Rectiva Portico Risk managed. Value created.

Governance

Privacy notice

How Rectiva Portico handles personal data, on this website and in the platform itself.

Last reviewed 31 July 2026.

Who we are

Rectiva Portico is a Governance, Risk and Compliance platform registered in England and Wales, with a registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, and an operational presence in Nairobi, Kenya. For any question about this notice or about personal data we hold, contact privacy@rectivaportico.com.

This website

This site sets no cookies, runs no analytics, and loads no third-party resources: no fonts, scripts, trackers or embedded content from any other domain. Nothing about your visit is shared with anyone else, because nothing about your visit leaves the server that hosts this page.

Our hosting provider keeps standard server logs, which include IP addresses, for operational and security purposes. We do not use them to build any profile of you.

If you email us, we hold that correspondence in order to reply to it and, if it leads to a commercial relationship, to keep a record of what was agreed.

Legal basis for our processing

We rely on the following bases, depending on the activity:

  • Contractual necessity: processing the data of users within a subscribing institution in order to provide and maintain the platform service.
  • Legitimate interests: responding to enquiries and maintaining security logs of this website. Our interest in operating a functional and secure service is not overridden by data subjects' interests in these cases, given the limited nature of the data involved.
  • Legal obligation: maintaining the append-only audit log. Subscribing institutions are required by their own regulators to maintain evidence of governance activity; we are required by those contractual obligations to preserve it faithfully.
  • Consent: the ROI calculator, described below, is the one exception to the above — we process the information you provide there only because you have actively agreed to it via the checkbox shown before your result is revealed.

We do not rely on consent for any other processing described in this notice.

ROI calculator

If you use the ROI calculator at our application (app.rectivaportico.com/roi-calculator), we collect your name, work email, optional institution name, and the diagnostic answers and figures you provide, on the basis of your consent, given via the checkbox shown before you see your result. We use this to send you your result by email and to follow up about Rectiva Portico. This information is held in our sales pipeline records alongside other prospective-client contacts, and is not shared outside Rectiva Portico. Contact privacy@rectivaportico.com to have it corrected or deleted.

The platform

When an institution subscribes to Rectiva Portico, that institution is the controller of the personal data it puts into the platform, covering the records of its own staff and any personal data appearing in its risk, incident and compliance records. We act as its processor, handling that data on its documented instructions.

If you are an employee of a subscribing institution and want to know what is held about you or to exercise your rights over it, your employer is the right first point of contact, because they decide what is recorded and why. We will support them in responding.

What the platform holds about a user

  • Name, work email address, assigned role and business unit.
  • Whether two-step sign-in is set up, and the authentication factor itself, which is held by our authentication provider and is not readable by us as a usable secret.
  • An audit record of actions taken in the platform: what was changed, when, and by whom. This is a deliberate feature: it is the record an institution needs in order to evidence its own governance. It is append-only, so it cannot be selectively edited.

Where it is held

Platform data is hosted in the European Union (Frankfurt, Germany) by a managed database provider operating under EU data-protection law.

International transfers

For institutions based in Kenya or Uganda, personal data processed in the platform is transferred to and stored in the European Union. Those transfers are made on the basis of equivalent safeguards and standard contractual arrangements that provide protections consistent with the Kenya Data Protection Act 2019 and the Uganda Data Protection and Privacy Act 2019.

In practice, the data typically held in the platform, including staff records, internal governance records and risk and compliance documentation, does not ordinarily engage data-localisation requirements under CBK or BoU frameworks. We confirm the applicable position for your specific licence and regulator before contracting.

How long it is kept

Retention is configured by each subscribing institution to match its own regulator's requirement. On termination, an institution has 30 days to retrieve its data, after which the data is deleted within 60 days of termination.

Audit log entries are the exception, and deliberately so: they cannot be edited or removed while the institution's account exists, because an audit trail that can be tidied up is not an audit trail.

Sub-processors

We use a small number of service providers to run the platform: cloud hosting, managed database and authentication services, and transactional email. A current list, with the role each plays and where it processes data, is provided to subscribing institutions and is available on request to any prospective customer carrying out due diligence.

Your rights

Your rights depend on the data protection law applicable to your situation. In all cases, contact privacy@rectivaportico.com to exercise any of the rights set out below. Where we act as a processor for a subscribing institution, rights requests relating to platform data should be directed through that institution in the first instance.

United Kingdom and European Union

Where UK GDPR or EU GDPR applies, you have rights of access, rectification, erasure, restriction, objection and data portability. You have the right to complain to a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO).

Kenya

Where the Kenya Data Protection Act 2019 applies, you have rights of access, rectification, erasure, objection and data portability under Sections 26 to 38 of that Act. You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

Uganda

Where the Uganda Data Protection and Privacy Act 2019 applies, you have rights of access, rectification, erasure, objection and data portability under that Act. You have the right to lodge a complaint with the Personal Data Protection Office (PDPO).

Changes to this notice

Any material change will be reflected here with an updated review date. Subscribing institutions are notified of changes affecting how we process data on their behalf.