This policy explains what personal data we collect when you use this website, enquire about our learning platform, or become a client; why we hold it; how long we keep it; and what rights you have over it. We handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are (data controller)
This website is operated by Vector Learning Technologies Ltd, a company registered in England & Wales (company number 17222876), registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. In this policy, "we", "us" and "our" refer to Vector Learning Technologies Ltd, which is the data controller for the personal data described below.
- Vector Learning Technologies Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
- Registered in England & Wales, Company No. 17222876
- Email: [email protected]
- Telephone: +44 7455 130 136
2. Contacting us about your data
Send data protection requests and questions to [email protected], or write to the registered office above marked "Data protection". We have not appointed a Data Protection Officer, as we are not required to; requests are handled by a company director.
3. What personal data we collect
| Source | Data |
|---|---|
| Enquiry form on this website | Your name, email address, the services you ticked, and the message you write. Nothing on the form is compulsory except your name, email address and message. |
| Email, telephone, or a consultation call you book with us | Your name, contact details, your organisation's name if you give one, and the content of what we discuss — including any detail about your training obligations, systems or staff numbers that you choose to share. |
| Client and project records | Contact details for the people we work with, scopes, contracts, estimates, invoices and payment records. Where we hold credentials for your systems, they are kept in an encrypted password manager and are not shared outside the company. |
| Learner data inside a platform we host for a client | Where we host the learning platform for a client organisation, that organisation is the controller of its learners' data and we act as its processor. See section 6. |
| Web server logs (created by our hosting provider) | IP address, browser and device type, pages requested, date and time. Used for security and to keep the site running. |
| Your browser's local storage | A single entry recording whether you accepted or declined non-essential cookies. It contains no identifier and never leaves your device. See our Cookie Policy. |
We do not run analytics, advertising or tracking scripts on this website. We do not collect special category data through this website, and we do not knowingly collect data about children.
4. Why we process it, and our lawful basis
| Purpose | Lawful basis (Art. 6 UK GDPR) |
|---|---|
| Replying to your enquiry, arranging a consultation, preparing a scope or estimate | Legitimate interests — you have approached us about work, and answering you is the obvious and expected response. You can ask us to stop at any time. |
| Delivering the platform, courses, integrations and support you have commissioned | Performance of a contract with you or with the organisation you represent. |
| Issuing invoices and keeping accounting and tax records | Legal obligation — the Companies Act 2006 and UK tax law require us to keep these records. |
| Keeping the site and our systems secure (server logs, backups) | Legitimate interests — protecting our systems, our clients' data and our business. |
| Storing your cookie choice on your device | Strictly necessary under PECR — it exists only to record the preference you gave us. Any non-essential cookie would run on consent only. |
We do not send marketing email. If that ever changes, it will be on an opt-in basis with a working unsubscribe link, and it will not be bundled into an enquiry form.
5. How long we keep it
| Record | Retention |
|---|---|
| Enquiries that do not become work | 24 months from the last contact, then deleted. |
| Client contact and project records | For the life of the relationship, then 6 years, to cover the limitation period for contract claims. |
| Invoices and accounting records | 6 complete financial years after the year they relate to, as UK tax law requires. |
| Learner data in a hosted platform | Per the client organisation's own retention rules, set out in our processing agreement with them. Deleted or returned on termination. |
| Web server logs | Up to 90 days at our hosting provider. |
| Cookie preference in local storage | Until you clear your browser storage. |
6. Who we share it with
We do not sell your personal data, and we do not share it for anyone else's marketing. We use a small number of service providers who process data on our instructions:
- Hosting and email — the provider that runs our servers and mailboxes, hosted in the United Kingdom.
- Accounting software and our accountant — for invoices and statutory accounts.
- Google Fonts — the fonts on this website are requested from Google's font service, which necessarily sees your IP address as part of that request. It sets no persistent cookie.
- Cloudflare (cdnjs) — the animation library used on this page is served from a public code CDN, which likewise sees your IP address for that request and sets no cookie.
We would disclose data if the law or a court required it, or to establish or defend a legal claim.
Where we are the processor, not the controller. If your employer uses a learning platform we host, your employer decides what learner data is collected and why; we act on its written instructions under Article 28 UK GDPR. Please raise access, correction or erasure requests with your employer first — if you contact us directly, we will pass the request on and tell you we have done so.
7. International transfers
Client and learner data in the platforms we host stays in United Kingdom data centres. The two exceptions on this website are Google Fonts and the Cloudflare code CDN described above, which are US-headquartered and may process your IP address outside the UK. Those transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the UK–US data bridge where the provider is certified under it. We do not transfer enquiry or client records outside the UK.
8. Your rights
Under the UK GDPR you have the right to:
- be told what we hold about you, and get a copy of it (access);
- have inaccurate data corrected (rectification);
- have data deleted where we no longer have a good reason to keep it (erasure);
- ask us to pause processing while a dispute is resolved (restriction);
- receive data you gave us in a portable, machine-readable format (portability);
- object to processing we base on legitimate interests, including any profiling — we do none;
- not be subject to solely automated decisions with legal or similarly significant effects — we make none.
Withdrawing consent
Where we rely on consent — in practice, only non-essential cookies — you can withdraw it at any time by choosing "Decline" in the banner, clearing this site's data in your browser, or emailing us. Withdrawing consent does not affect processing that already took place lawfully.
How to exercise a right
Email [email protected] and tell us what you want. We respond within one month of receiving your request, as the UK GDPR requires, and we will tell you if we need to extend that for a complex request. We may ask you to confirm your identity before we release data. There is no charge unless a request is excessive or repetitive.
9. Complaints
If you are unhappy with how we have handled your data, please tell us first — most issues are a misunderstanding we can fix quickly. You also have the right to complain to the UK's supervisory authority, the Information Commissioner's Office:
- www.ico.org.uk
- Helpline: 0303 123 1113
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
10. Security
The site is served over HTTPS. Access to our systems requires multi-factor authentication. Credentials are kept in an encrypted password manager, laptops are full-disk encrypted, and backups are encrypted at rest. If a breach were likely to risk your rights and freedoms, we would report it to the ICO within 72 hours and tell affected people without undue delay.
11. Cookies and local storage
This website sets no tracking cookies. The only thing stored on your device is your answer to the cookie banner. The full detail, including what third parties see when your browser fetches fonts and scripts, is in our Cookie Policy.
12. Changes to this policy
If we change how we handle personal data we will update this page and change the date at the top. If a change materially affects people whose data we already hold, we will contact them directly rather than rely on you noticing.