4. Lawful bases for processing (UK GDPR / EU GDPR)

We rely on one or more of these lawful bases:

• Contract: to deliver services you request.

• Legitimate interests: to operate and improve our business, keep systems secure, and respond to enquiries.

• Consent: for marketing emails/cookies where required.

• Legal obligation: for tax, accounting, and compliance requirements.

5. Cookies and analytics

We may use cookies and similar technologies for:

• essential site functionality,

• performance and analytics, and

• marketing (only where you consent, if applicable).

You can manage cookie preferences via [Cookie Banner/Settings] and browser settings.

6. Sharing your data

We may share data with:

• service providers (website hosting, analytics, email, booking tools, document tools, payment processors);

• professional advisers (legal/accounting) when necessary; and

• authorities if required by law.

We do not sell personal data.

7. International data transfers

Because we operate globally and use third-party providers, your data may be transferred outside the UK/EEA. Where required, we use appropriate safeguards such as:

• UK International Data Transfer Agreement (IDTA) and/or

• EU Standard Contractual Clauses (SCCs), and additional measures where appropriate.

8. Data retention

We keep personal data only as long as needed for the purposes above, including legal and accounting requirements. Typical retention periods:

• enquiries: up to 12 months;

• clients: for the life of the relationship plus [X years] for legal/tax records;

• marketing: until you unsubscribe.

9. Your rights

Depending on your location, you may have rights to:

• access your data,

• correct inaccuracies,

• delete data,

• restrict or object to processing,

• data portability, and

• withdraw consent at any time (for consent-based processing).

To exercise rights, contact: [privacy@vettedready.com].

10. Complaints

If you’re in the UK and unhappy with our response, you can complain to the Information Commissioner’s Office (ICO).

11. Security

We use reasonable technical and organisational measures to protect personal data (see “Security & Compliance” page for detail). No internet-based system is 100% secure; we continuously improve controls.

12. Changes to this policy

We may update this policy. The latest version will always be available on our website.