Privacy Policy
This policy explains what personal information Vinula Consulting Ltd, trading as Vinula InfoSec, collects through this website and in the course of our work, why we collect it, who it is shared with, how long we keep it, and the rights you have over it.
Who we are
Vinula Consulting Ltd (company number 15613857), trading as Vinula InfoSec, is the data controller for the information described here. We are registered with the Information Commissioner's Office under registration number ZB773945, and you can check that entry on the ICO's public register.
We have not appointed a statutory Data Protection Officer, because we are not a public authority and our core activity is not large scale monitoring or large scale processing of special category data. Privacy questions and requests go to the contact below, which is a monitored address.
- Email: info@vinula.co.uk
- Telephone: +44 7510 403140
- Post: Suite A, Kings House, 68 Victoria Road, Burgess Hill, West Sussex, RH15 9LH, United Kingdom
What we collect, why, and on what basis
When you use the contact form
The form asks for your name, your email address and your message, and it offers optional fields for your company, your telephone number, your town or region, the service you are interested in and your sector. When you submit it we also record the date and time, and the IP address the submission came from, which is used to check that the form is being completed by a person rather than by software.
We use this to reply to you, to answer your question and, where it leads that way, to scope and quote for work. Our lawful basis is legitimate interests: replying to somebody who has asked us to get in touch. Where you are asking us to quote, it is also steps taken at your request before entering a contract. The tick box on the form is there so you can see and confirm how the information will be used before you send it; it is not the legal basis we rely on, and ticking it does not sign you up to anything else.
Providing a name, an email address and a message is necessary for us to be able to reply. The other fields are optional and leaving them blank makes no difference to the answer you get.
When you become a client
In the course of delivering work we hold the contact details of the people we deal with, records of meetings and decisions, correspondence, and account and purchase history. Our lawful basis is contract, or legitimate interests where the person is a representative of an organisation we contract with rather than our customer personally.
Some of our work involves identity or verification documents, for example on a due diligence engagement. Where that happens our lawful basis is legal obligation or contract, depending on why the document is needed, and we tell you at the time.
Marketing
We send service updates and marketing only to people who have asked to receive them, or to existing clients about services similar to ones we have already provided. Our lawful basis is consent, or legitimate interests together with the soft opt in under the Privacy and Electronic Communications Regulations where you are an existing client. Every message carries an unsubscribe link, and you can tell us to stop at any time using the contact details above. We action that immediately, with no questions and no balancing exercise.
Accounting and legal records
We keep the records that company and tax law require us to keep. Our lawful basis is legal obligation.
Website security and measurement
The contact form is protected by an anti-spam check that sees your IP address and some technical signals from your browser. Our lawful basis is legitimate interests: keeping the form usable and stopping automated abuse. The storage this involves is strictly necessary for a service you asked to use, so it does not need your consent.
We also use Google Analytics, which is switched off unless you turn it on. Our lawful basis is consent, and you can withdraw it at any time using the Cookie settings link at the foot of any page. Full detail of every cookie is in our Cookie Policy.
When it is on, it records:
- which pages you look at, in what order, and for how long
- how far down a page you scroll
- clicks on our telephone number, on links that take you to another website, and on any file you download
- which buttons you press, their wording and where they sit on the page
- whether you started filling in the contact form, whether you left it part filled, and how many boxes you had completed. Never what you typed into it
- the name of any form box that was rejected and why, for example because it was left empty or an email address was not a valid one. The name of the box only, never its contents
- that an enquiry was sent successfully, along with the service and sector you chose from the menus
- how quickly the page loaded and responded for you, and the text of any error your browser reported while using the site
- anything you type into a site search, if we ever add one, which we have not
- your device, browser, screen size and language
- roughly where you are, worked out by Google from your IP address to about city level. Google does not pass us your IP address itself
- how you arrived: a search engine, a link on another site, or typing the address in
A random number is stored on your device so that two visits by you are counted as one person rather than two. It is not your name and we cannot turn it back into your name. We have deliberately not switched on the Google Analytics features that would join this up with your Google account or with advertising: Google signals, user IDs and user-provided data are all off, and we do not run any advertising or remarketing on this site.
Where the information comes from
In almost every case, from you directly. We do not buy lists and we do not scrape contact details. Where a client or a partner passes us the details of a colleague so we can arrange work, we use those details for that purpose only.
Who we share it with
We are supported by Begin Group Ltd (ICO registration ZC181845), a United Kingdom digital agency that operates this website and our customer relationship system on our behalf as a data processor. Begin Group Ltd only processes your data on our instructions. Enquiry data is held in that system, operated for us by Begin Group Ltd on the HighLevel platform.
We do not sell personal information and we do not share it for anybody else's marketing. These are the companies that handle it on our behalf, and what each of them does.
| Who | What they do with it | Where |
|---|---|---|
| Cloudflare | Serves this website, protects it from attack, runs the anti-spam check on the form, and holds the submitted enquiry. Sees IP addresses and everything you typed into the form. | Global network, United States parent |
| HighLevel (GoHighLevel) | Our client relationship system. An enquiry becomes a contact record here. Sees your name, contact details and message. | United States |
| Resend | Sends the notification of your enquiry to us and the acknowledgement to you. Sees your name, email address and message. | United States and European Union |
| Microsoft | Hosts our email. Any message you send us, and our reply, sits in a Microsoft 365 mailbox. | United Kingdom and European Union |
| Website measurement through Google Analytics and Google Tag Manager. Loaded only if you turn analytics on. | United States and European Union |
We also share information with our professional advisers, such as our accountants and insurers, where they need it and are bound to keep it confidential. We will disclose information where the law requires it.
Information that leaves the United Kingdom
Four of the companies above are based in, or owned from, the United States, so some of this information is handled outside the United Kingdom. Where that happens the transfer is covered by the International Data Transfer Agreement, or by the UK Addendum to the Standard Contractual Clauses, or by the UK Extension to the EU to US Data Privacy Framework where the provider is certified under it. You can ask us which applies to a particular provider and we will tell you.
How long we keep it
| What | How long |
|---|---|
| An enquiry that does not lead to work | 12 months, then deleted |
| An enquiry that becomes work | Merged into the client record, and kept for as long as that is |
| Client records and correspondence | 6 years after the last piece of work |
| Accounting and tax records | 6 years from the end of the accounting period |
| Marketing preferences and consent records | For as long as we rely on them, and 2 years after, so we can show what was agreed |
| Google Analytics: what happened on a visit | 14 months |
| Google Analytics: the random identifier that counts you as a returning visitor | 14 months from your last visit, so it is refreshed each time you come back |
| Your cookie choice | 6 months, then we ask again |
The 12 month figure is not just a statement of intent: enquiries are stored with an expiry set at the point they are received, so they are removed whether or not anybody remembers to do it.
How we protect it
The site is served only over an encrypted connection. The contact form is protected against automated abuse. Access to enquiry and client records is limited to the people who need it, accounts are protected by strong passwords and multi-factor authentication where the system supports it, and information security is the work we do for a living.
Your rights
Under data protection law you have the right:
- to ask us for a copy of the personal information we hold about you
- to ask us to correct anything that is wrong or incomplete
- to ask us to delete it, in some circumstances
- to ask us to restrict how we use it, in some circumstances
- to object to us using it, in some circumstances
- to receive it in a portable format, where you gave it to us and it is handled by automated means
- to withdraw your consent at any time where consent is what we rely on, which does not affect anything we did before you withdrew it
- to tell us to stop sending you marketing, at any time, absolutely
To exercise any of these, email info@vinula.co.uk. There is no fee, and we will respond within one calendar month. If a request is genuinely complex we may extend that by up to two further months, and we will tell you inside the first month if we need to.
Automated decision making
We do not make decisions about you by automated means alone, and we do not carry out profiling that has legal or similarly significant effects.
How to complain
Please tell us first, at info@vinula.co.uk. We will acknowledge your complaint within thirty days and tell you what we are doing about it. That is a right in its own right, under section 164A of the Data Protection Act 2018.
If you are still unhappy, you can complain to the Information Commissioner's Office. Complaining to us does not take away that right, and you do not have to come to us first.
- Online: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Changes to this policy
We review this policy at least once a year, and whenever we add a tool, change a provider or change what we do with personal information. The date at the foot of this page is when it last changed.
- 16 August 2026: expanded what Google Analytics records when you turn it on, so that the list matches what the site now measures. No new company is involved and no new cookie is used. Because the purpose is wider than before, the cookie banner asks everyone for their choice again. We also told Google to refuse advertising storage even when Analytics is on.
- 12 August 2026: rewritten in full. Added the companies that handle your information and where they are, including the agency that runs this website for us, the international transfer position, real retention periods, the cookies and analytics section, and the right to complain to us first. Corrected the lawful basis for our legal record keeping, which previously said consent.
- 5 June 2024: first published.
Last updated 12 August 2026.