Privacy Policy

Last updated: 17 August 2026

1. Who we are

Epody is a trading name of Qivo Innovation Limited, a private limited company registered in England and Wales under company number 16795234.

Our registered office is:

71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom

For the purposes of UK data protection law, Qivo Innovation Limited is the data controller responsible for the personal information described in this Privacy Policy.

In this policy, “Epody”, “we”, “us” and “our” refer to Qivo Innovation Limited trading as Epody.

You can contact us about privacy or data protection matters at:

Email: hello@epody.co.uk

Website: www.epody.co.uk

2. About this policy

This Privacy Policy explains how we collect, use, store and protect personal information when you:

Visit epody.co.uk
Contact us or request a catalogue review
Ask for a demonstration
Become an Epody customer
Use the Epody customer portal
Communicate with us by email, telephone or another channel
Provide product information, files or other materials for us to work on
Subscribe to marketing communications

We process personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, as amended from time to time.

3. Information we collect

Depending on how you interact with Epody, we may collect the following information.

Identity and contact information

This may include your:

Name
Job title
Business name
Business address
Email address
Telephone number

Enquiry and communication information

This includes information you provide when you:

Complete a contact, catalogue review or demonstration form
Email or telephone us
Send us a message
Request support
Respond to a survey or provide feedback

We may keep copies of correspondence and notes relating to our conversations with you.

Customer and service information

If you become a customer, we may collect:

Information about the services you purchase
Contract and subscription details
Project instructions
Brand and content requirements
Product catalogue information
Platform and integration requirements
Approval and revision history
Customer support records
Information about your use of the Epody portal

Portal account information

If you are given access to the Epody portal, we may process:

Your name and business email address
Your organisation and account role
Login and authentication information
Files, links and instructions you upload
Product selections and approval decisions
Messages and support requests
Account activity and security logs

Passwords are stored in protected form by our authentication provider. We do not have access to your original password.

Billing and transaction information

This may include:

Business and billing addresses
Invoice information
Payment status
Subscription and transaction records
Tax and accounting information

If card payments are available, full payment card details are processed securely by our payment provider. Epody does not store complete payment card details.

Technical and website usage information

When you use our website or portal, we may collect:

Internet Protocol address
Browser type and version
Device and operating system
Approximate location derived from your IP address
Referring website
Pages visited
Actions taken on the website
Date, time and duration of visits
Cookie and consent preferences
Portal security and activity logs

Where required, analytics information is only collected after you provide consent through our cookie controls.

Marketing information

We may record:

Whether you have agreed to receive marketing
Your communication preferences
Which Epody communications you open or interact with
When you unsubscribe or object to marketing

Customer-provided content

Customers may provide spreadsheets, platform exports, supplier files, PDFs, images, videos, product URLs, manufacturer information and other source materials.

Most product information is not personal information. However, uploaded materials may occasionally contain business contact details or other information relating to identifiable people. Customers should avoid including unnecessary personal or sensitive information in materials supplied to Epody.

4. How we obtain information

We may receive personal information:

Directly from you
From someone within your organisation
Through forms on our website
Through the Epody customer portal
Through email, telephone calls or meetings
From our payment, website, analytics and technical service providers
From referrals and professional contacts
From publicly accessible business sources, such as company websites, professional profiles and public registers
From product manufacturers, distributors, suppliers and publicly available product resources when carrying out agreed research

If we obtain your business contact information from another source and use it to contact you, we will provide access to this Privacy Policy when we first communicate with you, unless an applicable legal exception applies.

5. How and why we use your information

We only use personal information when we have a valid reason and lawful basis for doing so.

To respond to enquiries

We use your contact and enquiry information to respond to questions, arrange demonstrations, conduct catalogue reviews and discuss potential services.

Our lawful basis is taking steps at your request before entering into a contract and our legitimate interest in responding to business enquiries.

To provide Epody services

We use customer, project and account information to:

Deliver product-content and catalogue-management services
Research and enrich product information
Manage projects and customer accounts
Provide access to the customer portal
Present work for review and approval
Deliver files, exports and platform updates
Provide support
Manage subscriptions, renewals and service changes

Our lawful basis is performing our contract with you. Where the contract is with your organisation rather than you personally, we rely on our legitimate interest in administering that business relationship.

To manage billing and business records

We use billing and transaction information to issue invoices, process payments, maintain financial records and meet our legal, tax and accounting obligations.

Our lawful bases are performing our contract and complying with legal obligations.

To operate and secure our website and portal

We use technical and activity information to:

Operate our website and customer portal
Authenticate users
Maintain system security
Prevent fraud and unauthorised access
Diagnose technical problems
Maintain backups
Investigate suspected misuse

Our lawful basis is our legitimate interest in providing reliable and secure services.

To improve Epody

We may use feedback, aggregated service information and consented analytics data to understand how people use Epody and improve our website, portal, services and customer experience.

Our lawful bases are consent for non-essential analytics and our legitimate interest in improving our services using aggregated or non-identifying information.

To send service communications

We may send confirmations, project updates, approval notifications, invoices, security messages, policy updates and other communications necessary to manage your account or provide our services.

Our lawful bases are performing our contract, complying with legal obligations and our legitimate interest in administering our services.

To send marketing communications

We may send information about Epody services, features, events or useful product-content resources where:

You have asked to receive them
You have provided consent
The law permits us to contact you based on an existing business relationship
We have a legitimate interest in contacting a relevant business representative and electronic marketing rules permit it

You can unsubscribe at any time using the link in a marketing email or by contacting hello@epody.co.uk.

Unsubscribing from marketing will not prevent us from sending essential service or account communications.

To establish or defend legal rights

We may use relevant information to enforce agreements, recover money owed, resolve disputes, investigate complaints and establish, exercise or defend legal claims.

Our lawful bases are our legitimate interests and compliance with legal obligations.

6. When Epody processes information for customers

When Epody processes personal information contained within customer files, catalogues, accounts or connected systems solely on a customer’s instructions, the customer will normally be the data controller and Qivo Innovation Limited will act as its data processor.

In these circumstances:

The customer is responsible for deciding why the information is processed
The customer is responsible for ensuring it has a lawful basis
We process the information only to provide the agreed services and in accordance with the customer’s documented instructions
Our processing will also be governed by the relevant contract or data processing agreement

Questions about personal information controlled by an Epody customer should normally be directed to that customer first.

7. Our lawful bases

Depending on the circumstances, we rely on one or more of the following lawful bases:

Contract: processing is necessary to enter into or perform a contract
Legal obligation: processing is necessary to comply with the law
Legitimate interests: processing is necessary for our legitimate business interests or those of another party, provided those interests do not override your rights
Consent: you have given us clear permission for a particular use, such as non-essential analytics cookies or certain marketing communications

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

8. If you do not provide information

Some information is required so that we can respond to an enquiry, set up an account, enter into a contract or provide our services.

If you do not provide information that is reasonably required, we may be unable to:

Respond fully to your request
Provide an accurate proposal
Enter into or perform a contract
Create your portal account
Deliver some or all of the requested services

We will explain when information is required rather than optional.

9. Who we share information with

We do not sell or rent personal information.

Where necessary, we may share information with trusted providers that support our business, including:

Website hosting and website-platform providers
Customer portal, database and authentication providers
Cloud hosting and file-storage providers
Email and communication providers
Analytics providers
Payment processors and financial service providers
Accountants, legal advisers, insurers and other professional advisers
Technical contractors and support providers
Ecommerce platforms and integration providers where requested by the customer
Public authorities, regulators, courts or law-enforcement bodies where required by law

These providers may only use personal information for the agreed purpose and must protect it appropriately.

We may also disclose information in connection with a business sale, restructuring, merger or acquisition. Where appropriate, we will require the recipient to respect this Privacy Policy and applicable data protection law.

10. International transfers

Some of our service providers may store or access information outside the United Kingdom.

Where personal information is transferred outside the UK, we take steps to ensure it receives an appropriate level of protection. Depending on the destination and provider, this may include:

Relying on UK adequacy regulations
Using the UK International Data Transfer Agreement
Using the UK Addendum to approved international data-transfer clauses
Completing required transfer risk assessments
Applying additional contractual, organisational or technical safeguards

You can contact us if you would like further information about the safeguards used for a particular transfer.

11. How long we keep information

We only keep personal information for as long as it is reasonably required for the purpose for which it was collected.

Our usual retention periods are:

General enquiries: normally up to 24 months after our last meaningful communication
Customer, contract and project records: normally for the duration of the relationship and up to six years afterwards
Invoices, payments and accounting records: normally six years after the end of the relevant financial year
Portal accounts and operational project data: normally for the duration of the service and up to 90 days after closure, unless a longer period is required for contractual, backup, security or legal reasons
Support and service communications: normally for the duration of the relationship and up to six years where they form part of the contractual record
Marketing information: until you unsubscribe, object or the information is no longer relevant
Marketing suppression records: for as long as reasonably necessary to ensure we continue to respect your opt-out
Website analytics data: normally for no longer than 14 months, subject to the settings of the analytics service
Security logs: for a limited period appropriate to investigating security events and protecting our systems

We may keep information for longer where required by law, necessary to resolve a dispute or needed to establish, exercise or defend a legal claim.

When information is no longer required, we delete it, anonymise it or securely restrict further use.

12. Cookies and analytics

Our website uses cookies and similar technologies.

Cookies are small files placed on your device. They may be used to:

Make the website function correctly
Maintain security
Remember preferences
Understand how the website is used
Measure the performance of our content

Essential cookies

Essential cookies are required for the website to operate, maintain security or remember your privacy choices. These cookies do not require consent.

Analytics cookies

With your consent, we use Google Analytics to understand how visitors use our website. This may include information about pages visited, approximate location, device, browser and interactions with the website.

Google may process information on our behalf in accordance with its own privacy terms:

Google Privacy Policy

Google Analytics Terms

Analytics cookies should not be placed unless you choose to accept them through our cookie controls.

You can accept or reject non-essential cookies through the cookie banner and change your preferences using the cookie settings available on our website.

You can also delete or block cookies using your browser settings. Blocking essential cookies may affect how parts of the website operate.

13. Data security

We use appropriate technical and organisational measures designed to protect personal information against:

Unauthorised access
Accidental loss
Misuse
Alteration
Disclosure
Destruction

These measures may include access controls, authentication, encryption, secure service providers, backups, system monitoring and limiting access to people who need the information for their work.

No internet-based service can be guaranteed to be completely secure. If we become aware of a personal data breach, we will investigate it and notify affected individuals and the Information Commissioner’s Office where required by law.

14. Your data protection rights

Depending on the circumstances, you may have the right to:

Ask whether we process your personal information
Request access to your personal information
Ask us to correct inaccurate or incomplete information
Ask us to delete personal information
Ask us to restrict how information is used
Object to processing based on legitimate interests
Object to direct marketing at any time
Request the transfer of information you provided to us in a portable format
Withdraw consent where processing is based on consent
Complain to the Information Commissioner’s Office

These rights are not absolute and may be subject to legal conditions or exemptions.

To exercise a right, contact hello@epody.co.uk. We may need to confirm your identity before responding.

We normally respond to valid requests within one month. We will tell you if the request is particularly complex or if we are legally permitted to take longer.

15. Automated decision-making

We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects.

We may use AI-assisted tools as part of our product-content workflows, but Epody’s managed service includes human oversight and quality assurance. These tools are not used to make significant automated decisions about individuals.

16. Children

Epody provides business-to-business services and is not intended for children.

We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact hello@epody.co.uk so that we can investigate and delete it where appropriate.

17. Third-party websites

Our website may contain links to websites operated by other organisations, including ecommerce platforms, manufacturers and demonstration stores.

We are not responsible for the privacy practices of independent third-party websites. You should review the privacy information provided by those websites before submitting personal information.

18. Complaints

If you have a concern about how we use personal information, please contact us first so that we can investigate:

hello@epody.co.uk

You also have the right to complain to the UK Information Commissioner’s Office.

Information Commissioner’s Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Telephone: 0303 123 1113

Website: www.ico.org.uk/make-a-complaint

19. Changes to this policy

We may update this Privacy Policy when our services, systems or legal obligations change.

The latest version will always be published on this page. If a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected individuals before the new use begins.

20. Contact us

If you have questions about this Privacy Policy or how we handle personal information, contact:

Qivo Innovation Limited trading as Epody