Standa
Privacy notice: EquHire and McKenzie Friend (version 1.0)
Version: 1.0
Controller: Konve Ltd trading as Standa
Services: EquHire and McKenzie Friend support
1. About this notice
1.1 This notice explains how Konve Ltd, trading as Standa ("we", "us"), uses personal data when individuals use People Services through people.standa.co.uk.
1.2 Konve Ltd is the data controller. This notice covers EquHire and McKenzie Friend support, not Business Ops processing.
1.3 General contact, cancellation and privacy/data-rights requests: hello@standa.co.uk. The Standa privacy policy also lists dpo@konvegroup.com as its data protection contact and support@standa.co.uk for EquHire order support. Registered address: 7 Mells Crescent, London, SE9 4NF, United Kingdom. Contact details checked in a browser against Standa privacy policy, sections 1, 9 and 14 on 30 October 2026.
2. Data we use
2.1 We use account and contact details; service choice and accepted terms; payment status; questionnaire answers; correspondence; dates and deadlines; uploaded documents; notes and drafts; booking and session details; conflict-check parties and status; and operational logs.
2.2 EquHire information may include recruitment applications, employer or agency names, decisions, data requests and replies. McKenzie Friend information may include court or regulator documents, evidence, case events, opposing parties and hearing details.
2.3 Your information or documents may include special category data, such as health information, or personal data about criminal convictions or offences. Documents can also include personal data about other people. Provide only what is relevant.
2.4 Payment credentials are entered with the payment provider, not into service forms.
3. Purposes and lawful bases
3.1 Intake, account, case work, advice and delivery use UK GDPR Article 6(1)(b), steps requested before a contract and performance of the contract.
3.2 Where a conflict check is required, we use minimum party and matter information for a shared conflict check before accepting a McKenzie Friend engagement. This protects the integrity of the check and helps avoid acting for opposing sides. The lawful basis is Article 6(1)(f), legitimate interests in managing conflicts and protecting clients. This is not a routine EquHire check.
3.3 Limited transaction and accounting records use Article 6(1)(c), legal obligation. Necessary security and audit information uses Article 6(1)(f), legitimate interests in keeping the service secure.
3.4 Where special category data is necessary for legal advice or a legal claim, we rely on Article 9(2)(f), establishment, exercise or defence of legal claims.
3.5 Criminal offence data is processed under Article 10, DPA 2018 section 10(5) and Schedule 1 paragraph 33 where necessary for legal proceedings, obtaining legal advice or establishing, exercising or defending legal rights. Schedule 1 paragraph 33 contains no requirement for an appropriate policy document. Part 4 paragraph 38 applies where the condition relied on itself requires one; paragraph 39 describes its contents. We keep a written policy setting out safeguards for this data as good practice, although paragraph 33 does not require one.
4. AI and automated decisions
4.1 Azure OpenAI in the EU Data Zone helps draft or organise outputs requested for your service. It receives only the task instructions, selected checked legal extracts, necessary structured case facts and relevant client material for the requested task.
4.2 AI outputs are drafts. A practitioner provides substantive judgment and checks outputs where material disputed facts, legal application or case strategy require professional judgment. You decide whether to use or send an EquHire draft. You send, issue, sign and serve documents yourself.
4.3 We do not make a significant decision about you based solely on automated processing under UK GDPR Articles 22A to 22D.
4.4 Azure OpenAI processing uses the EU Data Zone. EU Data Zone inference may run across EU member states; data at rest stays in the resource geography. Automated abuse review does not store prompts; flagged content can be stored for human review. The current pages specify no fixed retention duration. Modified monitoring requires Microsoft approval. See the official provider sources in clause 5.5.
5. Who receives data and where
5.1 We use Microsoft Azure for the portal and data services; Azure OpenAI in the EU Data Zone; Microsoft 365 and SharePoint for documents and notices; Microsoft Entra External ID in the existing standaclients tenant; Stripe for checkout; QuickBooks for accounting; and HubSpot for limited operational records.
5.2 The portal remains the main service record. HubSpot receives minimal operational information, not questionnaire narratives, generated letters or case evidence. The existing Business Ops Conflict Matters list receives only the minimum party and matter fields listed in clause 6.2.
5.3 Service locations:
- People SQL, storage, Function App, Key Vault, network and logging resources: UK South.
- Static Web Apps: a global edge service.
- Azure OpenAI: EU Data Zone.
- Existing Entra External ID tenant: Europe.
- Microsoft 365/SharePoint, Stripe, QuickBooks and HubSpot: provider location and transfer information is in clause 5.5.
5.4 We do not send case narratives, sensitive case documents, payment data or calendar data to Stripe or QuickBooks.
5.5 Official provider documentation checked on 30 October 2026. These public statements establish provider commitments, not this tenant's actual configuration.
| Provider | Public location and transfer position | Official source |
|---|---|---|
| Microsoft 365 / SharePoint | For a UK-provisioned tenant, core mailbox and SharePoint content has a UK data-at-rest commitment. This does not promise all processing stays in the UK. | Microsoft Product Terms; SharePoint residency |
| Azure OpenAI | EU Data Zone processing can span EU member states; stored data stays in the resource geography. Abuse review may store flagged content for human review; current documentation gives no fixed duration. Modified monitoring needs approval. | Data privacy; Abuse monitoring |
| Stripe | Global processing includes the United States and India. UK transfers to certified Stripe, LLC rely on the UK-US data bridge; SCCs with the UK Addendum are an alternative mechanism. | Stripe privacy; Transfer mechanisms |
| HubSpot | Hosting options: US (Virginia/Oregon), EU (Germany), Canada (Montreal), Australia (Sydney); global access/processing can occur. UK-US data bridge where applicable; SCCs with UK Addendum for restricted transfers. | Hosting; DPA, section 11 |
| Intuit QuickBooks (UK) | Main storage is in the USA; global teams/partners can access data. Intuit Inc. certifies to the UK-US data bridge; other restricted transfers use SCCs with the UK Addendum. | QuickBooks UK location FAQ; Intuit privacy, international transfers |
6. Conflict checking
6.1 Where required, People Services checks the existing Business Ops Conflict Matters list to identify a possible conflict between parties in a matter.
6.2 People writes only a case reference; the client's name and necessary known variants; opposing organisation and individual names and aliases; ServiceLine; open or closed status; and opening or closing date.
6.3 It does not write evidence, advice, correspondence, questionnaire answers, contact details, payment information or sensitive case facts. A failed check or unresolved match is not treated as clearance.
6.4 The lawful basis is in clause 3.2. We do not routinely carry out conflict checks or conflict-register entries for EquHire.
7. How long we keep data
7.1 EquHire service data is kept for two years from case closure. McKenzie Friend case data is kept for seven years from case closure.
7.2 We send one notice 30 calendar days before the relevant retention period ends. The notice does not extend or restart retention.
7.3 Accounting records are kept for seven years from the end of the financial year. Finance data is separate and limited to accounting needs. Accounting retention takes account of the Finance Act 1998 six-year tax-record baseline, Companies Act 2006 section 388 and any longer statutory tax enquiry period.
7.4 Data is held in portal SQL, storage, SharePoint, HubSpot, Stripe, QuickBooks, Conflict Matters, logs and backups. People conflict rows are deleted at the later of the service retention end and three years from closure. Deletion pauses only while a known claim, complaint or court proceeding involving the matter is open; the reason is recorded, reviewed every 12 months and explained in the pre-deletion notice.
8. Your rights and complaints
8.1 You may have rights to ask for access, correction, deletion or restriction, object to processing based on legitimate interests, and receive eligible data in a portable format. Legal conditions and exceptions apply.
8.2 You can make a rights request in the portal (Account > My data) or to hello@standa.co.uk; dpo@konvegroup.com is also listed as the data protection contact on the Standa privacy policy. We respond without undue delay and within the applicable Article 12A UK GDPR period. The ordinary period is one month from the relevant event. Requested identity information, a permitted fee, a necessary extension or a qualifying clarification can affect it. Requests received before 5 February 2026 may need a saved-law check.
8.3 For a qualifying controller complaint received on or after 19 June 2026, DPA 2018 section 164A requires acknowledgement within 30 days, appropriate response steps and an outcome without undue delay. Thirty days is not a universal final-answer deadline.
8.4 You may complain to the Information Commission, the UK regulator. Its former public name was the Information Commissioner's Office (ICO); the statutory naming change took effect on 30 September 2026.
9. Security and changes
9.1 People Services uses separate resources, private client files, least-privilege access and managed identities.
9.2 Sign-in uses a password and emailed code. Phishing-resistant multi-factor authentication is the aim. SMS is not used.
9.3 This notice is for People Services only and does not replace the public website or Business Services notice.
9.4 Changes that affect clients are notified by email and on the portal at least 30 days before they take effect, except changes required by law. The email contains only a secure authenticated portal link.
Official legal sources checked
- UK GDPR Articles 6, 9, 10, 12A and 22A-22D
- Data Protection Act 2018, section 10, Schedule 1 paragraph 33, and section 164A
- Data (Use and Access) Act 2025 commencement and transition, SI 2026/82; Information Commission naming transfer, SI 2026/1015
- DPA 2018 Schedule 1 Part 4, paragraphs 38-41, read with paragraph 33: no appropriate-policy-document requirement is imposed for paragraph 33. Checked in a browser on 30 October 2026.
- Checked on legislation.gov.uk on 30 October 2026.