Privacy notice

ShadowVu Ltd is a private limited company registered in the United Kingdom. In this notice, “we”, “us” and “our” mean ShadowVu Ltd.

We are the data controller for personal data collected through shadowvu.com. That means we decide why and how your personal data is processed on this website. If you have any question about this notice or about how we handle your information, contact us at jim@shadowvu.com or on +44 (0)1235 242 742.

This notice explains what we collect through this website, why we collect it, how long we keep it and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Information you give us

This website carries an enquiry form. When that form is live and you complete it, we collect the information you choose to enter, namely:

• Your name, so we can address a reply to you.
• Your organisation, so the enquiry is routed to the right team.
• Your email address, and your telephone number if you choose to provide one, so we can respond.
• Your enquiry type, which determines which internal route the message takes.
• The content of your message, including anything further you decide to tell us.

We also receive personal data when you email us, telephone us, or contact us through our LinkedIn page. LinkedIn is operated by a third party and its own privacy notice applies to any data you provide there.

Please do not send us classified, export controlled, or otherwise restricted material through the website form or by unencrypted email. If your enquiry involves sensitive technical or programme information, contact us first and we will agree an appropriate channel.

Information collected automatically

When you visit this website, limited technical data may be processed by our hosting and content delivery providers as part of serving the site securely. This can include your IP address, the type and version of your browser and operating system, the pages you view, and the date and time of your visit. Where we use analytics, that data is described in section 05.

What we do not collect

This website does not ask for special category data, such as information about health, ethnicity, political opinions, religious beliefs, trade union membership, biometrics or sexual orientation. Please do not include such information in an enquiry. We do not take payments through this website and we do not collect payment card details here.

We must have a lawful basis under Article 6 of the UK GDPR for every use of your personal data. The bases we rely on are set out below.

• Responding to your enquiry. Lawful basis: legitimate interests, Article 6(1)(f). It is in our interests and yours that a business enquiry receives a considered reply from the right person. We have assessed that this processing does not override your rights and freedoms, because you initiated the contact and the data is limited to what a reply requires.
• Assessing a career application. Lawful basis: legitimate interests, Article 6(1)(f), and steps taken at your request before entering a contract, Article 6(1)(b).
• Managing a commercial, supplier, partner or distribution relationship. Lawful basis: performance of a contract, Article 6(1)(b), or legitimate interests where you are a contact at a corporate counterparty.
• Non-essential cookies, analytics and any marketing email. Lawful basis: your consent, Article 6(1)(a), which you may withdraw at any time.
• Keeping records, meeting statutory duties and defending legal claims. Lawful basis: legal obligation, Article 6(1)(c), and legitimate interests, Article 6(1)(f).
• Protecting the security and integrity of the website. Lawful basis: legitimate interests, Article 6(1)(f), in preventing abuse, fraud and attack.

We do not sell personal data, and we do not use your data for automated decision making or profiling that produces legal or similarly significant effects.

We do not sell, rent or trade personal data. We share it only where there is a clear reason to do so, and only with recipients bound by appropriate obligations.

Third party processors

We use service providers who process personal data on our instructions and on our behalf. Each is engaged under a written contract that meets Article 28 of the UK GDPR. The categories are:

• Website hosting, content delivery and platform security providers.
• Email, calendar and document collaboration providers.
• Website analytics providers, where analytics are in use and you have consented.
• Customer relationship management and enquiry handling systems.
• Recruitment systems, where you apply for a role.
• Professional advisers, including legal, accounting, insurance and audit.

We may also disclose personal data where we are required to by law, by a regulator, or by a court, or where disclosure is necessary to establish, exercise or defend legal claims. If our business or part of it is reorganised or transferred, personal data may be disclosed to a prospective acquirer under confidentiality obligations.

Transfers outside the United Kingdom

Some of our providers process data outside the United Kingdom. Where that happens, we transfer data only if the destination is covered by UK adequacy regulations, or under an approved safeguard such as the International Data Transfer Agreement or the UK Addendum to the European Commission Standard Contractual Clauses, together with a transfer risk assessment. You may ask us for details of the safeguard applied to a specific transfer.

A cookie is a small text file placed on your device by a website. Similar technologies include local storage, pixels and device fingerprinting techniques.

• Strictly necessary cookies are required for the site to function and to remain secure. Under the Privacy and Electronic Communications Regulations these do not require your consent, but we still tell you about them here.
• Analytics cookies help us understand which pages are read and where visitors struggle, so the site can be improved. These are set only with your consent.
• Advertising and tracking cookies are not used on this website.

Where consent is required, we ask for it before any non-essential cookie is set, and you can change or withdraw your choice at any time. You can also block or delete cookies through your browser settings, although strictly necessary cookies cannot be refused without affecting how the site works.

Analytics data is used in aggregate to measure site performance. We configure analytics to minimise the data collected, and we do not use it to build advertising profiles.

We keep personal data only for as long as we need it for the purpose it was collected for, or for as long as the law requires. Our working retention periods are:

• General enquiries and correspondence. 24 months from our last meaningful contact with you, then deleted or anonymised.
• Career applications. 12 months from the conclusion of the recruitment process, unless you ask us to keep your details on file for longer.
• Customer, supplier, partner and distributor records. For the duration of the relationship, then 6 years from its end to meet contractual, tax and limitation requirements.
• Website analytics. Up to 14 months, held in aggregated form.
• Security and server logs. Retained for a short period for security monitoring, then deleted on a rolling basis.

At the end of a retention period, data is securely deleted or irreversibly anonymised. Where deletion is not immediately possible, for example in a backup, we isolate the data and delete it on the normal backup cycle.

You have the following rights in relation to your personal data. Exercising them is free of charge in almost all cases, and we will respond within one calendar month.

• Right of access. To be told whether we hold data about you and to receive a copy of it.
• Right to rectification. To have inaccurate data corrected and incomplete data completed.
• Right to erasure. To have data deleted where we no longer have a good reason to keep it.
• Right to restrict processing. To have our use of your data paused, for example while an accuracy dispute is resolved.
• Right to data portability. To receive data you provided to us in a structured, commonly used, machine readable format, where processing is based on consent or contract and is carried out by automated means.
• Right to object. To object to processing based on legitimate interests, and an absolute right to object to direct marketing at any time.
• Right to withdraw consent. Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew.
• Rights relating to automated decisions. Not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect. We do not make such decisions.

To exercise any of these rights, email jim@shadowvu.com. We may need to verify your identity before we act, which protects your data from disclosure to someone else.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk. Complaining to the ICO does not affect any other legal remedy available to you.

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls on a least privilege basis, supplier due diligence, and staff confidentiality obligations and training.

No transmission over the internet can be guaranteed to be completely secure. Where the information you wish to send is sensitive, please contact us to agree a secure channel rather than sending it through this website.

This website is a business to business site aimed at professional and organisational audiences. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

We review this notice periodically and update it when our processing changes or the law changes. The date at the top of this page shows when it was last revised. Where a change is significant, we will take reasonable steps to bring it to the attention of people whose data we hold.

For any data protection question, including a request to exercise your rights, contact us using the details below and mark your message for the attention of the data protection contact.

• Email: jim@shadowvu.com
• Telephone: +44 (0)1235 242 742
• Postal address: available on request by email.
• Registered office: ShadowVu Ltd, United Kingdom.