Legal

Privacy Policy

How Velvore collects, uses, and protects your personal information.

Last updated: Draft — pending solicitor review

Draft notice: this policy is a working draft prepared by Velvore’s development team to align with UK GDPR (the UK General Data Protection Regulation) and the Data Protection Act 2018. Before publication, it should be reviewed and approved by Velvore’s solicitor. Specific operational details (retention periods, data-processor list, exact contact details) may need to be confirmed.

1. Who we are

Velvore Property Stewardship (“Velvore”, “we”, “us”, “our”) is a private property stewardship firm operating in Central London. For the purposes of UK data-protection law, Velvore is the data controller for the personal information collected through this website.

If you have any questions about this policy or about how we handle your data, please contact us using the details in section 11.

2. What information we collect

We collect the following categories of personal information:

  • Information you give us directly when you submit the enquiry form: your first and last name, email address, telephone number (optional), property postcode, and the service you are interested in. We also retain the date and time of the submission and any free-text content you choose to include.
  • Technical information collected automatically if you accept our analytics cookies: your IP address (typically anonymised by the analytics provider), browser type, device type, referring URL, the pages you visit on this site, and approximate geographic region. We do not collect technical information until you explicitly accept analytics cookies.
  • Communication records when you contact us by telephone, email, or any other method — including the content of those exchanges where relevant to the service you are enquiring about.

We do not knowingly collect any “special category” personal data (such as health, religious, or biometric information). Please do not include such information in messages to us.

3. Why we use your information (purpose & lawful basis)

We process your personal information for the following purposes, relying on the following lawful bases under Article 6 of the UK GDPR:

  • To respond to your enquiry and discuss our services with you. Lawful basis: legitimate interest — namely, our interest in operating our business and responding to people who contact us, balanced against your interest in receiving a timely reply.
  • To improve this website and understand how visitors use it. Lawful basis: consent — we only collect analytics information after you have explicitly accepted analytics cookies via the cookie banner. You can withdraw consent at any time using the “Cookie preferences” link in the site footer.
  • To comply with our legal and regulatory obligations — for example, where we are required to retain records for tax, anti-money-laundering, or other statutory purposes. Lawful basis: legal obligation.

4. Cookies and similar tracking

This website uses two kinds of cookies and storage:

  • Strictly necessary: a small entry in your browser’s localStorage that records whether you have accepted or rejected analytics cookies. This is set as soon as you make a choice and is not used for any other purpose. We do not require your consent to use it (UK PECR exemption for cookies strictly necessary to provide a service you requested).
  • Analytics (optional): if you accept, we load Google Analytics 4 to understand aggregate visitor patterns. Google Analytics may set its own cookies in your browser. Until you accept, the analytics script is not loaded and no analytics cookies are set.

You can change your choice at any time via the “Cookie preferences” link in the footer.

5. How long we keep your information

  • Enquiry submissions: retained for up to 24 months from the date of submission, after which they are deleted unless they have been transferred to an active client relationship.
  • Active client records: retained for the duration of the relationship and for a further 6 years after termination, in line with our standard professional and statutory record-keeping obligations.
  • Analytics data (if you opted in): retention is governed by Google Analytics’ own settings, currently set to 14 months.

6. Who we share your information with

We do not sell your personal information. We share it only with the following categories of recipient, and only to the extent strictly necessary:

  • Our hosting and form-processing provider (Netlify), which transmits enquiry submissions to us and stores them temporarily on its infrastructure.
  • Our analytics provider (Google Analytics), only if you have accepted analytics cookies.
  • Professional advisers (solicitors, accountants, auditors) where they need the information to provide their services to us.
  • Public authorities where we are legally required to disclose information (for example, in response to a valid court order or regulatory request).

All processors act under written agreements that require them to safeguard your information.

7. International transfers

Some of our providers (notably Netlify and Google) are based outside the United Kingdom and may process your information in the European Economic Area, the United States, or elsewhere. Where personal data leaves the UK, we rely on safeguards approved under UK GDPR — typically the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — to ensure equivalent protection.

8. Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete information.
  • Erase your data (“right to be forgotten”), subject to legal retention requirements.
  • Restrict processing in certain circumstances.
  • Object to processing based on legitimate interest.
  • Data portability — receive your data in a portable format.
  • Withdraw consent at any time, where processing is based on consent (for example, analytics cookies).

To exercise any of these rights, contact us using the details below. We will respond within one month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data-protection regulator, at ico.org.uk.

9. Security

We use appropriate technical and organisational measures to protect your personal information — including encrypted connections (HTTPS), access controls on our internal systems, and processor agreements with our service providers. No system is perfectly secure, however, and we cannot guarantee the security of information transmitted over the internet.

10. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of the page reflects the most recent change. Material changes will be highlighted on the site for a reasonable period.

11. Contact us

For any privacy-related question or to exercise your rights: