Governance
Privacy notice
How Rectiva Portico handles personal data, on this website and in the platform itself.
Last reviewed 6 October 2026.
Who we are
Rectiva Portico is a Governance, Risk and Compliance platform registered in England and Wales, with a registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, and an operational presence in Nairobi, Kenya. For any question about this notice or about personal data we hold, contact privacy@rectivaportico.com.
This website
Cookies, analytics and third parties on this website. This website sets no cookies and runs no analytics. It does not use local storage to track you. Pages are served from our own domain, and your browser does not load fonts, scripts or images from third parties. Our servers keep standard logs, including IP addresses, for security and to keep the service running. We do not use these logs to profile you.
The one exception is when you ask us for a demonstration or choose a call time. Those details are handled with Google Workspace, as described in the section “Demonstration requests and call bookings” below.
If you email us, we hold that correspondence in order to reply to it and, if it leads to a commercial relationship, to keep a record of what was agreed.
Legal basis for our processing
We rely on the following bases, depending on the activity:
- Contractual necessity: processing the data of users within a subscribing institution in order to provide and maintain the platform service.
- Legitimate interests: responding to enquiries and maintaining security logs of this website. Our interest in operating a functional and secure service is not overridden by data subjects' interests in these cases, given the limited nature of the data involved.
- Legal obligation: maintaining the append-only audit log. Subscribing institutions are required by their own regulators to maintain evidence of governance activity; we are required by those contractual obligations to preserve it faithfully.
- Consent: demonstration requests (including any call time you choose), the optional emailed readiness report and the ROI calculator, all described below, are the exceptions to the above. We process what you provide there only because you have actively agreed to it: through the checkbox on the demonstration form, the checkbox beside the readiness report request, or the checkbox shown before your ROI calculator result is revealed. You can withdraw consent at any time.
We do not rely on consent for any other processing described in this notice.
ROI calculator
If you use the ROI calculator at our application (app.rectivaportico.com/roi-calculator), we collect your name, work email, optional institution name, and the diagnostic answers and figures you provide, on the basis of your consent, given via the checkbox shown before you see your result. We use this to send you your result by email and to follow up about Rectiva Portico. This information is held in our sales pipeline records alongside other prospective-client contacts, and is not shared outside Rectiva Portico. Contact privacy@rectivaportico.com to have it corrected or deleted.
Demonstration requests and call bookings
What we collect. When you request a demonstration or choose a call time, we collect your name, work email address, type of institution, country, staff size band, the areas you want to see, any message you add, and the time you choose. If you tick the box to receive our one-page board summary, we use your email address to send it. Our servers also briefly see your IP address, which we use to prevent abuse.
Why we use it, and our legal basis. We use these details to reply to you, to arrange and run your demonstration, to send the material you asked for, and to keep a record of the enquiry. We rely on your consent, given through the checkbox on the form, which you can withdraw at any time. Where you later become a customer, we rely on contract and legitimate interests as described elsewhere in this notice. We do not use your details for unrelated marketing without asking you first.
Who handles it. We use Google Workspace (calendar, email, spreadsheet and video meeting services) to schedule calls, send invitations and replies, and keep our enquiry records. Google acts as our processor under its data processing terms. Your details may be processed in countries outside the United Kingdom, the European Union, Kenya and Uganda, including the United States. Where that happens we rely on the UK addendum and the EU standard contractual clauses in Google’s Workspace data processing terms and, for Kenya and Uganda, safeguards consistent with the Kenya Data Protection Act 2019 and the Uganda Data Protection and Privacy Act 2019. Google is listed with our other sub-processors.
How long we keep it. We keep enquiries that do not lead to a contract for 12 months after our last contact with you, then delete them. Calendar entries for demonstration calls are kept for the same period. If you become a customer, the details you gave move into our customer records and follow the retention rules for those records.
Your choices. You can ask us to access, correct or delete your enquiry, object to our use of it, or withdraw your consent, by emailing privacy@rectivaportico.com. You can also complain to the Information Commissioner’s Office in the UK, the Office of the Data Protection Commissioner in Kenya, or the Personal Data Protection Office in Uganda.
Readiness check and other interactive tools
The readiness check, regulator map and scenario game run in your browser. Your answers are not sent to us or stored by us. If you choose to email yourself the readiness report, we receive your email address and your result, and handle them as described under “Demonstration requests and call bookings”. Closing or reloading the page clears your answers.
The platform
When an institution subscribes to Rectiva Portico, that institution is the controller of the personal data it puts into the platform, covering the records of its own staff and any personal data appearing in its risk, incident and compliance records. We act as its processor, handling that data on its documented instructions.
If you are an employee of a subscribing institution and want to know what is held about you or to exercise your rights over it, your employer is the right first point of contact, because they decide what is recorded and why. We will support them in responding.
What the platform holds about a user
- Name, work email address, assigned role and business unit.
- Whether two-step sign-in is set up, and the authentication factor itself, which is held by our authentication provider and is not readable by us as a usable secret.
- An audit record of actions taken in the platform: what was changed, when, and by whom. This is a deliberate feature: it is the record an institution needs in order to evidence its own governance. It is append-only, so it cannot be selectively edited.
Where it is held
Platform data is hosted in the European Union (Frankfurt, Germany) by a managed database provider operating under EU data-protection law.
International transfers
For institutions based in Kenya or Uganda, personal data processed in the platform is transferred to and stored in the European Union. Those transfers are made on the basis of equivalent safeguards and standard contractual arrangements that provide protections consistent with the Kenya Data Protection Act 2019 and the Uganda Data Protection and Privacy Act 2019.
In practice, the data typically held in the platform, including staff records, internal governance records and risk and compliance documentation, does not ordinarily engage data-localisation requirements under CBK or BoU frameworks. We confirm the applicable position for your specific licence and regulator before contracting.
Enquiry details you send through the demonstration form may also be processed by Google outside the United Kingdom, the European Union, Kenya and Uganda, with the safeguards named under “Demonstration requests and call bookings” above.
How long it is kept
Retention is configured by each subscribing institution to match its own regulator's requirement. On termination, an institution has 30 days to retrieve its data, after which the data is deleted within 60 days of termination.
Audit log entries are the exception, and deliberately so: they cannot be edited or removed while the institution's account exists, because an audit trail that can be tidied up is not an audit trail.
Sub-processors
We use a small number of service providers to run the platform: cloud hosting, managed database and authentication services, and transactional email. A current list, with the role each plays and where it processes data, is provided to subscribing institutions and is available on request to any prospective customer carrying out due diligence.
For demonstration requests and call bookings we also use Google (calendar, email, spreadsheet and video meeting services). Your request passes through our website hosting provider’s servers on its way to Google, and that provider keeps standard logs as described above.
Your rights
Your rights depend on the data protection law applicable to your situation. In all cases, contact privacy@rectivaportico.com to exercise any of the rights set out below. Where we act as a processor for a subscribing institution, rights requests relating to platform data should be directed through that institution in the first instance.
United Kingdom and European Union
Where UK GDPR or EU GDPR applies, you have rights of access, rectification, erasure, restriction, objection and data portability. You have the right to complain to a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO).
Kenya
Where the Kenya Data Protection Act 2019 applies, you have rights of access, rectification, erasure, objection and data portability under Sections 26 to 38 of that Act. You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC).
Uganda
Where the Uganda Data Protection and Privacy Act 2019 applies, you have rights of access, rectification, erasure, objection and data portability under that Act. You have the right to lodge a complaint with the Personal Data Protection Office (PDPO).
Changes to this notice
Any material change will be reflected here with an updated review date. Subscribing institutions are notified of changes affecting how we process data on their behalf.