Privacy notice

Who we are

Brenton Partners Ltd., trading as Trovato, is the data controller for personal data collected through this website. You can reach us about anything in this notice at:

• Email: hello@trovato.ai
• Registered office: 70 Welland Road, Tonbridge, Kent T10 3TB, United Kingdom
• Data protection contact: Data Protection Officer (DPO) — email us at the address above.

The personal data we collect

We only collect what we need to respond to you and to run the site. Depending on how you use it, that includes:

• Enquiry and demo-request details you submit — your name and work email, and (for demo requests) your firm, role, firm size, country and practice areas, plus any message you write.
• Communications — the content of emails and other correspondence you send us, and our replies.
• Marketing-attribution data — the page you submitted from, the referring page, and any UTM campaign parameters in the link you arrived through.
• Technical and analytics data — with your consent, your approximate location, device, browser and pages viewed, collected via Google Analytics 4 (see our cookie notice). Until you consent this is anonymous and cookieless.

How and why we use your data, and our lawful bases

We use your personal data only for the purposes below. For each we rely on a lawful basis under Article 6 of the UK GDPR:

• Responding to your enquiry and arranging demos — lawful basis: legitimate interests (Art. 6(1)(f)): our interest in responding to and pursuing genuine business enquiries.
• Sending you service or follow-up emails you asked for — lawful basis: legitimate interests, or consent (Art. 6(1)(a)) where the law requires it for marketing.
• Measuring and improving the website with analytics — lawful basis: consent (Art. 6(1)(a)); you can withdraw it at any time.
• Operating, securing and protecting the site (e.g. rate-limiting, spam/abuse prevention, audit logging) — lawful basis: legitimate interests in keeping the site safe and available.
• Meeting legal, regulatory or tax obligations and handling disputes — lawful basis: legal obligation (Art. 6(1)(c)) or legitimate interests in establishing or defending legal claims.

Special category data and children

We do not ask for special category data (such as health, race or political opinions) and ask that you do not send it through the site. This website is aimed at legal professionals, not children, and we do not knowingly collect data from anyone under 18.

Cookies and analytics

We use a small number of strictly necessary cookies and, with your consent, Google Analytics. By default our analytics run in a cookieless, anonymous mode (Google Consent Mode); we only set analytics cookies once you accept them. Full detail — including each cookie, its purpose and how to change your choice — is in our cookie notice (/legal/cookies).

Who we share your data with

We do not sell your personal data and we do not share it with advertising networks. We share it only with:

• Service providers acting as our processors under contract — our website hosting/infrastructure provider (Fasthosts), our transactional-email provider (Microsoft365), and Google (Google Analytics), each bound to use the data only on our instructions.
• Other companies in our group, where needed to respond to you.
• Professional advisers (such as lawyers, accountants and auditors) where reasonably necessary.
• Authorities, regulators or courts where we are required to by law, or to establish, exercise or defend legal claims.

International transfers

Some of our providers process data outside the UK. Google Analytics may process data in the United States. Where we transfer personal data outside the UK, we rely on UK 'adequacy' regulations where they apply, or on appropriate safeguards — the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses — so your data keeps an equivalent level of protection. You can ask us for a copy of the safeguards we use.

How long we keep it

We keep personal data only as long as we need it for the purposes above, then delete or anonymise it:

• Enquiry, demo-request and correspondence data — while we deal with your enquiry and for up to 24 months after our last meaningful contact, unless you become a customer (then it is governed by the customer agreement) or ask us to delete it sooner.
• Analytics data — Google Analytics is configured to retain user-level and event data for 14 months; aggregated, non-identifying reports may be kept longer.
• Records we must keep for legal, tax or security reasons — for as long as the relevant law requires.

How we protect your data

We use appropriate technical and organisational measures to protect personal data — including encryption in transit, access controls and audit logging, and limiting access to staff who need it. No website can be completely secure, but we work to protect your data and to notify you and the ICO of any breach where the law requires.

Your rights

Under the UK GDPR you have the following rights over your personal data. We will respond within one month and will not charge a fee unless a request is manifestly unfounded or excessive:

• Be informed about how we use your data — that is the purpose of this notice.
• Access a copy of the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data ('right to be forgotten') in certain circumstances.
• Restriction of how we use your data in certain circumstances.
• Data portability — receive certain data in a portable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time where we rely on it (such as analytics), without affecting processing already carried out.
• Not be subject to solely automated decisions with legal or similarly significant effects — we do not make such decisions through this website.

How to exercise your rights, or complain

To exercise any of these rights, email us at hello@trovato.ai; we may need to verify your identity first. If you are unhappy with how we have handled your data you can complain to the UK supervisory authority, the ICO — Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — helpline 0303 123 1113 — ico.org.uk. We would, however, appreciate the chance to put things right first.

Visitors in South Africa

If you are in South Africa, we also process your personal information in line with the Protection of Personal Information Act (POPIA). The rights and contact route above apply equally; you may also lodge a complaint with the Information Regulator (South Africa).

Changes to this notice

We may update this notice from time to time. The current version and its date are shown at the top of this page; this notice was last updated on 23 June 2026.