Privacy Policy

“Drova Services” refers to any of the products and services we may provide to you.

“Personal Information” refers to any information that may identify you or could be reasonably used to identify you, directly or indirectly. This includes names, identifiers, contact details, location data, online identifiers, and any information you provide, upload, or generate through Drova Services.

“User Content” refers to any content you create, upload, store, communicate, or display through Drova Services. Content may include Personal Information, including Sensitive Information.

We may update this Privacy Policy periodically. When we do, we will update the “Effective Starting” date. If changes are material, we will notify you via email, website notices, or login alerts.

If you do not agree with the updated terms, you should stop using Drova Services or exercise your rights as described in this Privacy Policy, or otherwise as provided by law.

We collect Personal Information to provide, operate, improve, and secure Drova Services. If we cannot collect certain information, you may not be able to use Drova Services or to create an account.

We use Personal Information to:

We may also use Personal Information for additional purposes disclosed at the time of collection.

The Personal Information we may collect includes information that you provide voluntarily to us, information that we collect automatically and information that we obtain from third party sources.

We may also process Personal Information incorporated in the content that users create, provide, post, host, upload, store, communicate or display when you use the Drova Services (“User Content”). This may include Sensitive Information, such as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. Where we process Personal Information in content, we do so on behalf of our customers and users and it is their responsibility to have lawful grounds to use that Personal Information.

We collect analytics data about:

If you integrate third-party services:

We may collect:

We collect Personal Information:

We may disclose Personal Information to:

If you use Drova as part of an organisation, administrators may:

Technology, hosting, analytics, and customer support providers may access Personal Information to facilitate and improve Drova Services.

We may also disclose Personal Information to comply with legal and regulatory obligations globally.

We may disclose Personal Information to related entities of Drova Pty Ltd for operational purposes.

If Drova is sold or restructured, Personal Information may be transferred to the new owner.

We may disclose Personal Information to third parties for marketing only with your consent or where lawful grounds exist.

We may disclose Personal Information to bankers, auditors, insurers and insurance brokers, legal advisers and other professional advisers to obtain professional advice, or to comply with contractual requirements or law.

We store your personal information in Australia. However, your information may be accessed from or transferred to locations outside Australia (including the USA and UK) in these circumstances:

Before disclosing your personal information overseas, we take reasonable steps to ensure that the recipient treats your information in accordance with applicable law by only sending what is necessary, requiring recipients to protect your information through contractual agreements which require the recipient to comply with the privacy standards in applicable law or through other mechanisms that provide comparable safeguards and by monitoring how recipients handle your information.

We retain Personal Information where:

When no longer needed, we will delete or anonymise Personal Information or securely store it until deletion is possible (eg. backups).

We may use automated processing, including machine learning and artificial intelligence technologies, to help provide, improve and secure Drova Services. For example, automated processing may be used to:

Automated processing assists our services but is not intended to produce decisions that have legal or similarly significant effects on individuals without appropriate human involvement. Where applicable privacy laws provide rights relating to automated decision-making or profiling, you may contact us to request further information or to exercise those rights.

When we work with third-party AI providers, we ensure they handle your personal information in accordance with privacy laws through contractual requirements and appropriate safeguards.

Any information generated or inferred about you by AI technologies is treated as Personal Information, and you maintain all the rights outlined in this Privacy Policy. When using AI with your Personal Information, we commit to:

Transparency and Control

Security

Risk Mitigation

We use cookies, tracking pixels and similar technologies on our website and in our emails to:

You can manage these technologies by:

Some features may not function if cookies are disabled.

We use Google Analytics to understand how people use our website. This involves cookies that collect information about your browsing activity. You can opt out of Google's advertising features through your Google account settings, browser add-ons, or your device's privacy settings. Google provides various tools and options to control how your data is used for advertising purposes. You can learn more about how Google uses your data and your available options on Google's privacy pages.

Please see our Cookie Policy for details.

In storing your Personal Information, we use a number of security and organisational measures and technologies to safeguard your Personal Information from unauthorised access, modification or disclosure and misuse, interference or loss. We have personnel tasked with protecting your information, developing new security features, and identifying and mitigating vulnerabilities. Our existing security measures include encryption, two-factor authentication, and notifications when new devices and apps are connected with your user account. We also have in place security measures and policies focused on restricting access to sensitive information to authorised personnel, and we consistently review our security procedures and architecture with a consideration of new technologies and updated methods. Despite our reasonable efforts however, no system is ever perfect.

Whilst we hold your information on a secured server behind a firewall and we encrypt data transfer using 256bit SSL encryption, please be aware that there are inherent risks in transmitting information using the internet.

The Drova Services are certified to meet ISO 27001 information security standards. Please contact us for further information on the scope of our ISO 27001 certification.

If you are a visitor from the European Economic Area or the United Kingdom, our legal basis for collecting and using the Personal Information described above will depend on the Personal Information concerned and the specific context in which we collect it.

However, we will normally collect Personal Information from you only where we have your consent to do so, where we need the Personal Information to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect Personal Information from you or may otherwise need the Personal Information to protect your vital interests or those of another person (e.g. other users).

If we ask you to provide Personal Information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Information is mandatory or not (as well as of the possible consequences if you do not provide your Personal Information).

Similarly, if we collect and use your Personal Information in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.

Most of the ways in which we use your personal data are based on our legitimate interests in:

When we rely on our legitimate interests as a lawful ground to process your Personal Information, we do so taking into account the potential impact on your privacy and we offer the right to object to or opt out from processing as described below in the “Your privacy rights” section below.

If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Information, please contact us using the contact details provided under the “Contacting Drova about Privacy” heading below.

Your Personal Information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have privacy laws that are different to the laws of your country (and, in some cases, may not be as protective).

Specifically, our group companies and third-party service providers and partners operate around the world and, in particular, in Australia, the United States of America, the Netherlands, Germany, South Africa, Hong Kong, the United Kingdom and Vietnam. This means that when we collect your Personal Information we may process it in any of these countries, pursuant to any privacy laws that apply to Your Content. We currently host our servers for the Drova Services using a third-party hosting provider, Amazon Web Services (“AWS”).

Californian users of the Drova Services will have additional rights afforded to them under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA, effective 1 January 2023).

The CCPA and the CPRA provide California users various rights with respect to the personal information we collect, including the right to, with certain limitations:

California users of the Drova Services may make a request with respect to any of these rights by contacting us by using the contact details provided under the ‘Contacting Drova about Privacy’ heading below.

You have the following privacy rights, regardless of the legal jurisdiction of Your Content:

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable privacy laws.

Please note that we do not offer any of the rights described above with respect to any Personal Information that is incorporated in any User Content. We process such content on behalf of our customers and if your Personal Information is contained in any such content, you should contact the customer on whose behalf we have stored the information.

In addition to the rights you have outlined under “Your privacy rights”, you also have the below rights.

You can request deletion of your personal data in certain limited circumstances as set out in European Data Protection Law, such as where the data is no longer necessary or has been unlawfully processed. This right is not absolute and we may be required or entitled to retain your data for legal, regulatory or legitimate business reasons.

You can ask us to suspend processing where:

Where technically feasible, you can receive your personal data in a structured, commonly used format or have it transmitted to another controller where:

You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.

Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

Please contact us using the below details if you have queries about our Privacy Policy and privacy practices, or the way we deal with your Personal Information. You may also contact us using these details if you wish to exercise any of your privacy rights described in the section entitled “Your privacy rights” above.

Postal Address: Drova Level 1, 47 York Street, Sydney NSW 2000 Australia Telephone: +61 1300 333 472

Email: hr@drova.com

Position title and name:

Co-founder & Head of ESGRC: Rachel Riley

Where you are located in the European Economic Area (EEA) or the United Kingdom, you may also contact Drova Limited:

Postal Address: 22 Wycombe End,

Beaconsfield, Buckinghamshire HP9 1NB United Kingdom Telephone: +442045257290 Email: hr@drova.com

Position title and name:

Co-founder & Chief Commercial Officer: Rachel Riley

When you request that we access or correct your Personal Information, we will need to locate the relevant information, so it would greatly assist us if you could supply as much supporting detail as possible. Where we refuse any access or correction request, we will comply with any requirements under applicable laws to notify you of our reasons for doing so and the mechanisms through which you may complain. Where we deny a request to correct information after you have made a request to us, we will comply with any applicable legal requirements to advise you of any inaccuracies or lack of necessary detail within your request.