Privacy Notice

This notice explains how Valsys handles personal data, the purposes for which we use it, the legal bases we rely on, and the rights available to you.

1. Who we are

Valsys Ltd ("Valsys", "we", "us", "our") is the data controller responsible for the personal data described in this notice. We are a company registered in England and Wales (company number 10702797) and we are registered with the Information Commissioner's Office (registration reference ZB055872).

We are not required to appoint a statutory Data Protection Officer. Any questions about this notice, or any request to exercise your rights, can be sent to:

• Email: privacy@valsys.io
• Post: Valsys Ltd, 14 Windermere Road, Archway, London N19 5SE, United Kingdom

2. Who this notice is for

This notice applies to personal data we process about:

• visitors to our website;
• representatives and contacts of our clients, prospective clients, suppliers and partners; and
• people who apply to work with us.

Current employees and contractors receive separate, more detailed privacy information. The data within the analytical products we provide to clients is described in section 5 below; that data is anonymised or pseudonymised before it reaches us and is governed by our wider data protection programme.

3. The personal data we process, and why

Website visitors. When you visit our website we may process limited technical data (such as IP address and device and browser information, recorded in our server logs) and any details you submit through a contact or enquiry form (such as your name, email address and message). We use this to operate and secure the website and to respond to your enquiry. Our legal basis is our legitimate interests in running and securing our website and responding to enquiries. We do not use cookies or analytics (see section 6).

Clients, prospective clients, suppliers and partners. We process the business contact details of the individuals we deal with at these organisations — typically name, role, business email and phone number, and records of our correspondence and dealings. We use this to provide and receive services, manage the relationship, administer contracts and accounts, send relevant business communications, and meet our legal and regulatory obligations. Our legal bases are the performance of a contract, our legitimate interests in managing and developing our business relationships, your consent where required for marketing, and compliance with legal obligations.

Job applicants. If you apply to work with us, we process the personal data in your application and any related correspondence, for the purpose of assessing your application and managing recruitment. Our legal basis is our legitimate interests in recruiting, and taking steps at your request prior to entering an employment relationship.

4. Where we obtain personal data

We obtain personal data directly from you (for example when you contact us, enter into a relationship with us, or apply for a role), automatically when you use our website, and occasionally from public sources such as Companies House or professional networks where we engage with prospective clients or partners.

5. Data within our products

We provide analytics to institutional clients using data we receive from third-party data providers. That data is anonymised or pseudonymised at source before it reaches us. We do not collect it directly from the individuals to whom it may relate, we have no direct relationship with them, and we do not receive direct identifiers such as names, email addresses or home addresses.

Where data is anonymised, it is not personal data. Where data is pseudonymised, it remains personal data and we process it under our data protection programme, including data protection impact assessments, strict data minimisation, and a contractual and technical prohibition on re-identification. The original collection of that data, and the information provided to the individuals concerned, are handled by the relevant providers under their own privacy notices and legal bases. We do not attempt to re-identify any individual, and we do not make decisions about individuals from this data.

6. Cookies and analytics

Our website does not use cookies. We do not use analytics, advertising or other tracking technologies, and we do not set any cookies — essential or non-essential — when you visit, so no cookie banner or consent step is required.

The only information stored on your device is a small display preference (for example whether you have chosen the light or dark theme). This is kept locally in your browser, is not a cookie, and is never used to track or identify you.

7. Who we share personal data with

We share personal data only as needed and under appropriate safeguards, with:

• service providers who process data on our behalf under contract, including providers of cloud hosting and productivity tools, customer-relationship management, and software development and collaboration;
• our professional advisers, auditors and, where required, regulators or law-enforcement bodies; and
• a buyer or successor in the event of a corporate transaction, subject to confidentiality.

We do not sell your personal data.

8. International transfers

Some of our service providers, and our group entity Valsys Inc, are located outside the United Kingdom, including in the United States and Canada. Where we transfer personal data outside the UK we ensure an appropriate safeguard is in place — for example UK "adequacy" arrangements (including for transfers to Canadian organisations subject to PIPEDA), the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, or the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses). You can ask us for more information about the safeguards that apply.

9. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described above, or to meet a legal, regulatory or contractual requirement, in line with our Data Retention Policy. For example, business-contact and CRM records are kept while the relationship is active or a legitimate interest exists and are reviewed at least every 24 months; recruitment records for unsuccessful applicants are kept for up to 12 months; and financial and accounting records are kept for six years plus the current financial year. When personal data is no longer needed, it is securely deleted or anonymised.

10. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

11. Your rights

Subject to certain conditions under data protection law, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our processing of your data;
• data portability;
• withdraw consent at any time where we rely on consent; and
• not be subject to a solely automated decision with legal or similarly significant effects (see section 10).

To exercise any of these rights, contact us using the details in section 1. We will respond within one month, though this may be extended for complex requests as the law allows. Exercising your rights is free of charge in most cases.

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk , by calling 0303 123 1113, or by writing to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

12. Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last updated, and we will take appropriate steps to bring material changes to your attention.

13. Contact us

For any privacy query, or to exercise your rights, contact privacy@valsys.io or write to Valsys Ltd, 14 Windermere Road, Archway, London N19 5SE, United Kingdom.