Privacy Notice

• We collect personal data only where you give it to us, or where it is needed to run the site.
• We do not use tracking cookies, advertising cookies, or third-party ad networks.
• We do not sell, rent, or share your data for marketing, and we do not run a mailing list.
• We may reply to your enquiry and follow up once about it. If you tell us to stop, we stop.
• You can ask us what we hold about you, and ask us to correct or delete it, at any time.

Virticus Advisory is the data controller for the personal data described in this notice.

Contact:

hello@virticus.com

Under UK GDPR we rely on the following:

• Legitimate interests — to respond to business enquiries, to send you a result you requested, and to follow up once about it. Our interest is in operating and marketing a specialist advisory business; we have considered that this is B2B correspondence you initiated, limited in volume, and easy to stop.
• Performance of a contract — to deliver engagements and operate the client portal for firms we work with.
• Legal obligation — where we must retain records for tax, accounting, or professional purposes.

You can object to processing based on legitimate interests at any time by emailing us. We will stop unless we have compelling grounds not to.

This website uses no tracking, analytics, or advertising cookies. That is why you are not asked to dismiss a cookie banner.

The client portal sets strictly necessary session cookies so that signed-in users stay authenticated and see only their own organisation’s workspace. These are essential to providing a service you have asked for and are exempt from consent requirements. They are not used for tracking.

We use a small number of providers who process data on our behalf under contract:

• Resend — delivers enquiry and check-result emails to us.
• Plausible Analytics — EU-hosted, cookie-free page analytics.
• Railway — hosting for the website, application, and database.

We do not sell, rent, or otherwise disclose your personal data to third parties for their own purposes. We may disclose data where we are legally required to.

Where a provider processes data outside the UK, that transfer is covered by an appropriate safeguard such as UK International Data Transfer Agreement terms or an adequacy decision.

• Enquiries and check results — up to 24 months from your last contact with us, then deleted.
• Client portal accounts and engagement records — for the duration of the engagement and up to 6 years afterwards, reflecting professional and limitation-period requirements.
• Analytics — aggregate only, with no personal data to retain.

You can ask us to delete your enquiry data sooner, and we will unless we are required to keep it.

Access to enquiry and portal data is restricted to those who need it to deliver the work. Portal passwords are stored hashed, never in plain text, and portal data is scoped so one organisation cannot see another’s. Data is transmitted over encrypted connections.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO and, where required, you.

Under UK GDPR you have the right to:

• Ask what personal data we hold about you, and get a copy.
• Have inaccurate data corrected.
• Ask us to delete your data.
• Ask us to restrict how we use it.
• Object to processing based on legitimate interests.
• Receive data you gave us in a portable format.

To exercise any of these, email hello@virticus.com. We respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would ask that you raise it with us first so we can put it right.

We update this notice when our processing changes. The date at the top shows when it was last revised. Material changes affecting how we use data you have already given us will be notified to you directly.