Privacy Policy

This Privacy Policy explains how Varsuite Media Group Ltd, trading as Varsuite (“Varsuite”, “we”, “us”), a company registered in England and Wales under company number 14243978, whose registered office is at Mentor House, Ainsworth Street, Blackburn, England, BB1 6AY, collects and uses personal data as a data controller. It applies to visitors to our website, prospective and current clients, and contacts at Client organisations. Where we process personal data on behalf of a Client as a processor - for example, a Client's own customers' data within a platform we host or develop - that processing is governed by our Data Processing Addendum and the Client's own privacy notice, not this Policy.

1. Who we are

1.1 Varsuite is the controller of the personal data described in this Policy. You can contact us about privacy matters at privacy@varsuite.co.uk, or by post at the registered office address above. We are registered with the Information Commissioner's Office under registration reference ZB434970.

2. Personal data we collect

2.1 We may collect and process the following categories of personal data:

• Contact and business details you provide when making an enquiry, onboarding as a Client, or signing a Quote or Statement of Work (for example, name, job title, company, email address, phone number).
• Account and billing information (for example, billing address and payment details, processed via our payment provider).
• Communications with us, including emails, support tickets, and call or meeting notes.
• Technical data collected through our website and hosting infrastructure, such as IP address, browser and device information, and usage data, including via cookies (see clause 6).
• Where relevant, information you submit through an AI-assisted feature of our website or services (for example, a chat or contact-form input), for the purpose of responding to you or providing the requested service.

3. How we use it, and our lawful basis

3.1 We use personal data for the following purposes, relying on the lawful bases summarised below:

PURPOSE                                                    LAWFUL BASIS

Providing and managing our services and your account       Performance of a contract

Billing, invoicing and payment                             Performance of a contract; legal obligation

Responding to enquiries and providing support              Performance of a contract; legitimate interests

Sending marketing communications                           Consent, or legitimate interests where permitted, with
                                                           an opt-out in every message

Security, fraud prevention and system monitoring           Legitimate interests; legal obligation

Improving our website and services, including              Legitimate interests
aggregated or anonymised analysis

Complying with our legal, accounting and tax obligations Legal obligation

4. Our use of AI

4.1 We may use AI-assisted and automation tools internally - for example, to help triage enquiries, draft communications, or analyse how our website and services are used - as part of providing and improving our own services.

4.2 We do not make a decision that produces a legal effect concerning you, or which similarly significantly affects you, based solely on automated processing without human review.

4.3 We do not use personal data submitted to us to train the general, publicly available models of third-party AI providers, beyond what is reasonably necessary to provide the specific service or response requested.

5. Who we share data with

5.1 We may share personal data with:

• Analytics providers, used to understand how a website or platform is being used. Where we use a third-party analytics provider on our own behalf, we configure it so that no personally identifiable information is passed to it.
• Our transactional email delivery provider, which processes the email we and our platforms send. Administrators of that provider's platform may be able to view message metadata and content for delivery, deliverability and abuse-investigation purposes.
• Recording, transcription and meeting-capture tools, as described in section 7A.
• our staff, contractors and professional advisers who reasonably need it to carry out their role;
• hosting, infrastructure, communications, payment, analytics and AI/automation service providers who process personal data on our behalf as our processors, under written agreements requiring them to protect it;
• law enforcement, regulators or other authorities where we are required to do so by law;
• a prospective buyer or successor in the event of a sale, merger or reorganisation of our business.

5.2 We do not sell personal data.

6. International transfers

6.1 Where we, or a service provider acting on our behalf, transfer personal data outside the United Kingdom, we ensure an appropriate safeguard is in place, such as adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

7. Retention

7.1 We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, or to meet our legal, accounting or regulatory obligations, after which it is deleted or anonymised. Personal data we process on behalf of a Client as a processor is retained and deleted in accordance with our Data Processing Addendum and the applicable Service Contract.

7A. Meetings, recordings and transcripts

7A.1 We may record calls, video meetings and in-person meetings, and produce written transcripts, notes, summaries and action points from them, using recording and transcription tools and AI-assisted summarisation. We do this to keep an accurate record of what was discussed and agreed, to capture requirements for a Service, and to avoid work being based on a misremembered conversation.

7A.2 Our lawful basis is our legitimate interest in maintaining an accurate record of our client engagements and the requirements we are asked to build to. Where consent is required, we will ask for it.

7A.3 We will make it clear before or at the start of a meeting where it is being recorded. If you or any attendee does not wish a meeting to be recorded, tell us and we will not record it, or will stop recording. Where you invite other people to a meeting with us, you are responsible for telling them it may be recorded.

7A.4 Recordings, transcripts and summaries are retained only for as long as we need them for the engagement they relate to, and for a reasonable period afterwards for reference, warranty and dispute-resolution purposes, after which they are deleted. Where a recording is no longer of any use to the engagement, we delete it. You may ask us to delete a specific recording or transcript at any time, and we will do so unless we are required to retain it by law or need it in connection with an actual or anticipated dispute.

7A.5 We do not record meetings covertly, and we will not use a recording for a purpose unconnected with the engagement without telling you.

8. Cookies

8.1 Our website uses cookies and similar technologies for essential functionality, analytics, and (where you consent) marketing purposes. You can manage cookies through your browser settings and through the cookie controls presented on our website.

9. Your rights

9.1 Subject to applicable law, you have the right to request access to, rectification or erasure of your personal data, to restrict or object to our processing, to request portability of your data, and to withdraw consent at any time where we rely on consent. To exercise these rights, contact us at privacy@varsuite.co.uk.

9.2 You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe we have not handled your personal data appropriately.

10. Security

10.1 We apply appropriate technical and organisational measures to protect personal data, including encryption, access controls and monitoring, consistent with the security provisions described in our Service Contract.

11. Children

11.1 Our services are directed at businesses, and we do not seek to collect personal data directly from children in our own capacity as controller.

11.2 Where a Client instructs us to process images or other personal data of children within a platform we host or develop for it - for example, a nursery, school, childcare or activity provider - the Client is the controller for that data and we act solely as its processor under the Data Processing Addendum. The Client is responsible for holding the necessary lawful basis and, where required, parental or guardian consent, and for providing the required privacy information. We process that data only on the Client's documented instructions.

12. Changes to this Policy

12.1 We may update this Policy from time to time. Where a change is material, we will take reasonable steps to notify you, such as posting a notice on our website.

13. Contact us

13.1 If you have any questions about this Policy or how we handle personal data, please contact us at privacy@varsuite.co.uk or support@varsuite.co.uk.

Varsuite Media Group Ltd. Company number 14243978. Registered office: Mentor House, Ainsworth Street, Blackburn, England, BB1 6AY. ICO registration: ZB434970.