Privacy policy

1. Who we are

VectisFlow Limited is a data intelligence consultancy registered in England and Wales, company number 14990157. For personal data collected through this website we are the data controller.

For anything in this notice, or to exercise any of the rights described in section 8, contact hello@vectisflow.com.

We have not appointed a Data Protection Officer. On the processing described here we are not a public authority, we do not monitor individuals on a large scale, and we do not process special category data at scale, so the conditions in Article 37 are not met. We keep that assessment under review as the business grows.

2. What we collect

Only what we need in order to reply to you and to keep the site working. We do not buy personal data, we do not enrich what you give us from third-party sources, and we do not build profiles.

• Enquiry data: the name, email address and message you submit through the contact form, plus organisation and role if you choose to give them. Those two fields are optional and marked as such.
• Consent data: your cookie choices and the date you made them, stored in your browser's local storage under the key bc-consent-v1. This never leaves your device unless you submit an enquiry.
• Technical data: IP address, user agent and requested URL, recorded in our hosting provider's server logs and used only to keep the site available and secure.
• Analytics data: none. No analytics or advertising product is installed on this site. If that changes, this notice and the cookie policy will be updated before it goes live, and analytics will remain off until you consent.

3. Why we use it, and our lawful basis

Under Article 6 of the UK GDPR we rely on the following:

• Replying to your enquiry: legitimate interests, Article 6(1)(f). Our interest is in responding to someone who has approached us about our services. The processing is what you would expect, it is minimal, and it is easy to object to. A legitimate interests assessment supporting this is retained and available on request.
• Keeping a record of enquiries that become engagements: necessary for the performance of a contract, Article 6(1)(b), and thereafter legal obligation, Article 6(1)(c), for accounting records.
• Keeping the site secure and available: legitimate interests, Article 6(1)(f), covering server logs and abuse prevention.
• Any future analytics: consent, Article 6(1)(a), withdrawable at any time through the cookie controls.

4. Who we share it with

We do not sell personal data, and we do not share it for advertising or profiling under any circumstances.

Enquiry data reaches two categories of processor, each engaged under a written data processing agreement: the provider that hosts this site and retains its server logs, and the provider that carries our email and holds our correspondence. Current provider names are available on request and are listed in our supplier register.

There is no CRM, no marketing automation platform and no analytics processor in the path. Nothing else receives your data.

5. International transfers

Personal data collected through this site is stored in the United Kingdom or the European Economic Area.

Where a processor operates outside the UK, we rely on UK adequacy regulations where they apply, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. We do not use a processor that cannot meet one of those routes.

6. How long we keep it

We do not keep personal data for longer than we need it.

• Enquiries that do not lead to an engagement: 24 months from your last contact with us, then deleted. Long enough to recognise you if you come back, short enough not to be a standing liability.
• Enquiries that become engagements: retained for the life of the contract and for six years afterwards, in line with the limitation period and our accounting obligations.
• Server logs: 90 days.
• Consent records: 24 months from the date the choice was made, after which we ask again.

7. How we protect it

The site is served over HTTPS only. Enquiry data is transmitted over TLS and stored in access-controlled systems. Access is limited to the people who need it in order to reply to you, protected by multi-factor authentication.

This site sets no third-party scripts, loads no third-party fonts and embeds no third-party media, which removes an entire class of data leakage that most marketing sites carry.

The controls described here are the same ones set out in the security schedule we use in client contracts, so a procurement reviewer will not find two different accounts of the same measures.

8. Your rights

Under the UK GDPR you have the right to be informed about how we use your data, to request a copy of it, to have inaccurate data corrected, to have data erased, to restrict how we use it, to object to processing based on legitimate interests, and to data portability. Where we rely on consent, you can withdraw it at any time and as easily as you gave it.

To exercise any of these, email hello@vectisflow.com. We will respond within one month. We will not charge you, and we will not ask you to justify the request.

If you object to us processing your enquiry under legitimate interests, we will stop unless we have compelling grounds not to. In practice that means we will delete it and not reply further.

9. Automated decision-making

We do not make decisions about you by solely automated means, and we do not carry out profiling, on this website.

That is worth stating precisely given what we do for a living. The retrieval and extraction systems we build for clients run inside those clients' environments, on their data, under their control, and are entirely separate from this site.

10. Cookies and similar technologies

The site sets no cookies at all before you make a choice, and no non-essential storage at any point unless you opt in. Details are in the cookie policy, including how to change your mind.

11. Complaints

If you are unhappy with how we have handled your data, please tell us first at hello@vectisflow.com so we can put it right.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

12. Changes to this notice

We will update this notice when our processing changes, and record the date of the most recent change at the top of this page. Where a change materially affects you, we will say so rather than relying on you to notice.