Privacy Notice

This Privacy Notice explains how Nineteen Point Two collects, uses, stores and shares personal data.

It applies to:

• visitors to the Nineteen Point Two website
• visitors to WAIA pages
• visitors to Outside Clarity pages
• prospects and business contacts
• customer contacts
• WAIA organisation administrators
• WAIA learners
• Outside Clarity users and prospective users
• people who contact us for support, sales, partnerships or general enquiries

1. Who we are

Nineteen Point Two is a business that provides practical operating systems, commercial advisory services and workplace AI adoption tools, including WAIA and Outside Clarity.

Legal entity: Nineteen Point Two Limited
Company number: 15905276
Registered address: C/O James Todd & Co Furzehall Farm, 110 Wickham Road, Fareham, Hampshire, United Kingdom, PO16 7JH
Privacy contact: ben@nineteenpointtwo.com

In this Privacy Notice, “Nineteen Point Two”, “19.2”, “we”, “us” and “our” refer to the organisation providing these services.

2. Our role under data protection law

Our role depends on the context.

Where we are controller

We are controller where we decide why and how personal data is used. This includes personal data used for:

• our websites
• sales and marketing
• prospecting and business development
• customer relationship management
• Outside Clarity enquiries, fit checks, intakes and reports
• billing and account administration
• support enquiries
• supplier management
• our own business operations

Where we are processor

For WAIA learner data provided or managed by a customer organisation, the customer organisation will usually be the controller and Nineteen Point Two will usually act as processor.

This means the customer decides why learner data is used, who should access WAIA, what learning is assigned, and how WAIA records are used internally. Nineteen Point Two processes the data to provide WAIA under the customer’s instructions.

For other hosted services, such as Outside Clarity, our role depends on the service, the customer relationship and the information being processed. Nineteen Point Two Limited remains the customer-facing organisation responsible for the service, while third-party infrastructure and AI providers may act as processors or subprocessors.

3. Personal data we collect

The personal data we collect depends on how you interact with us.

Website visitors

We may collect:

• IP address
• device and browser information
• pages viewed
• approximate location derived from technical data
• referral source
• cookie preferences
• website usage data
• security and diagnostic logs

Prospects and business contacts

We may collect:

• name
• job title
• organisation
• work email address
• work telephone number, if provided
• LinkedIn or professional profile information, where relevant
• communication history
• areas of business interest
• campaign engagement information
• publicly available business information

Customer contacts

We may collect:

• name
• job title
• organisation
• work email address
• contract and order information
• billing contact details
• communication history
• meeting notes
• service preferences
• support history

WAIA organisation administrators

We may collect:

• name
• work email address
• organisation
• admin role or permission level
• login and account activity
• invitation activity
• learner management activity
• organisation settings
• organisation AI guidance configuration
• organisation branding information, such as logo URL, website URL and short description
• support messages
• technical logs

WAIA learners

We may collect:

• name
• work email address
• organisation
• user role or access level
• invitation status
• course assignment
• course progress
• lesson completion status
• knowledge check or assessment responses
• guidance acknowledgement status
• certificate or completion records
• login and security logs
• support messages

Outside Clarity users

We may collect:

• name
• email address
• organisation, where provided
• decision summaries and context you choose to provide
• supporting material you choose to submit
• fit-check and intake responses
• case status, suitability and review information
• payment and report-delivery status, where applicable
• support messages
• technical logs

Support and enquiries

We may collect:

• contact details
• message content
• files or screenshots you choose to send us
• technical diagnostic information
• support history

Please do not send us special category data unless we specifically ask for it and there is a clear reason to do so.

4. How we collect personal data

We may collect personal data:

• directly from you
• from your employer or organisation
• when an organisation invites you to WAIA
• when you use WAIA
• when you use Outside Clarity
• when you complete learning, acknowledgements or assessments
• when you complete a fit check, intake form or service workflow
• when you contact us
• when you visit our website
• from publicly available business sources
• from service providers used for email, analytics, hosting, security, customer management or support

5. Why we use personal data

We use personal data for the following purposes.

Where we act as processor, the customer organisation is responsible for identifying its own lawful basis for using learner data.

6. AI-supported processing and model training

Some Nineteen Point Two services may use AI-supported tools to help provide the relevant service. For example, Outside Clarity may use structured AI-supported tools and human review to help consider the information you submit and prepare a response or report.

Information submitted through our applications is used to provide the relevant service. Where the applicable product and provider arrangements support it, submitted application content is not used to train AI models.

For Outside Clarity, Lovable has confirmed that it does not use end-user content from published applications to train Lovable models, and that its agreements with routed model providers prohibit those providers from using that content to train their models.

This does not mean that providers apply zero retention, zero logging or no operational processing. Providers may process and retain request data, response data or metadata for security, reliability, abuse monitoring, support, legal or operational purposes under their own applicable terms.

7. Marketing communications

We may contact business contacts about Nineteen Point Two services where we believe there is a relevant business interest. We will respect opt-out requests.

Where consent is required for a particular type of communication, we will seek consent before sending it.

You can ask us to stop sending marketing communications at any time by contacting ben@nineteenpointtwo.com or using any unsubscribe link provided.

8. Cookies and similar technologies

We use cookies and similar technologies where needed to operate our website or platform, maintain security, understand usage or support analytics.

Non-essential cookies will only be used where required consent has been obtained.

More detail is available in our Cookie Notice: /cookies/.

9. Who we share personal data with

We may share personal data with:

• hosting and infrastructure providers
• database and authentication providers
• application deployment and monitoring providers
• email and communication providers
• analytics providers
• payment, accounting and finance providers
• professional advisers
• legal, regulatory or public authorities where required
• customer organisations, where WAIA records relate to their own learners
• suppliers who help us provide, secure or support our services

Where a third party processes customer personal data on our behalf for Nineteen Point Two products or services, we treat them as a processor or subprocessor as appropriate and require appropriate contractual protection.

10. Current and expected providers

Depending on the current deployment, providers may include:

• Lovable, for application hosting, deployment, platform operation or related services
• Supabase, for database, authentication, storage, backend and related services
• GitHub, for code hosting, website hosting or deployment workflows
• Cloudflare, for DNS, security, routing, hosting or deployment support where used
• Microsoft 365 or Google Workspace, for email, documents, business administration and support where used
• Hunter.io or similar tools, for business contact research, outreach or campaign management where used
• analytics tools, where enabled
• AI model providers routed through our application providers, where an AI-supported service requires them
• payment, accounting or invoicing tools, where used

Nineteen Point Two uses Lovable under a Business plan for relevant hosted applications. Lovable’s Data Processing Agreement forms part of the applicable contractual terms and provides the UK GDPR Article 28 processor provisions for personal-data processing.

Where applicable, Lovable’s international-transfer framework uses the EU Standard Contractual Clauses, Modules 2 and 3, with the UK Addendum.

The active Nineteen Point Two product subprocessor list is maintained separately at /subprocessors/.

11. International transfers

Some of our service providers may process personal data outside the United Kingdom or European Economic Area.

Where this happens, we use appropriate safeguards where required, such as adequacy regulations, standard contractual clauses, the UK International Data Transfer Addendum, data processing agreements or other lawful transfer mechanisms.

12. How long we keep personal data

We keep personal data only for as long as reasonably needed for the purpose for which it was collected, including to provide services, meet legal duties, resolve disputes and maintain business records.

Typical retention periods are:

Specific customer learner data retention may be agreed in customer terms, the order form or data processing agreement.

Deletion from a Nineteen Point Two application does not necessarily mean immediate deletion from every provider-side operational, backup, security or abuse-monitoring record where provider retention rules apply.

13. Your rights

Depending on the circumstances, you may have rights to:

• access your personal data
• correct inaccurate personal data
• request deletion
• restrict processing
• object to processing
• request portability
• withdraw consent where processing is based on consent
• complain to the Information Commissioner’s Office

Where your data is processed in WAIA on behalf of your employer or organisation, we may need to refer your request to that organisation because it is usually the controller.

14. Security

We use reasonable technical and organisational measures to protect personal data. These may include access controls, authentication, role-based permissions, encryption where supported by the relevant provider, logging, supplier controls and operational security practices.

No online service can be guaranteed to be completely secure. Customers and users are responsible for keeping their own login credentials secure and for using WAIA in line with their organisation’s policies.

15. Children

WAIA and Outside Clarity are designed for workplace or business use and are not intended for children.

16. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. The latest version will be published on our website with an updated version date.

17. Contact

For questions about this Privacy Notice or how we handle personal data, contact:

ben@nineteenpointtwo.com

You can also complain to the Information Commissioner’s Office if you are unhappy with how we handle your personal data.