EnforcerOnline Privacy Notice

This privacy notice explains how Innovis Solutions Limited ("Innovis", "we", "our", "us") collects, uses and protects personal data relating to users of our EnforcerOnline system ("system", "the system") that is hosted at www.enforceronline.net.

Last updated: 6th October 2026

Who we are

Innovis acts as the controller for the personal data we collect to authenticate users, maintain system security and maintain internal audit logs pertaining to users of EnforcerOnline. Your organisation determines which of its staff are granted and revoked access to the system, and we process those account administration instructions on their behalf. For our own internal support team accounts, Innovis acts as the controller across all aspects of user account data.

Company Registration Number: 07047666
Information Commissioners Office
(ICO) Registration Number:		 ZC244928
Registered Office: 22 Kersey Drive, South Croydon, CR2 8SX, England

How to contact us

You can contact us about any data protection matters by emailing privacy@innovissolutions.co.uk.

Lawful basis for processing

Legitimate interests (UK GDPR Article 6(1)(f)) — Your personal data is necessary for granting you secure access to the system for carrying out your role and responsibilities, as contracted by the organisation you work for.

Data that we process about system users

We process user data collected by three different means:

1) Pre-provisioned account information

Your organisation will provide certain information to us when they request a user account for you.

Data collected

  • Full name
  • Work email address
  • Department / role
  • Access rights / permissions

Purpose

Necessary for granting you secure access to the system.

Account Governance

Please note that your organisation (the data controller for your employment or contracting relationship) determines who is granted or revoked access to the system, as well as your assigned permissions. Requests to modify your user role or deactivate an active account must be submitted directly to your organisation's account administrator.

2) Single Sign-On authentication

When you log in using Microsoft or Google ("the identity provider") Single Sign-On (SSO), we receive the below information, which is used to ensure a secure login to the system. Note: We do not transmit or share your personal data with the identity provider during this authentication hand-off.

Data collected

  • Unique SSO user identifier, typically your work email address

Data discarded

Any additional profile fields transmitted by default by Microsoft or Google that are not strictly required for authentication are immediately discarded and are not stored or logged.

Purpose

Required to authenticate your identity and allow you to log in.

3) System usage information

When you interact with the system and with our helpdesk service, the following additional information may be recorded:

Data collected

  1. IP address
  2. Browser/device specifications
  3. Session timestamps
  4. Audit logs of your activity within the system
  5. Email correspondence with our support team

Purpose

(a)-(c) Required to protect system security, detect fraudulent login attempts, and maintain platform stability.
(d) Required for management reporting and oversight
(e) Required to resolve issues and provide guidance

Who we share your data with

We do not sell your personal data. We share user account and technical log data only with trusted service providers who support the delivery of our system:

  • Microsoft 365 / Exchange Online: Used for emailing system notifications.

Where your data is stored & International transfers

Your user account profile data, application data, and technical logs are hosted on server infrastructure owned and managed directly by us, within a secure UK data centre.

We use Microsoft 365 / Exchange Online (provisioned under a UK contract) to send system emails and notifications to users. All email data at rest is stored within Microsoft’s UK data centres. Where malware detection or network routing temporarily processes email traffic outside the UK during transmission, such processing is protected under Microsoft’s enterprise terms. These terms incorporate approved UK data transfer safeguards (specifically the UK Addendum to the EU Standard Contractual Clauses under Section 119A of the Data Protection Act 2018) in accordance with Article 46 of the UK GDPR.

How long we retain your data

User accounts are retained for the duration of your organisation's contract, even when suspended or closed.

Any logs pertaining to your actions on cases will be retained while the case is open and for up to six years after closure, according to your organisation’s agreed requirements.

Any other logs that contain your personal data are retained for 12 months after your account is closed. This is to support audit history and system security. After this period the logs are anonymised or deleted.

Notwithstanding the specific retention periods outlined above, upon the termination or expiry of your organisation’s contract, all user account data and associated logs will be permanently deleted (or anonymised) within 3 months of contract end, unless a longer retention period is required by applicable law.

We retain support emails for the duration of your organisation's contract plus 12 months. Emails containing technical resolution details and troubleshooting insights may be retained indefinitely for internal knowledge bases and product improvement; however, all personal data is stripped or anonymised prior to long-term storage.

Your statutory rights

Under UK data protection law, as a user of the system, you have the following rights regarding your account data:

  • Right of Access: The right to request a copy of the personal data we hold about you (a Subject Access Request).
  • Right to Rectification: The right to ask us to correct inaccurate or incomplete information.
  • Right to Erasure ("Right to be Forgotten"): The right to request that we delete your user profile data and/or associated audit logs.
  • Right to Restrict or Object: The right to object to or restrict our processing of your personal data under certain conditions.

These rights are not absolute and may be subject to exemptions or other limitations under data protection law.

To exercise any of these rights, please contact us at privacy@innovissolutions.co.uk.

Please note that, for users from our client organisations (as opposed to our internal support staff), certain data is maintained on behalf of your organisation to preserve business and legal records. This includes your account profile itself and audit logs that your organisation uses for management oversight of user activity within the system. Consequently, we may need to coordinate with your account administrator before processing account modification or deletion requests.

Client Data

Our role as data processor

Our system allows our clients to upload, manage, and process personal data associated with enforcement cases ("Client Data"). In this context, Client Data does not include user accounts for the system.

Where Client Data contains personal information regarding third parties, Innovis Solutions Limited acts strictly as a data processor. Our client is the data controller.

Processing Instructions

We process Client Data solely in accordance with our client's written instructions, our terms of service, and our Data Protection and Privacy Policy.

Third-Party Rights

If you are an individual whose personal data is hosted within the system and wish to exercise your data protection rights (such as access or deletion), please contact the organisation that entered your details into the system directly.

How to complain to the ICO

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK data protection regulator:

Information Commissioner's Office (ICO)
Helpline: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/