Davion Haven Global Privacy & Data Protection Policy
This comprehensive Privacy and Data Protection Policy governs how Davion Haven Inc. ("Davion Haven", "we", "us", or "our") collects, processes, isolates, encrypts, and retains personal data, workforce metrics, settlement financial details, and enterprise AI training datasets across all registered Clients, AI Data Annotators, and Referral Partners.
Scope, Architectural Role & Legal Controllership
Davion Haven operates as a secure global infrastructure connecting enterprise AI developers ("Clients"), specialized data annotators and RLHF domain specialists ("Annotators"), and commercial growth partners ("Referral Partners"). Depending on the nature of data processed:
We act as the Data Controller for registered user profile credentials, KYC identification files, banking and payout disbursement accounts, performance reputation metrics, and telemetry generated directly on the Davion Haven platform.
We act as the Data Processor (or Sub-Processor) regarding Client-provided raw AI datasets, bounding box coordinates, reinforcement learning human feedback (RLHF) prompts, and domain-specific labeling payloads processed under executed Client MSAs and Statements of Work.
This policy has been designed to meet and exceed the legal mandates of the European Union General Data Protection Regulation (GDPR - Regulation EU 2016/679), the United Kingdom Data Protection Act 2018 (UK GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA - Cal. Civ. Code § 1798.100 et seq.), the Nigeria Data Protection Act 2023 (NDPA), and international cross-border transfer standards.
Multi-Role Data Collection Taxonomy
We adhere to strict data minimization principles under Art. 5(1)(c) GDPR. We only collect information strictly necessary to authenticate users, facilitate contracted data workflows, process weekly financial settlements, and maintain cryptographic audit trails:
- Corporate Identity: Legal entity name, tax registration number / VAT ID, business registered address, authorized representative contact information.
- Billing & Deposit Credentials: Enterprise billing address, authorized cardholder or bank wire identifiers (processed directly via PCI-DSS Level 1 compliant settlement gateways; Davion Haven never stores raw CVV numbers).
- Dataset Specifications: Annotation schema requirements, taxonomy guidelines, quality threshold benchmarks, and access credentials to designated client cloud buckets.
- Identity & KYC Verification: Legal name, government-issued photo identification (passport, national ID, or driver's license), proof of residency, and tax declaration status.
- Workforce Profile & Capabilities: Language proficiencies, academic credentials, specialized domain expertise (e.g. medical, legal, coding, linguistics), and Davion Haven Academy assessment certifications.
- Work Telemetry & Quality Logs: Timestamps of tasks completed, benchmark evaluation scores, audit review outcomes, platform interaction latency, and aggregate weekly verified productive hours.
- Settlement Banking Accounts: Local and international bank account details, IBAN/SWIFT identifiers, account beneficiary verification, and digital wallet payment coordinates required for automated Thursday payouts.
- Partner Profile: Legal entity or individual name, email address, promotional platform channels, and generated cryptographic referral code (e.g.,
DAVION-REF-XXXX). - Attribution Telemetry: Aggregated referral click counts, qualifying client onboarding conversions, cumulative contract value tracking, and vested recurring 5% commission balances.
- Payout Disbursement Channels: Verified banking rails for automated Thursday commission disbursements.
Lawful Bases for Processing (GDPR & International Standard)
We only process your personal data where a clear legal basis exists under applicable data protection laws:
| Processing Activity | Lawful Basis (GDPR Art. 6) | Purpose & Implementation |
|---|---|---|
| Account Provisioning & Work Dispatch | Art. 6(1)(b) - Contractual Necessity | Executing our agreement to provide marketplace services, match annotators to projects, and provide dashboard access. |
| Thursday Earnings & Payout Disbursements | Art. 6(1)(b) & (c) - Contract & Legal Obligation | Calculating 100% financial allocations, processing automated wire/gateway disbursements, and issuing tax receipts. |
| Automated QA Audits & Anti-Botting | Art. 6(1)(f) - Legitimate Interests | Preventing synthetic bot generation, validating human verification, and protecting dataset integrity for clients. |
| AML / KYC Identity Verification | Art. 6(1)(c) - Compliance with Legal Obligation | Complying with statutory anti-money laundering, international sanction screening, and financial integrity laws. |
| Optional Academy Certification Badging | Art. 6(1)(a) - Explicit User Consent | Publishing verified capability badges and domain specialization credentials on the public workforce directory. |
Enterprise AI Dataset Protection & Strict Sandboxing
Davion Haven enforces enterprise-grade security protocols to protect the confidential nature and proprietary intellectual property embedded within Client AI datasets:
Davion Haven guarantees that raw customer datasets, prompts, labels, grounding images, video streams, audio recordings, or completed annotations provided by Clients or produced by Annotators are NEVER used, ingested, or processed to train, fine-tune, evaluate, or benchmark any internal foundation model or proprietary algorithm belonging to Davion Haven without explicit, separate written authorization.
Annotators work strictly inside tokenized, ephemeral sandboxes. Annotators never receive bulk database downloads or unauthorized export capabilities.
Automated anonymization pipelines strip names, IP addresses, credit card numbers, and geographic coordinates before payloads enter annotation queues.
Local browser cache, canvas buffers, and pre-signed S3 links expire immediately upon batch submission or after 60 minutes of inactivity.
Financial & Settlement Data Encryption Architecture
Because Davion Haven executes automated Thursday weekly disbursements to annotators and referral partners globally, the integrity and confidentiality of banking data is paramount:
- Encryption at Rest: All banking routing numbers, account numbers, SWIFT/BIC codes, and tax identification numbers are encrypted at the database row level using hardware-accelerated AES-256 encryption with envelope key rotation managed via AWS Key Management Service (KMS).
- Encryption in Transit: All communications between user browsers, the Davion Haven API servers, and banking partners are strictly enforced over TLS 1.3 with Perfect Forward Secrecy (PFS).
- Zero Plaintext Storage of Payment Cards: Client credit card details are tokenized directly via PCI-DSS Level 1 certified partners (Stripe / Flutterwave / Paystack). Davion Haven servers never touch or store raw card primary account numbers (PANs) or security codes (CVVs).
- Strict RBAC & Audit Trails: Access to settlement disbursement tables is restricted to automated disbursement microservices and verified compliance officers via multi-factor authentication and immutable logging.
Authorized Third-Party Sub-Processors
Davion Haven engages carefully vetted third-party service providers ("Sub-Processors") to deliver cloud infrastructure, database hosting, settlement payouts, and identity verification. All sub-processors undergo rigorous security due diligence and are bound by formal Data Processing Agreements (DPAs) incorporating Standard Contractual Clauses (SCCs):
| Sub-Processor | Core Purpose | Hosting Jurisdiction | Safeguards & Certifications |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud Compute, S3 Encrypted Storage & KMS | US / EU (Frankfurt / Dublin) | SOC 2 Type II, ISO 27001, GDPR SCCs |
| Supabase / PostgreSQL | Relational Application Database & Auth | US / EU Data Regions | SOC 2 Type II, Row Level Security (RLS) |
| Stripe & Flutterwave | Client Deposits & Global Banking Payout Rails | Global / Multi-Region | PCI-DSS Level 1, Central Bank Regulated |
| Cloudflare Inc. | Edge WAF, DDoS Mitigation & DNS Security | Global Edge Network | ISO 27001, SOC 2 Type II |
| Postmark / Resend | Transactional Email & Security Alerts | United States / EU | GDPR DPA with SCCs, Zero Log Ingestion |
Cross-Border Data Transfers & International Safeguards
Davion Haven serves a distributed international community. Whenever personal data or project assets originating in the European Economic Area (EEA), United Kingdom, Switzerland, or Nigeria are transferred across borders:
- We execute Standard Contractual Clauses (SCCs) adopted by the European Commission (Implementing Decision (EU) 2021/914) with all international partners and cloud nodes.
- We conduct documented Transfer Impact Assessments (TIAs) to verify that local jurisdictional surveillance laws do not impinge upon the safeguards provided by the GDPR.
- Enterprise Data Residency: Enterprise Clients may request dedicated data pinning in specific jurisdictions (e.g., EU-only Frankfurt cluster or US-East AWS GovCloud partitions).
Data Retention, Archival & Automatic Purge Schedules
We retain personal and project data only as long as necessary to fulfill contractual commitments, resolve disputes, and comply with mandatory statutory retention limits:
Raw source files and working annotation queues are automatically purged from Davion Haven temporary staging servers thirty (30) calendar days after final client acceptance sign-off.
Disbursement histories, commission statements, and transaction ledgers are retained for seven (7) years to satisfy mandatory commercial tax and Anti-Money Laundering (AML) statutory audits.
Benchmarking scores, academy certificates, and accuracy metrics are maintained for 24 months after account dormancy to allow seamless reinstatement and credential verification.
IP access logs, authentication attempts, and firewall interaction logs are retained for 180 days before undergoing automated rolling deletion.
Data Subject Rights (DSAR) & User Control Hub
Under GDPR (Articles 15-22), CCPA/CPRA, and the Nigeria Data Protection Act, you possess clear, enforceable rights regarding your personal information:
Send an email from your registered account to privacy@davionhaven.com with subject line "DSAR Request". We verify and fulfill all requests within 30 days free of charge.
Cookies, Local Storage & Telemetry Transparency
Davion Haven uses strictly necessary cookies and local storage items to maintain session state, authenticate API requests, and safeguard against Cross-Site Request Forgery (CSRF):
- Essential Authentication Tokens: Secure HTTP-only JWTs storing your authenticated role credentials and workspace permissions.
- Security & Anti-Bot Tokens: Cloudflare Turnstile tokens to protect login forms from automated brute-force attacks without user friction.
- Workspace Preferences: Local storage flags for sidebar collapse state, theme preferences, and active dashboard tab selection.
- No Invasive Third-Party Tracking: We do not deploy third-party advertising tracking pixels, cross-app beacons, or data broker scripts on the Davion Haven platform.
Security Incident Management & 72-Hour SLA
In the highly improbable event of a security incident or confirmed breach affecting personal data or customer dataset sandboxes:
Davion Haven maintains a binding commitment under Article 33 GDPR to notify competent supervisory authorities (and affected Clients and Users without undue delay) within seventy-two (72) hours of becoming aware of any personal data breach presenting a risk to user rights. The notification will describe the nature of the breach, affected data categories, estimated user volume, and immediate containment measures taken.
Data Protection Officer (DPO) & Regulatory Recourse
Davion Haven has appointed a designated Data Protection Officer (DPO) to oversee privacy compliance and handle inquiries from users and data protection authorities globally.
Officer: Office of the Data Protection Officer
Email: dpo@davionhaven.com
General Privacy: privacy@davionhaven.com
Corporate Address: Davion Haven Inc., Legal & Privacy Operations, 100 Innovation Way, Suite 400.
If you believe your personal data has been processed in violation of applicable laws and we have not resolved your concern adequately, you retain the right to lodge a formal complaint with your local supervisory authority (such as the UK ICO, French CNIL, Irish DPC, California Privacy Protection Agency, or the Nigeria Data Protection Commission - NDPC).
SHA256:8f4c...91b2