Data Protection Policy

Last updated: 9 November 2026

Purpose and scope

This policy sets out how Vantorel LTD meets its obligations under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003. It applies to everyone working for us, including contractors, and to all personal data we handle. To learn what we collect about you directly, read our Privacy Policy.

Controller and processor roles

• Controller: for our own enquiries, client contacts, staff records and accounts.
• Processor: for personal data we handle on a client’s instructions, such as records in a CRM we support, data used by an AI agent or email lists in a marketing campaign.

Our data protection principles

We make sure that personal data is:

• processed lawfully, fairly and transparently
• collected for specific, legitimate purposes
• adequate, relevant and limited to what is necessary
• accurate and kept up to date
• kept no longer than necessary
• kept secure, with appropriate technical and organisational measures

We keep records that demonstrate how we meet these principles.

When we act as a processor

Before processing personal data for a client, we enter into written terms that meet Article 28 of the UK GDPR. We will:

• process the data only on the client’s documented instructions
• ensure that people with access are bound by confidentiality
• apply appropriate security measures
• use sub-processors only with the client’s authorisation, on equivalent terms
• help the client respond to individual rights requests and meet its security obligations
• delete or return the data at the end of the engagement, unless the law requires us to keep it
• give the client the information needed to demonstrate compliance, and allow reasonable audits

How this applies to our services

Software, CRM, CMS and integrations

We build with data protection by design. We use realistic test data instead of live personal data wherever possible, and limit production access to the people who need it.

AI agents

We assess what personal data an agent can reach and restrict it to what the task requires. We recommend human review for significant decisions, and we check that model providers’ terms suit the data involved, including how long inputs are retained.

Blockchain

Public blockchains are permanent and cannot honour erasure. We design products to keep personal data off chain.

Cybersecurity

Testing can expose personal data. We limit what we view, avoid copying it, store evidence in encrypted workspaces and delete it once the agreed retention period ends.

E-book publishing and marketing

Manuscripts, reader lists and author details are shared only as needed for the work. Marketing to individuals follows consent and soft opt-in rules, and suppression lists are respected.

Security measures

• Least-privilege access and multi-factor authentication on business systems
• Encrypted connections and encrypted storage of secrets
• Separate access for each client and prompt removal when no longer needed
• Dependency scanning and security review before releases
• Device security controls for anyone handling personal data

Assessing risk

We carry out a data protection impact assessment, or support the client’s, where processing is likely to pose a high risk to people. This includes new uses of AI involving personal data or large-scale processing of sensitive information.

Personal data breaches

Anyone who suspects a breach must report it internally straight away. As a controller, we notify the Information Commissioner’s Office within 72 hours where a breach is likely to pose a risk to people, and inform affected individuals where that risk is high. As a processor, we notify the client without undue delay after becoming aware of a breach.

International transfers

We only transfer personal data outside the UK under UK adequacy regulations or with appropriate safeguards, such as the International Data Transfer Agreement.

Individual rights

We respond to rights requests within one month. If we receive a request about data we hold for a client, we pass it to that client promptly and help as instructed.

Responsibility and review

Company directors are responsible for this policy. Everyone with access to personal data receives suitable training. We review this policy at least once a year and after any significant change. Questions can be sent to hello@vantorel.org.