Legal

Privacy notice

How VulaPri Limited processes personal data: our lawful bases, who we share it with, how long we keep it, how you can exercise your rights, and how to complain. This notice is written in line with the UK GDPR and the Data Protection Act 2018.

Last updated: 6 October 2026 · Version 2.4 · Effective 11 October 2026

1. Who we are

When we are the controller

VulaPri Limited is the controller for personal data we process for our own business purposes — including website enquiries, business development, client relationship management, engagement administration, billing, legal compliance, and our own records.

Registered in England & Wales
Company number: 16827529
Registered office: 86-90 Paul Street, London, EC2A 4NE, United Kingdom
ICO registration number: ZC080376
VAT number: 515508209
Privacy contact: privacy@vulapri.com

References to "we", "us", and "our" mean VulaPri Limited.

When we are a processor

Where we process personal data on behalf of a client as part of a client engagement, we act as a processor under the relevant contract and data processing terms. In those cases the client is the controller and remains responsible for its own privacy information unless otherwise agreed. If your personal data is part of a client's work, please contact that organisation directly.

Just DSARS

VulaPri Limited also trades as Just DSARS, our managed data subject access request (DSAR) service. The Just DSARS privacy notice explains how we process personal data for that service.

Our associated companies

JUST DSARS SA (Pty) Ltd (South Africa, Enterprise No. 2026/376670/07), registered office 333 Manitoba Drive, Faerie Glen, Pretoria, Gauteng, 0081 — the operations support company for Just DSARS.
Vula Capability Systems Limited (England & Wales, company number 17243290), registered office 14 Hurricane Court, Heron Drive, Langley, Slough, SL3 8FA — our privacy capability training company.

Both are separate companies with directors and shareholders in common with VulaPri Limited. They are not VulaPri subsidiaries.

2. What personal data we collect

We collect personal data that you choose to provide, and we also collect limited technical data automatically when you use the website:

Information you provide through the contact form — your name, work email, organisation, role (optional), the nature of your enquiry, and any free-text detail you choose to share.
Information you submit to the Knowledge Hub — if you submit an organisation for a directory listing, or flag a correction, we collect your name and work email (used only to verify the submission with you — never published) and the organisation information you provide for publication (which, if accepted, appears publicly in the relevant Knowledge Hub directory).
Information you provide by email, by phone or during meetings — whatever you choose to share, including your telephone number and other contact details.
Information from LinkedIn — if you contact us through LinkedIn, your contact details and professional information.
Information collected at a conference or event — your contact details and professional information.
Business contact details of people we approach — where we contact you proactively about our services in your professional role, we will have obtained your name, job title, organisation, work contact details and professional profile link from a professional source: your organisation's website, a published privacy notice or DPO contact page, the professional details you show on LinkedIn (including through LinkedIn Sales Navigator), or an introduction from a mutual contact. Our first message tells you which source we used. We also keep a record of the messages we exchange with you.
Business contact details passed to us by a client or referrer — where you have asked an existing client or a referrer to put you in touch with us, they may give us your contact details and professional information.
Information generated during a client engagement — for clients only: contact details for your privacy / legal / IT teams, meeting notes, advisory deliverables, and the operational context required to perform the engagement.
Payment and billing details — for clients, the details needed to invoice and take payment.
Identity information — where we need to confirm your identity before acting on a request to exercise your data protection rights.
Website and server data — limited technical data such as IP address, browser type, device information, timestamps, pages requested, and security logs, processed to operate and secure the website.
Analytics data — where optional analytics are enabled, we use analytics cookies or similar technologies only in accordance with our cookies notice and your consent choices. No analytics are currently enabled.

You are not required by law to give us personal data. Without the details marked as required on our forms we cannot respond to your enquiry or submission, and our client agreements require basic contact and billing details.

3. Why we process your personal data and our lawful basis

Our purposes, the data we use for each, and the lawful basis we rely on are set out below.

Data categories	Purpose	Lawful basis (UK GDPR)
Contact information (name, email, organisation, role) and enquiry details	Responding to business enquiries and exploring potential engagements	Art. 6(1)(f) — legitimate interests in responding to professional enquiries and developing client relationships; Art. 6(1)(b) — pre-contract steps where you ask on your own behalf, as a sole trader or individual
Contact information, meeting notes and engagement records	Delivering services to a corporate client and managing client contacts	Art. 6(1)(f) — legitimate interests in delivering and administering professional services
Contact and contract information	Delivering services under a contract with an individual or sole trader	Art. 6(1)(b) — performance of a contract
Contact, contract and payment information	Invoicing, taking payment, giving refunds, and keeping the associated financial records	Art. 6(1)(b) — contract, or Art. 6(1)(f) where the contract is with the organisation you represent; Art. 6(1)(c) — legal obligation for accounting and tax records
IP address, browser and device data, security logs and strictly necessary cookies	Website security, server logs and basic site operation	Art. 6(1)(f) — legitimate interests in operating and securing the website and the data it holds
Organisation information submitted for publication	Reviewing and publishing organisation listings in the Knowledge Hub directories	Art. 6(1)(f) — legitimate interests in maintaining a useful, trustworthy public directory, balanced by a documented assessment; you can object at any time (Art. 21)
Submitter name and work email	Verifying a Knowledge Hub submission with the person who submitted it	Art. 6(1)(f) — legitimate interests; contact details used only to verify, never published
Cookies, IP address, browser and other website technical data	Optional analytics cookies and associated analytics data	PECR reg. 6 consent for storage/access on your device, and Art. 6(1)(a) consent where personal data is processed
Name and email address	Sending newsletters or marketing updates where you have subscribed	Art. 6(1)(a) — consent; unsubscribe at any time
Business contact information (name, job title, organisation, work email, work telephone number, professional profile link) and message history	Contacting business decision-makers about our services in their professional role (business-to-business direct marketing), including through LinkedIn	Art. 6(1)(f) — legitimate interests. See the note below.
Business contact information	Sending relevant business updates to existing corporate clients or business contacts	Art. 6(1)(f) — legitimate interests, where permitted by applicable electronic-marketing rules; object or unsubscribe at any time
Contact information and correspondence	Service- or engagement-related communications, including with our service providers about client work	Art. 6(1)(b) or Art. 6(1)(f) (delivering our services to our clients), depending on the context
Contact and identity information	Responding to requests to exercise your data protection rights, and to data protection complaints	Art. 6(1)(c) — legal obligation
Contact information and correspondence	Legal, regulatory, tax and accounting obligations (for example record-keeping and company law obligations)	Art. 6(1)(c) — legal obligation

Business-to-business direct marketing. Our legitimate interest is in telling organisations about privacy services relevant to them; Recital 47 recognises direct marketing as a legitimate interest. We contact people only in their professional role — by email to their work address, through LinkedIn, or by telephone to their work number. We do not send marketing to personal addresses, and we send marketing email to individual subscribers (sole traders and non-Scottish partnerships) only with consent, in line with regulation 22 of the Privacy and Electronic Communications Regulations 2003. We have recorded a legitimate interests assessment, available on request. This notice is provided at or before our first message (Art. 14).

Where we rely on legitimate interests, we balance that interest against your rights and freedoms, and you can object at any time.

Your right to object to marketing. You have an unconditional right to object to direct marketing (UK GDPR Art. 21(2)). Reply to any message we send you, or email privacy@vulapri.com, and we will stop and add you to our suppression list so that we do not contact you again. Because VulaPri Limited is also the controller for Just DSARS, an objection to VulaPri marketing also stops Just DSARS marketing, and vice versa.

We do not seek to collect special-category personal data through this website. During some client engagements we may encounter special-category personal data — for example when supporting a DPIA, DSAR, breach assessment or compliance review. Where we act as a processor, the client is responsible for identifying the relevant Art. 6 lawful basis and Art. 9 condition, and we process the data under the applicable data processing terms. Where we act as a controller, we will identify an appropriate Art. 6 lawful basis and, where required, an Art. 9 condition and any applicable Data Protection Act 2018 Schedule 1 condition.

4. Who we share your personal data with

We share personal data only where necessary, and under appropriate contractual safeguards. Recipients may include:

Cloud and hosting providers — Netlify, Inc. (website hosting and form processing) and Microsoft Corporation (email, calendar, document storage via Microsoft 365), each acting as our processor.
CRM provider — HubSpot, Inc., acting as our processor for business communications and pipeline management.
Accounting and finance providers — Xero Limited (bookkeeping) and our accountant (when retained), each acting as our processor.
Our associated companies — JUST DSARS SA (Pty) Ltd, which supports Just DSARS case delivery and enquiry handling as our processor under a written data processing and transfer agreement; and Vula Capability Systems Limited, where your enquiry clearly relates to its capability development services, where you ask us to, or where it is otherwise appropriate and consistent with your expectations (Art. 6(1)(f)). Vula Capability Systems Limited then acts as an independent controller under its own privacy notice.
LinkedIn — where we contact you through LinkedIn, including LinkedIn Sales Navigator, LinkedIn is an independent controller of its members’ profile data under its own privacy policy (LinkedIn Corporation for members in the UK; LinkedIn Ireland Unlimited Company for members in the EU, EEA and Switzerland). For the messages, notes and tags we create in Sales Navigator, LinkedIn acts as our processor under its data processing agreement and stores that data in the United States.
Sub-contracting partners — partners we engage for specific client engagements, disclosed to the clients concerned, who may act as our processor, an independent controller, or a separate professional adviser depending on the engagement.
Professional advisers — legal, insurance, and accounting advisers, under duties of confidence.
Banks and other financial institutions — to take and make payments.
A buyer or successor — if we sell, merge or restructure all or part of our business.
Regulators, tax authorities, courts, tribunals and law enforcement — where required by law.

We have data processing agreements in place with our processors, covering security, retention, international transfers, data sharing and storage. We do not sell your personal data and we do not share it for third-party marketing.

5. International transfers

Some of our processors and other recipients are based outside the UK: JUST DSARS SA (Pty) Ltd in South Africa, and Netlify, Microsoft, HubSpot and LinkedIn, which are US companies. For access by the Just DSARS team in South Africa we have a written data processing and transfer agreement and have completed a transfer risk assessment. Where personal data is transferred outside the UK we rely on either an adequacy decision (for example, the UK adequacy regulations for the EEA) or an appropriate safeguard such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, in line with UK GDPR Art. 46. For transfers to the United States, we may rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is actively certified and the transfer is covered by that certification (LinkedIn Corporation is certified, and its data processing agreement also provides the EU Standard Contractual Clauses with the UK Addendum); otherwise we use appropriate safeguards such as the UK IDTA or the UK Addendum. You can ask for a copy of the safeguards we rely on by emailing privacy@vulapri.com.

6. How long we keep your personal data

How long we keep personal data depends on why we hold it and on our legal obligations.

Enquiry data where no engagement results — up to two years, then deleted, unless we are required to retain it longer.
Business contact details of people we have approached — two years from our first contact if you do not respond, or two years from your last response, then deleted. If you go on to make an enquiry or become a client, the enquiry or client retention periods in this section apply instead. If you object, we keep only the minimum needed (name and work contact details) on a suppression list, under Art. 6(1)(f), for as long as needed to make sure we do not contact you again.
Knowledge Hub submissions that are not published — submitter contact details and unaccepted submissions are kept for up to 6 months to manage re-submissions, then deleted.
Client engagement records — for the duration of the engagement and normally up to six years from the end of the financial year in which it ends, unless a longer period is required or justified for legal, regulatory, insurance or claims-handling purposes.
Records required by HMRC and Companies House — for the periods set by statute (typically six years).
Insurance records (PI / Cyber / PL) — retained for the duration of the policy plus the relevant limitation period for claims arising out of advice given during the policy period.
Newsletter subscriber data — until you unsubscribe, plus 12 months thereafter.
Website analytics — as detailed in our cookies notice.

Where we act as a processor, we keep client data only for the retention period agreed with the client, then delete or return it.

7. Data security

We have appropriate technical and organisational measures in place to protect your personal data (UK GDPR Art. 32). Access is on a need-to-know basis for employees, contractors and third parties who support the delivery of our services.

Access controls on our systems, with client work restricted to the people assigned to it.
Safeguards such as encryption, managed and secured devices, and secure archiving.
Due diligence on our processors and sub-processors, to make sure they meet our security standards and contractual requirements.
Policies and procedures, including for personal data breach management, so that staff and third parties know their obligations and how to respond.

8. Your rights

Under UK GDPR you have the following rights, exercisable free of charge in most cases:

Access (Art. 15) — to obtain a copy of your personal data.
Rectification (Art. 16) — to correct inaccurate data. Please tell us if your information changes so our records stay up to date.
Erasure (Art. 17) — to ask us to delete your data, subject to legal limits.
Restriction (Art. 18) — to limit processing in specified circumstances.
Portability (Art. 20) — to receive your data in a structured, machine-readable format.
Object (Art. 21), including an unconditional right to object to direct marketing (Art. 21(2)).
Withdraw consent (Art. 7(3)) — where processing is based on consent, with no effect on prior lawful processing.
Rights in relation to automated decision-making (UK GDPR Arts. 22A–22D). We do not make decisions producing legal or similarly significant effects about you by solely automated means. Knowledge Hub submissions are reviewed before publication; that review may include AI-assisted relevance and accuracy checks, but a person makes the final decision, and you can ask for human review or object at any time.

Your rights are not absolute and may depend on the circumstances and the lawful basis for processing. We may need to verify your identity before responding. To exercise any of these rights, write to privacy@vulapri.com. We respond within one month (UK GDPR Art. 12(3)), extendable in limited circumstances; if we need more time, we will tell you before the deadline.

Where we act as a processor, we will pass your request to the relevant controller (our client) and help them respond.

9. Complaints

If you are unhappy with how we have handled your personal data, you can complain to us directly using our complaint form, or by emailing privacy@vulapri.com, setting out your concern.

We will acknowledge your complaint within 30 days of receiving it, investigate it, and inform you of the outcome without undue delay. We may need to verify your identity first, and in limited, complex cases we may need longer — if so, we will tell you why and keep you updated.

You also have the right to complain to the Information Commissioner’s Office (ICO), or to the supervisory authority in your country if you are outside the UK, at any time. You do not have to complain to us first, including if you are unhappy with how we have dealt with your complaint.

ICO website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Cookies

See our separate cookies notice for cookies and similar technologies this website uses, and how to control them.

11. Changes to this notice

We may update this notice from time to time. The version and date at the top of this page show when it was last revised. Material changes are flagged on the site before they take effect.

12. Contact

Questions about this notice or our processing? Write to privacy@vulapri.com, or by post to VulaPri Limited, 86-90 Paul Street, London, EC2A 4NE.

Back to home