Overview

Governli provides automated vendor risk assessments for IT and SaaS procurement. This Privacy Policy describes how we collect, use and protect information when you use the service.

Information we process

We process account and billing information (name, email, company details, billing country and any VAT/tax identifier you provide) and the vendor documentation you choose to upload for assessment. Documents are processed solely to produce the assessment report you request.

Controller and processor roles

Governli is the data controller for account, billing and business-relationship data (for example your user account, company profile and purchase records). For the assessment content a customer uploads — which may include supplier information and personal data about supplier contacts — the customer is the data controller and Governli acts as a data processor under our Data Processing Agreement. Supplier contacts whose details appear in assessments may exercise their rights through the customer or by contacting us directly.

Sub-processors and international transfers

We rely on a small set of sub-processors for hosting, database, payments, email, error monitoring and AI analysis — each listed with its purpose and processing region on the Sub-processors page. Where a sub-processor processes personal data outside the EU/EEA, transfers rely on an appropriate safeguard such as the European Commission's Standard Contractual Clauses, as described in the DPA. This policy applies to customers worldwide; where the GDPR applies we honour it in full, and we extend the same care to all customers regardless of location.

Data storage and residency

Primary database and file storage are hosted within the EU, within approved environments designed to support European regulatory requirements. Some sub-processors — including the AI analysis path — process data outside the EU/EEA as described above and on the Sub-processors page.

AI model training

Customer documents and uploaded information are never used to train AI models.

Security measures

We apply technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, audit logging and least-privilege processing. Customer documents are processed only to deliver the requested assessment.

Retention and deletion

Customer workspace data — uploaded documents, assessments, evidence and reports — is retained while the account is active and is deleted no later than 90 days after the customer account is terminated.

Governli does not currently offer customer-configurable retention periods. A verified customer deletion request may result in earlier deletion where legally and technically appropriate.

Records Governli must keep for legal, accounting, payment, fraud-prevention, security, audit or dispute purposes are retained separately for the required or legitimate period.

Deleted production data ages out of backups according to the applicable backup retention lifecycle; historical backups are not individually rewritten.

Your rights and how to exercise them

You may request access to, correction of, export of, or deletion of your personal data. Send the request from the email address associated with your Governli account to info@governli.com, or use our contact page.

We verify that the request comes from the account holder before acting on it, confirm the scope with you in writing, and record the handling so it can be audited afterwards. We respond within one month.

Two different roles matter here. For your own account and contact data, Governli is the controller and handles the request directly. For documents and assessment content inside a customer workspace, the customer organisation is the controller and Governli acts on its instructions — if you are a supplier or workspace member, we will refer your request to that organisation and support them in answering it. This prevents one user from deleting another organisation's records.

Contact

For privacy questions, please see our contact page or email info@governli.com.