Skip to main content

    Privacy Policy

    Theodora Monye (Theodora AI Advisory)

    Effective date: 9 November 2026

    Who we are

    The data controller is: Theodora Monye (trading as Theodora AI Advisory)

    Email: theo@theodoramonye.com

    Website: theodoramonye.com

    ICO Registration Number: ZC132519.

    If you have any questions about this policy or how we process your personal data, contact theo@theodoramonye.com. If you remain unhappy with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

    Overview

    This Privacy Policy explains how we collect, use, share and protect personal data when you use theodoramonye.com, contact us via the website contact form, download resources, or otherwise engage with Theodora AI Advisory or access the Theodora AI Advisory Governance Hub client portal at www.theodoramonye.com/hub. The policy also sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

    Personal data we collect and why

    We only collect personal data necessary for the purposes set out below.

    Contact form enquiries

    • Data collected: name, email address, city, any message content you submit.
    • Purpose: to respond to enquiries, arrange calls or meetings, and to manage potential client relationships.
    • Lawful basis: legitimate interests (to respond to enquiries and manage client relationships). Where you provide special categories of data or otherwise request us to act in a way requiring consent, we will obtain your consent.
    • Retention: retained for up to 12 months after last contact unless you become a client, in which case client records are retained for statutory accounting/tax periods.

    AI Oversight Readiness Check

    The check runs entirely in your browser. Your answers and results are not stored or sent to us. If you tick “Include my results with my request” and submit our intake form, we receive a short summary with your request: whether your organisation has a formal board, your overall rating and your weakest areas. Your individual answers are never sent. The summary is handled in the same way as the rest of your intake request.

    Resource downloads (downloads modal)

    • Data collected: name, work email address, resource requested, timestamp.
    • Purpose: to send the requested resource and, where you have consented, to send occasional relevant updates and communications about resources and events.
    • Lawful basis: consent for marketing communications; delivery of the resource is by consent or contract performance as applicable.
    • Retention: contact details and consent record retained for up to 24 months unless you withdraw consent earlier.

    HubSpot CRM, tracking and analytics related to contacts

    • Data collected: contact form and download data stored in HubSpot, IP address, cookies and interaction logs as permitted, CRM contact records, and any notes from communications.
    • Purpose: to manage contacts, track interactions (e.g., pages visited, resources downloaded), personalise communications and improve services.
    • Lawful basis: legitimate interests for CRM administration and relationship management; consent for marketing and non‑essential tracking cookies.
    • Retention: HubSpot records retained for up to 24 months unless you request deletion earlier.
    • Third parties and transfers: HubSpot is a US company with EU/UK processing infrastructure. Where data is transferred outside the UK/EEA, we rely on adequacy decisions or Standard Contractual Clauses (SCCs) and appropriate safeguards. See "Third parties" below.

    Website analytics

    • Data collected: aggregated and pseudonymised analytics data (page views, session duration, device metadata). Where cookies store identifiers, these may be processed prior to anonymisation.
    • Purpose: to understand how users use the website and to improve content and functionality.
    • Lawful basis: consent for analytics cookies where required.
    • Retention: aggregated analytics retained for up to 26 months; identifiers removed/anonymised in line with provider settings.

    Chatbot interactions

    We do not currently operate a chatbot. If chat functionality is introduced in future, this policy will be updated before any such processing begins, and appropriate consent mechanisms will be implemented.

    Mailing list and marketing communications

    • Data collected: name and work email (from downloads or sign‑ups).
    • Purpose: to send occasional newsletters, event notices and updates on AI governance resources.
    • Lawful basis: consent. We will only send marketing emails where you have opted in. You may withdraw consent at any time.
    • Retention: marketing lists retained for up to 24 months unless you withdraw consent.

    Cookies and similar technologies

    Our website uses cookies and similar tracking technologies. We use HubSpot tracking scripts and other analytics cookies. Categories:

    • Strictly necessary cookies: required for site functionality and cannot be disabled.
    • Analytics & performance cookies: used to measure site usage and improve performance (e.g., Google Analytics). These require your consent.
    • CRM/tracking cookies (HubSpot): used to identify returning visitors and personalise content; these require your consent.
    • Functional cookies: used for site preferences and other non-essential features; these require consent if they are not strictly necessary.

    You can control cookies via the cookie banner on our site, via cookie preference settings, or by changing your browser settings. Disabling certain cookies may affect site functionality. For guidance on managing cookies in your browser visit aboutcookies.org. For full details see our Cookie Policy.

    Third parties and processors

    We use the following third‑party service providers to process personal data on our behalf:

    • HubSpot (CRM and analytics) — hubspot.com/legal/privacy-policy
    • Google (Google Analytics and related services) — policies.google.com/technologies/partner-sites
    • Google Workspace (email) — workspace.google.com/security
    • Lovable (website and client portal frontend hosting) — lovable.dev/data-processing-agreement. Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. Data is processed under the Business plan Data Processing Agreement, which incorporates the 2021 EU Standard Contractual Clauses and the UK ICO International Data Transfer Addendum (Version B1.0). Some sub-processors are US-based; current sub-processor list available at trust.lovable.dev. Customer data is not used for model training or product development.
    • Supabase (client portal database and file storage) — supabase.com/privacy. Data is stored in the EU (Ireland) region. Supabase processes client portal data including names, contact details, job roles, organisation names, diagnostic tool results, document download records, and maturity assessment data on our behalf. Appropriate data processing agreements and transfer safeguards are in place.

    We have written data processing agreements with our processors and appropriate safeguards for any international data transfers (e.g., SCCs or adequacy where applicable). Contact theo@theodoramonye.com for details or to request copies of relevant safeguards.

    Client portal processing

    Contracted clients of Theodora AI Advisory are provided access to a private Governance Hub portal at www.theodoramonye.com/hub. The portal is hosted on Lovable and uses Supabase for data storage. Personal data processed through the portal includes: name, job role, organisation name, telephone number, email address, diagnostic tool inputs and outputs, document download records, and AI governance maturity assessment data. This data is processed on the basis of contract performance (Article 6(1)(b) UK GDPR and EU GDPR) and is retained for the duration of the client engagement and for statutory accounting and tax periods thereafter. Clients may request access to, correction of, or deletion of their portal data by contacting theo@theodoramonye.com. The portal is invitation-only and no data is collected from non-contracted individuals through this channel.

    Legal obligations and disclosure

    We may disclose personal data where required by law, court order or regulatory request, or to protect rights, property or safety. Where possible and permitted, we will notify you before disclosure.

    Your rights

    Under UK GDPR you have rights in relation to your personal data:

    • Access: request a copy of personal data we hold about you.
    • Rectification: ask us to correct inaccurate or incomplete data.
    • Erasure: request deletion (subject to legal and contractual retention requirements).
    • Restriction: ask us to limit how we use your data.
    • Portability: request a machine‑readable copy of your data for transfer to another controller.
    • Object: object to certain processing (e.g., direct marketing or processing based on legitimate interests).
    • Withdraw consent: where we rely on consent you can withdraw it at any time; withdrawal does not affect processing prior to withdrawal.

    To exercise any right, email theo@theodoramonye.com. We may ask for proof of identity. We will respond within one month of receipt (this may be extended by up to two months for complex requests, and we will notify you if an extension is necessary). If you remain unsatisfied you can complain to the ICO at ico.org.uk.

    Security and data retention

    We take appropriate technical and organisational measures to protect personal data, proportionate to the risk and nature of the processing. These measures include TLS encryption for data in transit, access controls and unique user accounts for systems, password policies, and regular backups. Only authorised personnel have access to personal data and we limit access to what is necessary.

    Records and retention

    We retain personal data only for as long as necessary for the purposes set out in this policy, or to comply with legal obligations. Specific retention periods are set out above.

    Children and special categories of data

    Our site and services are not intended for children under 16. Do not submit special category data (e.g., health data, racial or ethnic origin, political opinions) via the website contact form. If you provide such data to us, we will only process it where we have a lawful basis and explicit consent or another lawful ground.

    Automated decision‑making

    We do not use automated decision‑making that produces legal or similarly significant effects for individuals. The interactive diagnostic tools on this website generate indicative screening outputs based on user‑submitted information. These outputs do not constitute automated decision‑making within the meaning of Article 22 of the UK GDPR as they do not produce decisions with legal or similarly significant effects on individuals. If this changes we will notify you and explain the logic, significance and safeguards involved.

    Changes to this policy

    We may update this Privacy Policy from time to time. The "Effective date" at the top shows the current version. We will publish changes on the website and, where appropriate, notify registered contacts.

    Contact and further information

    If you have questions about this policy, wish to exercise your rights, or want a copy of the data processing safeguards, contact: theo@theodoramonye.com

    ← Back to home