data brokers or other third parties.

Revient does not intend to sell or share personal information for cross-context behavioural advertising.

A Merchant-directed disclosure of Case Data to a Collection Agency or a transfer of Case Data as part of a receivable-sale transaction is made to provide the relevant Recovery or Sell Now service. Where a regional privacy statute applies a specialised definition of sale or sharing, Revient will assess the particular processing under that law and provide any legally required rights or disclosures.

34. Marketing communications

Revient may send service users and prospective business customers information about Revient where permitted by applicable law.

Where consent is required, Revient will request it separately. Optional marketing consent is not a condition of creating a Revient Account.

Marketing emails will provide a method to unsubscribe. An opt-out does not stop transactional communications such as security alerts, billing messages, Terms updates, Case notifications or other service communications necessary to operate the Account.

35. Cookies and similar technologies

Revient uses cookies and other storage/access technologies for authentication, security, user preferences, service operation and, where enabled, analytics or other optional purposes.

The Revient Cookie Policy explains these technologies and available controls.

36. International processing and transfers

Revient may use service providers or Partners in countries different from the country in which personal information was collected.

Where a restricted international transfer is subject to UK data-protection law, Revient will use an applicable lawful transfer mechanism where required, such as an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, another approved safeguard or another lawful transfer mechanism.

Where EU GDPR applies, Revient will use an applicable EU transfer mechanism where required, including adequacy or applicable Standard Contractual Clauses.

The Revient Data Protection & GDPR document contains additional transfer information and the current provider register.

37. How long we retain personal information

Revient does not retain identifiable personal information indefinitely merely because it might later be useful.

Retention depends on the purpose, the type of information, whether an Account or Case remains active, contract and legal limitation periods, tax/accounting requirements, complaints, litigation or legal holds, security needs, applicable platform requirements and whether information can instead be deleted or anonymised.

The production retention schedule will use the following categories:

Where a connected platform requires earlier deletion and no independent lawful retention ground applies, Revient will apply the relevant platform deletion requirement.

Access restriction and completed physical deletion are separate operations. If cleanup of an unsuccessful evidence acquisition cannot complete because private storage is unavailable, unattached content is kept quarantined and inaccessible pending cleanup retry. A failed cleanup is not recorded as successful deletion. This control does not establish a universal automated purge schedule or imply immediate removal from backups; the applicable retention schedule and legal exceptions remain separate.

38. Disconnecting an integration

Disconnecting a platform or mailbox stops future access using the active connection and Revient may revoke or delete active credentials where supported.

Disconnection does not necessarily require immediate deletion of historical information already incorporated into an active or lawfully retained Case. Information may remain where needed for an ongoing Case, contract records, legal obligations, security, legal claims or another lawful retention purpose.

39. Security

Revient uses technical and organisational measures designed to protect personal information against unauthorised access, unlawful processing, accidental loss, destruction or damage, taking account of the nature and risks of the processing.

The current security measures are described more fully in the Revient Data Protection & GDPR document and may include, where implemented and appropriate, access controls, role-based permissions, tenant separation, encryption in transit, encryption at rest, secure credential handling, authentication controls, audit logging, monitoring, backups, vulnerability management, incident-response procedures and least-privilege access.

Revient does not claim a security certification that it has not obtained.

40. Personal-data breaches

Revient maintains procedures for identifying, investigating, containing and responding to personal-data security incidents.

Where Revient acts as Processor, it will notify the relevant Controller without undue delay after becoming aware of a qualifying Personal Data Breach, in accordance with the Data Processing Addendum.

Where Revient acts as Controller, Revient will make regulator or individual notifications where required by applicable law.

41. Your UK and EEA privacy rights

Depending on the circumstances and applicable law, you may have rights to:

• be informed about processing;
• request access to personal information;
• request correction of inaccurate or incomplete information;
• request deletion in applicable circumstances;
• request restriction of processing in applicable circumstances;
• object to certain processing, including direct marketing;
• receive or transfer certain information in a portable form where applicable;
• withdraw consent where processing is based on consent, without affecting processing already lawfully carried out before withdrawal; and
• receive safeguards relating to qualifying automated decisions.

These rights are not absolute and may be subject to legal conditions and exceptions.

42. How to make a privacy request

You can make a privacy request by contacting:

Email: (PRIVACY EMAIL)
Privacy rights portal: (PRIVACY RIGHTS PORTAL URL, IF USED)

Please provide enough information for Revient to understand and locate the request. This may include your name, email address, the Merchant or store involved, and an order or Case reference where known.

Revient may need to verify identity before disclosing or changing personal information. Revient will request only information reasonably necessary for that verification.

43. Requests relating to Merchant-controlled data

If your request concerns information that Revient processes solely on behalf of a Merchant, the Merchant may be responsible for responding as Controller.

If you contact Revient directly, Revient may identify or notify the relevant Merchant, forward the request, assist the Merchant or explain how to contact the relevant Controller, subject to applicable law and security considerations.

44. Privacy complaints

If you believe Revient has handled your personal information improperly, you may submit a data-protection complaint to:

Email: (PRIVACY EMAIL)
Privacy complaint form: (PRIVACY COMPLAINT FORM URL, IF USED)

Revient will acknowledge qualifying UK data-protection complaints within the period required by applicable law and will take appropriate steps to investigate, keep the complainant informed where required, and communicate the outcome without undue delay.

For UK processing, you may also complain to the Information Commissioner's Office:

ICO complaint information: https://ico.org.uk/make-a-complaint/

You do not have to waive any regulator complaint right in order to contact Revient.

45. California privacy rights

If the California Consumer Privacy Act, as amended, applies to Revient's processing of your personal information, California residents may have rights that include:

• the right to know the categories and specific pieces of personal information collected, used and disclosed as provided by law;
• the right to request deletion, subject to applicable exceptions;
• the right to request correction of inaccurate personal information;
• the right to receive information about categories of sources, purposes and recipients;
• the right to opt out of a qualifying sale or sharing of personal information;
• the right to limit certain uses of sensitive personal information where the statutory right applies; and
• the right not to receive unlawful discriminatory treatment for exercising statutory privacy rights.

Requests can be submitted using (PRIVACY EMAIL) and (PRIVACY RIGHTS PORTAL URL, IF USED).

If Revient is required to recognise a Global Privacy Control signal for qualifying sale or sharing, Revient will process that signal in accordance with applicable law.

Revient does not intend to sell or share personal information for cross-context behavioural advertising. If Revient's practices change in a way that creates a legally defined sale or sharing subject to opt-out, Revient will provide the legally required mechanism.

California residents may also submit complaints to the California Privacy Protection Agency where appropriate:

CPPA complaint form: https://cppa.ca.gov/webapplications/complaint

The regulator complaint form is separate from, and does not replace, privacy requests that must be submitted to Revient for Revient to act on the request.

46. Other United States privacy rights

If another US state privacy law applies to Revient and to your personal information, Revient will provide the rights and appeal or opt-out procedures required by that law. Depending on the state, those rights may include access, correction, deletion, portability, and opt-outs relating to certain sales, targeted advertising or profiling.

Revient's accessibility from a state does not by itself mean that Revient meets the applicability thresholds of every state privacy law.

47. EU/EEA users and representative

Where EU GDPR applies to Revient's processing, Revient will comply with the rights, lawful-basis, transparency, security and international-transfer requirements applicable to that processing.

If Revient is required to appoint an EU representative, the representative's details will be:

(EU REPRESENTATIVE NAME AND CONTACT DETAILS, IF REQUIRED)

48. UK representative or other regional representatives

If Revient is established outside a jurisdiction and applicable law requires a local privacy representative, Revient will publish the relevant representative details in this Notice.

(OTHER REQUIRED REGIONAL REPRESENTATIVE DETAILS, IF APPLICABLE)

49. Data Protection Officer

If Revient is legally required to appoint a Data Protection Officer, or voluntarily appoints one, the DPO can be contacted at:

(DPO CONTACT DETAILS, IF APPLICABLE)

If no DPO is required or appointed, privacy enquiries should be sent to (PRIVACY EMAIL).

50. Children

Revient Accounts are intended for adults acting for businesses or organisations. You must be at least 18 to create a Revient Account.

Revient is not directed to children. Merchants should not intentionally provide information about a child unless the information is genuinely necessary and the processing is lawful. Revient may restrict, redact or delete unnecessary information relating to a child.

51. Accuracy and corrections

Revient takes reasonable steps appropriate to its role to maintain accurate information. Much Case Data originates from Merchants, integrations and third parties, and Revient may not independently know whether every source record is correct.

Merchants are required to update material Case information. If you believe information about you is inaccurate, you may contact Revient or the relevant Merchant.

52. Data minimisation

Revient aims to process only the information reasonably necessary for the relevant functionality.

For email evidence, Revient's intended model is case-targeted search rather than indiscriminate mailbox copying. For commerce integrations, Revient seeks to retrieve relevant orders and Case information rather than the Merchant's entire customer database where broader access is not required.

53. Analytics and service improvement

Revient may use operational information to understand service reliability, product performance, errors, security and aggregate usage.

Where possible and appropriate, Revient will use aggregated or anonymised information for product metrics and benchmarking.

Use of cookies or other device-storage/access technologies for analytics is governed by the Cookie Policy and applicable consent or objection requirements.

54. Anonymised and aggregated information

Information that has been genuinely anonymised so that an individual is no longer identifiable is not treated as personal information for purposes that depend on identifiability.

Subject to applicable law, Merchant instructions where Revient is Processor, and third-party platform restrictions, Revient may use properly anonymised or aggregated information to understand product performance, improve security, evaluate Evidence Engine quality and understand aggregate Case outcomes.

55. Evidence Engine improvement and model providers

Real corrections and review labels are retained within their Workspace, bound to the exact assessment and selected evidence versions. Case data is also used to train and improve Revient AI, including models Revient trains itself. Before it is used, names, email addresses, postal addresses, phone numbers, order numbers and Case and Workspace identifiers are removed, leaving only the facts of the Case and its outcome. Learning shared across Merchants uses only data from which no Merchant, customer or Case can be identified. Gmail-derived material is never used for training. Model, prompt, schema and runtime changes require an evaluated candidate and recorded approval before activation; outcome reporting is kept separate from assessment accuracy.

Where Revient uses an external AI/model provider to process personal information, the provider and its role will be reflected in the Data Protection & GDPR provider register where required.

Selected mailbox information is never used for model training. Case information is used for training only in the de-identified form described above. Calling a third-party model API does not itself retrain that provider's model. The implemented Revient AI path uses OpenAI's Responses API with store: false. This setting is not a guarantee of zero provider retention; account-level retention, abuse-monitoring, processing locations, contractual terms and transfer safeguards must be separately established. See OpenAI data controls.

Current production AI/model provider(s): OpenAI

Implemented testing configuration: OpenAI GPT-6 Luna, Standard processing; no credential or model is activated merely by this disclosure. Account-specific retention, contract and transfer terms: (AI ACCOUNT DATA CONTROLS / CONTRACT / LOCATIONS / TRANSFER SAFEGUARDS — UNRESOLVED).

56. Changes to this Privacy Notice

Revient may update this Notice when our Services, integrations, providers, processing or legal obligations change.

The current version and effective date will be displayed at the top of the Notice. Where a change materially affects how personal information is used, Revient will provide additional notice where required or appropriate.

Updating this Notice does not retrospectively make an unlawful processing activity lawful.

57. Relationship with Revient's other legal documents

Revient publishes four principal legal documents:

• Terms of Service - the commercial contract and responsibilities of Merchants and Partners;
• Privacy Notice - this document, explaining how personal information is handled;
• Cookie Policy - explaining cookies and similar storage/access technologies; and
• Data Protection & GDPR - containing Revient's detailed data-protection framework, Data Processing Addendum, Subprocessor framework, international-transfer provisions and security commitments.

58. Contact us

Revient / (COMPANY LEGAL NAME) LIMITED
Company number: (COMPANY REGISTRATION NUMBER)
Registered in: (JURISDICTION OF INCORPORATION)
Registered office: (REGISTERED OFFICE ADDRESS)
Privacy: (PRIVACY EMAIL)
Support: (SUPPORT EMAIL)
Privacy rights portal: (PRIVACY RIGHTS PORTAL URL, IF USED)
Privacy complaint form: (PRIVACY COMPLAINT FORM URL, IF USED)
ICO registration number: (ICO REGISTRATION NUMBER, IF APPLICABLE)
EU representative: (EU REPRESENTATIVE DETAILS, IF REQUIRED)
Website: (WEBSITE URL)

Draft implementation note — selected visual evidence

Where enabled, a merchant may upload a short CCTV clip and an evidence description for an existing case. The merchant must have authority to supply it and minimize unrelated people or sensitive content. Recordings can include people, locations and timestamps; neither the merchant narrative nor the recording clock is automatically verified. Private uploads are encrypted and scanned. Selected test evidence is retained until explicitly removed, subject to applicable holds; production retention terms remain unresolved.

Visual AI processing requires a separate selected-frame permission and an approved runtime. It analyses bounded sampled images, not all video motion or audio, and returns draft observations for human review. Facial identification, inferred intent and automatic findings of wrongdoing are not purposes of this feature. Requests use store:false; that setting does not itself guarantee zero provider retention. Applicable provider terms, transfer safeguards and production retention require confirmation before launch.

Only a merchant-reviewed summary is eligible for authorized partner access. Sharing the entire uploaded original clip requires a separate explicit choice. Revocation stops future downloads but cannot retract copies already downloaded. Test records remain unavailable to partners. Reviewed observations do not override eligibility checks or authorize contact, recovery or release. The controller must establish the applicable lawful basis, notices and rights handling for its footage; the upload checkbox is not a substitute for those obligations. This draft implementation note does not activate legal-readiness gates.