Legal

Privacy Notice

How Nineteen Point Two Limited collects, uses, stores and shares personal data across the website, customer relationships and WAIA.

Last updated: 15 October 2026 Version: 1.3

This Privacy Notice explains how Nineteen Point Two collects, uses, stores and shares personal data.

It applies to:

  • visitors to the Nineteen Point Two website
  • visitors to WAIA pages
  • prospects and business contacts
  • customer contacts
  • WAIA organisation administrators
  • WAIA learners
  • people who contact us for support, sales, partnerships or general enquiries

1. Who we are

Nineteen Point Two is a business that provides practical operating systems, commercial advisory services and workplace AI adoption tools, including WAIA.

Legal entity: Nineteen Point Two Limited
Company number: 15905276
Registered address: C/O James Todd & Co Furzehall Farm, 110 Wickham Road, Fareham, Hampshire, United Kingdom, PO16 7JH
Privacy contact: ben@nineteenpointtwo.com

In this Privacy Notice, “Nineteen Point Two”, “19.2”, “we”, “us” and “our” refer to the organisation providing these services.

2. Our role under data protection law

Our role depends on the context.

Where we are controller

We are controller where we decide why and how personal data is used. This includes personal data used for:

  • our website
  • sales and marketing
  • prospecting and business development
  • customer relationship management
  • billing and account administration
  • support enquiries
  • supplier management
  • our own business operations

Where we are processor

For Customer Personal Data provided or managed by a customer organisation through WAIA, including learner records, organisational baselines, application evidence and management review, the customer is controller and Nineteen Point Two acts as processor under the Data Processing Agreement.

The customer decides why this data is used, who should access WAIA, what learning is assigned, and how WAIA records are used internally. Nineteen Point Two processes it under the customer’s documented instructions. We remain controller for our own customer contacts, billing, website enquiries and business operations.

3. Personal data we collect

The personal data we collect depends on how you interact with us.

Website visitors

We may collect:

  • IP address
  • device and browser information
  • pages viewed
  • approximate location derived from technical data
  • referral source
  • website usage data
  • security and diagnostic logs

Prospects and business contacts

We may collect:

  • name
  • job title
  • organisation
  • work email address
  • work telephone number, if provided
  • LinkedIn or professional profile information, where relevant
  • communication history
  • areas of business interest
  • campaign engagement information
  • publicly available business information

Customer contacts

We may collect:

  • name
  • job title
  • organisation
  • work email address
  • contract and order information
  • billing contact details
  • communication history
  • meeting notes
  • service preferences
  • support history

WAIA organisation administrators

We may collect:

  • name
  • work email address
  • organisation
  • admin role or permission level
  • login and account activity
  • invitation activity
  • learner management activity
  • organisation settings
  • organisation AI guidance configuration
  • organisation branding information, such as logo URL, website URL and short description
  • support messages
  • technical logs

WAIA learners

We may collect:

  • name
  • work email address
  • organisation
  • user role or access level
  • invitation status
  • course assignment
  • course progress and baseline responses
  • learner or application evidence, including workflow frequency, net time change, checking and rework, outcome signals, and supporting narrative or context
  • organisation workflow grouping, management review decisions, reviewer/context records and validation/context snapshots where relevant
  • lesson completion status
  • knowledge check or assessment responses
  • guidance acknowledgement status
  • certificate or completion records
  • login and security logs
  • support messages

Support and enquiries

We may collect:

  • contact details
  • message content
  • files or screenshots you choose to send us
  • technical diagnostic information
  • support history

Please do not send us special category data unless we specifically ask for it and there is a clear reason to do so.

Tally hosts our Contact Us and Visibility Check forms. The Contact Us form has no connected external integration. Visibility Check submissions also go to a Google Apps Script webhook for the Google-based access process. Partial submissions are disabled on both forms. A valid source code in a direct link may accompany a submitted enquiry.

4. How we collect personal data

We may collect personal data:

  • directly from you
  • from your employer or organisation
  • when an organisation invites you to WAIA
  • when you use WAIA
  • when you complete learning, acknowledgements or assessments
  • when you contact us
  • when you visit our website
  • from publicly available business sources
  • from service providers used for email, analytics, hosting, security, customer management or support

5. Why we use personal data

We use personal data for the following purposes.

Purpose

Examples

Our lawful basis where we are controller

Provide WAIA

Account access, learning delivery, progress records, admin reporting

Not our controller purpose for Customer Personal Data. The customer determines the lawful basis; we act on its documented instructions.

Manage customer relationships

Contract management, onboarding, support, renewal discussions

Legitimate interests in managing a business customer relationship; contract where the contact is personally a party to it.

Support users

Troubleshooting, responding to questions, resolving issues

Legitimate interests in resolving enquiries and supporting users; customer-controlled WAIA records are processed on customer instructions.

Evidence learning and acknowledgement

Completion records, guidance acknowledgement, certificate status

Customer instruction for Customer Personal Data. The customer determines its lawful basis.

Maintain security

Login monitoring, audit logs, misuse prevention, service protection

Legitimate interests in protecting our website and service; legal obligation where a specific law requires processing.

Improve services

Understanding usage, identifying errors, improving content and workflows

Legitimate interests for our own service improvement; consent where required for device storage or access. Customer Personal Data remains subject to customer instructions.

Respond to enquiries

Answering a question, arranging a walkthrough or following up on a requested assessment

Legitimate interests in responding to a request; contract where taking steps at your request towards a contract with you personally.

Direct marketing

Promotional messages and campaign activity

Consent where required by electronic marketing rules; otherwise legitimate interests where lawful and subject to your right to object.

Billing and finance

Invoicing, payment records, accounting

Legal obligation for required tax and accounting records; legitimate interests in administering business accounts.

Legal and compliance

Handling disputes, enforcing terms, meeting legal duties

Legal obligation where a specific duty applies; legitimate interests in establishing or defending legal rights.

These bases describe our controller activities. Where we act as processor, the customer organisation determines the lawful basis for Customer Personal Data and our processing follows its instructions.

6. Marketing communications

Submitting an enquiry or assessment does not by itself give permission for unrelated marketing. We use the details to respond to the request. Any later direct marketing is a separate activity and must meet applicable electronic marketing rules.

Where consent is required for a particular type of communication, we will seek consent before sending it.

You can ask us to stop sending marketing communications at any time by contacting ben@nineteenpointtwo.com or using any unsubscribe link provided.

7. Cookies and similar technologies

We use cookies and similar technologies where needed to operate our website or platform, remember preferences, maintain security, understand usage or support analytics.

The WAIA marketing site uses Cloudflare Web Analytics to measure website use. You can object at analytics preferences. Your choice is kept in first-party localStorage under waia:analytics-objection. Visibility Check results are held in sessionStorage for the browser tab. Marketing attribution does not use persistent browser storage.

More detail is available in our Cookie Notice: /cookies/.

8. Who we share personal data with

We may share personal data with:

  • hosting and infrastructure providers
  • database and authentication providers
  • application deployment and monitoring providers
  • email and communication providers
  • analytics providers
  • payment, accounting and finance providers
  • professional advisers
  • legal, regulatory or public authorities where required
  • customer organisations, where WAIA records relate to their own learners
  • suppliers who help us provide, secure or support our services

Where a third party processes customer personal data on our behalf for WAIA, we treat them as a subprocessor and require appropriate contractual protection.

9. Providers

Providers used for different activities include:

  • Lovable, for WAIA hosting, backend infrastructure and authentication emails
  • Supabase, as underlying database and backend infrastructure managed by Lovable Cloud
  • Cloudflare, for hosting and edge infrastructure and separately for public website analytics
  • Google, through Search Console for search performance and Apps Script for Visibility Check form processing
  • Tally, for Contact Us and Visibility Check submissions
  • Resend, for invitations, learner nudges and administrator digests; Lovable separately provides authentication emails

The active WAIA subprocessor list is maintained separately at /subprocessors/.

10. International transfers

Some of our service providers may process personal data outside the United Kingdom or European Economic Area.

Where a restricted transfer occurs, we must use a valid transfer basis under applicable law. This may be an adequacy decision or appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses or applicable EU standard contractual clauses, with any required transfer assessment and supplementary measures. Supplier locations and the mechanisms used depend on the supplier and service. Resend's primary processing is in the United States; its data processing agreement includes applicable EU standard contractual clauses and UK transfer provisions.

11. How long we keep personal data

We keep personal data only for as long as reasonably needed for the purpose for which it was collected, including to provide services, meet legal duties, resolve disputes and maintain business records.

Our retention categories and criteria are:

Data type

Retention approach

Website enquiry data

Kept for as long as needed to respond and manage the relationship

Prospect and marketing data

Reviewed against the purpose of the contact, relationship and any objection or withdrawal of consent

Customer contact data

Kept while needed to manage the customer relationship and afterwards where needed for records or disputes

Billing and accounting records

Kept for the period required by tax and accounting law

WAIA learner data

Governed by the customer agreement, the customer’s instructions and the Data Processing Agreement

Support records

Kept for a reasonable period to manage service quality, disputes and continuity

Security logs

Kept for a limited period unless needed to investigate an incident

WAIA Customer Personal Data is returned or deleted under the Data Processing Agreement. Export and complete organisation deletion are handled manually. Backup copies are removed through normal backup retention cycles, subject to legal obligations.

12. Your rights

Depending on the circumstances, you may have rights to:

  • access your personal data
  • correct inaccurate personal data
  • request deletion
  • restrict processing
  • object to processing
  • request portability
  • withdraw consent where processing is based on consent
  • complain to the Information Commissioner’s Office

To exercise a right, email ben@nineteenpointtwo.com and tell us what you want to do. We may ask for information needed to confirm your identity. We will respond within the period required by law and explain any applicable exception. You can object to processing based on legitimate interests and withdraw consent at any time where consent is the basis; withdrawal does not affect earlier lawful processing.

Where your data is processed in WAIA on behalf of your employer or organisation, we will direct your request to that controller or assist it as required by the Data Processing Agreement.

If you remain unhappy, you can complain to the Information Commissioner’s Office at ico.org.uk.

13. Security

We use reasonable technical and organisational measures to protect personal data. These may include access controls, authentication, role-based permissions, encryption where supported by the relevant provider, logging, supplier controls and operational security practices.

No online service can be guaranteed to be completely secure. Customers and users are responsible for keeping their own login credentials secure and for using WAIA in line with their organisation’s policies.

14. Children

WAIA is designed for workplace use and is not intended for children.

15. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. The latest version will be published on our website with an updated version date.

16. Contact

For questions about this Privacy Notice or how we handle personal data, contact:

ben@nineteenpointtwo.com

You can also complain to the Information Commissioner’s Office if you are unhappy with how we handle your personal data.