Privacy Policy

This page describes how information is handled on the Devana website and client portal. The statutory notice on processing personal data is on the Privacy Notice page.

Information collected

What you provide. Contact form entries, proposal requests, contract details, documents you upload to the portal and messages you send.
What is collected automatically. IP address, browser details, pages visited and session records. These logs exist for security and error tracking.

How information is used

Collected information is used to deliver consulting services, prepare applications, provide portal access, issue invoices and meet statutory obligations. Marketing messages are sent only where you have given separate consent.

Security measures

Area	Measure
Transport	All traffic is encrypted with TLS
Passwords	Stored irreversibly, never in plain text
Access	Role based authorisation, client data access is logged
Sessions	Session cookies are marked httpOnly and cannot be read by page scripts
Sign in attempts	Repeated failed attempts are rate limited
Documents	Storage is closed to direct URL access

Information is shared only with parties needed to deliver the service: the institutions receiving an application, financial and legal advisors, hosting and email providers. Nothing is sold to third parties.

Retention and deletion

Data is held for the duration of the engagement and for the retention periods required by law, then deleted or anonymised. If you ask for your account to be closed, portal access ends; records subject to a statutory retention duty remain until that period expires.

Children

The site and portal are intended for business use. We do not knowingly collect data from anyone under eighteen.

Changes

When the policy changes, the revision date at the top of the page is updated. Portal users are notified of material changes.

Common questions on this topic

Where are documents I upload to the portal stored?

In restricted storage. Only consultants assigned to your company and authorised administrators can open them.

What happens if I forget my password?

A time limited reset link is sent to your registered email address. The link works once and expires.

Could I see another client's project?

No. Authorisation is checked on the server, so even with the address you cannot reach another company's records.

Do you use my details for marketing?

Not unless you opt in. Newsletter subscription starts with a separate consent and every message carries an unsubscribe link.

What if I find a security problem?

Report it to the address on the Contact page. We treat such reports seriously and respond as quickly as we can.