This notice tells you what personal data we hold about you, why we hold it, who we share it with, how long we keep it, and what your rights are. We wrote it in plain English. If anything is unclear, please contact us using the details at the bottom of this page.
Who we are
Aura Nova Ltd.
44 Harpur St
Bedford
MK40 2QT, United Kingdom
Email: [email protected]
Telephone: +44 1234 619242
Data Protection Officer: Tim King > [email protected]
Quick summary
- We only collect what we need to deliver our services, respond to enquiries and meet legal obligations.
- We never sell your personal data.
- You can ask for a copy of your data, ask us to correct or delete it, or object to processing > at any time, free of charge.
- You can complain to the UK Information Commissioner's Office if you're unhappy with how we handle your data.
What data we hold and why
| Activity | Why we hold the data | How long we keep it |
|---|---|---|
| Client engagement | To deliver the services agreed in your engagement > site visits, monitoring deployment, analysis and reporting. UK GDPR Art. 6(1)(b) > performance of contract. | Active engagement plus 7 years for accounting, audit and professional-liability obligations. |
| Enquiries via the contact form or email | To respond to your enquiry and follow up with relevant information. UK GDPR Art. 6(1)(f) > legitimate interest in responding to business enquiries. | 24 months from last contact, then deleted or anonymised. |
| Newsletter & marketing list | To send you our briefings, field notes and event invitations. UK GDPR Art. 6(1)(a) > consent. You may unsubscribe at any time. | Until you unsubscribe, plus a suppression record so we don't email you again by mistake. |
| Monitoring & reporting data we process for clients | To deliver air-quality, energy and ESG analyses. The legal basis for processing personal data within client environments rests with the client as controller; we act as processor under a data-processing agreement. UK GDPR Art. 28 > processor obligations. | As agreed in the client engagement; typically returned or deleted within 60 days of engagement end. |
| Website analytics | To understand how the site is used (only if you accept analytics cookies). UK GDPR Art. 6(1)(a) > consent. | 13 months from your last visit. |
| Authentication & session | To keep you signed in to client portals (where applicable). UK GDPR Art. 6(1)(b) > performance of the portal login flow. | Session token expires after 1 hour idle; refresh on activity. |
| Audit & access trail | Records of actions taken on our systems, retained as a security audit trail. UK GDPR Art. 6(1)(c) and 6(1)(f) > legal obligation and legitimate interest in maintaining a security audit log. | Action log retained for 12 months; model-change entries retained for 7 years. |
Special-category data
For some Health & Wellness engagements we may process special-category data (e.g. occupant-health survey responses) on the basis of explicit consent (UK GDPR Art. 9(2)(a)) or with a clear public-interest basis (Art. 9(2)(g)). We handle this data only when strictly necessary, in pseudonymised form wherever possible, and we delete it on the same schedule as the parent engagement.
Who we share data with
We share your data only with the people and services we need to run our practice, and only for the purposes above:
- Sub-processors > specialist laboratories and analytics partners under written data-processing agreements; current list available on request.
- Cloud storage & backup > UK / EEA-based providers under appropriate safeguards.
- Transactional email > for confirmations, reports and DSAR responses.
- Professional advisers > accountants, auditors and legal counsel where required.
- Regulators & law-enforcement > only where compelled by law.
We process data in the UK and EEA. Where any sub-processor operates outside the UK, we rely on UK adequacy decisions and Standard Contractual Clauses / the IDTA.
How we keep your data safe
Your data is encrypted in transit and at rest. Access is restricted on a need-to-know basis and protected by strong authentication. We keep an audit trail of access and changes, and we run a documented incident-response plan.
Automated decision-making
We do not make solely automated decisions about you that have legal or similarly significant effects.
Your rights
Right to be informed
We tell you how your data is used. That's what this notice is for.
Right of access (DSAR)
You can ask for a copy of the data we hold about you. We'll respond within 30 days of confirming it's really you asking. Submit a request at aura-nova.co.uk/dsar.
Right to rectification
If anything we hold is wrong, ask us to fix it.
Right to erasure
Ask us to delete your data. We will, except where we're legally required to keep certain records (audit logs, finance records) > we'll tell you what stays and why.
Right to restrict processing
Ask us to stop using your data for a particular purpose while we sort out a complaint or correction.
Right to data portability
Ask for a machine-readable copy of your data so you can take it to another service.
Right to object
Object to processing we do under 'legitimate interests' > for example, stop receiving emails about events.
Rights related to automated decision-making and profiling
We don't make solely automated decisions about you that have legal or similarly significant effects.
Contact us
If you would like a copy of the data we hold about you, want us to correct or delete something, or have any other concern about how we use your data, please contact our DPO Tim King at [email protected] or use the DSAR form.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk > telephone 0303 123 1113.
This notice was last updated 18 May 2026. We may update it from time to time; we'll post any material changes on this page and, where appropriate, notify you directly.