1. Introduction

This Privacy Policy explains how personal data is collected, used, stored, and protected by The-Virtual-Desk, a trading name of The-Virtual-Desk Solutions Ltd.

We are committed to protecting your privacy and complying with applicable data protection legislation, including:

The UK General Data Protection Regulation (UK GDPR)

The Data Protection Act 2018

2. Data Controller

The-Virtual-Desk Solutions Ltd is the data controller responsible for personal data processed in connection with our Services.

Registered office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.
Company number: 17008780

We are registered with the Information Commissioner’s Office (ICO).

We are responsible for investigating and responding to data protection enquiries and complaints relating to the personal data we process.

Data protection enquiries may be directed to:

Email: shaun.davis@the-virtual-desk.com

3. Personal Data We Process

Depending on the nature of our engagement, we may process:

Identity data (name, job title, company name)

Contact data (email address, telephone number, business address)

Financial data (billing details, payment records)

Technical data (IP address, device and browser information)

Communications data (emails, instructions, correspondence)

We process personal data that is necessary for the provision of our Services, the sale and delivery of our Digital Products, the operation and security of our website and online shop, and our legal and regulatory obligations.

4. Special Category Data

We do not process special category personal data as defined under Article 9 UK GDPR unless expressly agreed in writing in advance.

Where such processing is agreed, it will be subject to:

A written agreement or data processing agreement

Appropriate safeguards

A valid lawful basis and condition for processing

5. Lawful Bases for Processing

We process personal data on one or more of the following lawful bases:

Performance of a contract

Legal obligation

Legitimate interests

Consent (where required)

6. How We Use Personal Data
To process and administer purchases of Digital Products through our IONOS Online Shop, including processing orders, confirming payments, providing digital downloads, issuing receipts and order confirmations, administering refunds or cancellations, providing customer support and maintaining appropriate financial and transaction records.

Personal data may be used to:

Deliver agreed Services

Communicate with Clients and Customers

Manage billing and accounts

Comply with legal and regulatory obligations

Improve our services and business operations

6A. Digital Products, Orders and Online Shop

Where you purchase or attempt to purchase a Digital Product from The-Virtual-Desk, we process personal data necessary to administer the transaction, provide the Digital Product, maintain appropriate business records and meet our legal and regulatory obligations.

Depending on the transaction, this may include:

your name;

email address;

billing and contact information;

business or company information where provided;

details of the Digital Product purchased;

order number and transaction details;

payment status and relevant payment information;

VAT or tax information where applicable;

IP address and technical information associated with the transaction;

download or access information where available; and

communications relating to your order or customer support enquiry.

Purposes of processing

We may process this information to:

process and administer orders;

confirm and fulfil purchases;

provide access to purchased Digital Products;

send order confirmations, receipts and delivery information;

provide customer support;

process refunds, cancellations and other customer requests;

maintain accounting and financial records;

comply with legal, tax and regulatory obligations;

prevent fraud, misuse or unauthorised transactions;

protect our website, systems and Digital Products; and

establish, exercise or defend legal claims where necessary.

Lawful bases

Depending on the circumstances, the lawful bases for this processing may include:

performance of a contract;

compliance with a legal obligation;

our legitimate interests in administering and protecting our business, systems and Digital Products; and

consent, where consent is specifically required by law.

We do not rely on consent where another lawful basis is more appropriate.

Payment providers and technology providers

Payments for Digital Products may be processed through third-party payment providers or payment services integrated with our website or online shop.

We do not ordinarily receive or store customers' full payment card details. Payment information may be processed directly by the relevant payment provider in accordance with its own privacy notice and terms.

We may also use third-party technology providers for website hosting, online-shop functionality, order management, email delivery, digital-product delivery, analytics, security and related business administration.

Such providers may process personal data on our behalf or independently as applicable to their role and contractual arrangements.

Digital-product delivery

Where a Digital Product is purchased, we may process your email address and order information to provide the purchased files, download links or access instructions.

Information relating to an order may be retained after delivery where necessary for accounting, legal, tax, dispute-resolution, fraud-prevention or other legitimate business purposes.

Marketing following a purchase

Purchasing a Digital Product does not automatically mean that you have consented to receive marketing communications.

Where we send marketing communications, we will do so only where permitted by applicable law and will provide an appropriate means of opting out or objecting.

Where applicable, we may rely on legitimate interests for relevant business-to-business marketing activities or consent where consent is required.

Digital-product licensing

Where necessary to protect our intellectual property and enforce the applicable licence, we may retain records relating to the purchaser, order, product purchased and applicable licence.

We do not sell personal data.

7. Business Development and Marketing Communications

As part of our legitimate business activities, we may process business contact information for the purposes of business development, networking, and marketing our Services to organisations that we reasonably believe may benefit from them.

This may include:

Contacting businesses regarding services that may be relevant to their operations;

Responding to enquiries or requests for information;

Developing and maintaining professional business relationships;

Sending business-to-business communications relating to our Services.

The personal data processed for these purposes may include:

Name;

Job title;

Business email address;

Business telephone number;

Company name;

Publicly available business contact information.

Where we undertake business development or marketing activities, we rely on our legitimate interests as the lawful basis for processing under Article 6(1)(f) UK GDPR.

We take steps to ensure that any communications are relevant, proportionate, and directed towards organisations that may reasonably have an interest in our Services.

Recipients of marketing or business development communications have the right to object to such processing at any time. If you no longer wish to receive communications from us, you may contact us using the details provided on our website or reply directly to any communication requesting that no further contact be made.

We maintain appropriate records of such requests and will honour them in accordance with applicable data protection laws.

8. Data Sharing and Third-Party Service Providers

We may share personal data with trusted third-party service providers where this is necessary to operate our business, provide our Services and Digital Products, process orders and payments, maintain our website and online shop, communicate with customers, or comply with legal and regulatory obligations.

We do not sell personal data to third parties.

IONOS — Website and Online Shop

Our website and online shop are provided using services supplied by IONOS SE and its associated IONOS entities and service providers, as applicable to the services we use.

Where you purchase a Digital Product through our online shop, IONOS may process information necessary to create and administer your order. This may include your name, email address, billing and contact information, order details, product information, payment status, transaction information, IP address and other technical or order-related information necessary to operate the online shop.

IONOS may also process information necessary to provide order confirmation, digital-product delivery, customer account functionality, order administration, security and related online-shop services.

IONOS processes personal data in accordance with its own privacy and data-protection arrangements. Further information about data processing by IONOS products is available through IONOS's privacy and data-protection information.

Stripe and Link / Onelink — Payment Processing

Payments for Digital Products may be processed using Stripe's payment services, including its Link payment service (known as Onelink in the UK) where this option is used at checkout.

When you choose to pay using Link / Onelink, Stripe may process personal data and payment information necessary to authenticate the customer, process and secure the transaction, prevent fraud, manage payment methods and provide the Link / Onelink payment service.

Depending on the payment method and transaction, information processed by Stripe may include your name, email address, billing information, payment-method information, transaction details, device or technical information, and information required for authentication, fraud prevention and payment security.

We do not ordinarily receive or store your full payment card number or security code. Payment information is processed through Stripe's payment infrastructure in accordance with Stripe's applicable privacy notice and terms.

Where you have previously used Link / Onelink, Stripe may use information associated with your Link / Onelink account to facilitate a faster checkout experience, subject to Stripe's own terms and privacy practices.

Stripe may process certain personal data as an independent controller for its own purposes and may process other personal data on our behalf where applicable to the services provided. The respective roles depend on the particular processing activity and service involved.

For further information about how Stripe and Link / Onelink process personal data, please refer to Stripe's Privacy Centre and Privacy Policy.

Other Payment, Technology and Service Providers

Depending on the Services or Digital Products you purchase and the systems used at the time, we may also share relevant personal data with:

payment processors and payment service providers;

website and hosting providers;

online-shop and digital-product delivery providers;

email and communications providers;

accounting, bookkeeping and financial administration providers;

professional advisers, including legal, accounting or other professional advisers;

analytics, security and fraud-prevention providers; and

government, regulatory, law-enforcement or other authorities where disclosure is required or permitted by law.

We only share information that is reasonably necessary for the relevant purpose and, where appropriate, require service providers processing personal data on our behalf to handle that information in accordance with applicable data-protection requirements.

Payment Card Information

We do not ordinarily store customers' full payment card details on our own website or systems.

Payment card and other payment information is handled by the relevant payment service provider. The payment provider may process payment information directly in order to authorise, settle and secure the transaction, prevent fraud, comply with legal and regulatory requirements and provide its payment services.

International Data Transfers

Some of our third-party service providers may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we will take appropriate steps to ensure that the transfer is made in accordance with applicable UK data-protection law and that appropriate safeguards are in place where required.

The safeguards may include an adequacy regulation or decision, appropriate contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism recognised under applicable data-protection law.

Your Choices and Rights

Where a third-party provider processes personal data as part of providing services to us, your data-protection rights remain unaffected.

Depending on the circumstances and applicable law, you may have rights including access, rectification, erasure, restriction of processing, objection and data portability.

Further information about your rights and how to exercise them is provided in the relevant sections of this Privacy Policy.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse.

We also maintain professional business insurance with Hiscox Business Insurance.

10. Data Retention

Order and transaction records are retained for as long as reasonably necessary to fulfil legal, accounting, tax, contractual, dispute-resolution and regulatory requirements. Different categories of information may therefore be retained for different periods.

11. Your Rights

Under UK GDPR, individuals have the right to:

Access their personal data

Request rectification or erasure

Restrict or object to processing

Request data portability

Withdraw consent where applicable

Requests should be made in writing.

12. Data Protection Complaints

We are committed to handling personal data fairly, lawfully, and transparently. If you have any concerns about how we have collected, used, stored, or otherwise processed your personal data, we encourage you to contact us in the first instance so that we have the opportunity to investigate and resolve your concerns.

Data protection complaints should be submitted by email to:

Email: shaun.davis@the-virtual-desk.com

Please include sufficient information to help us identify your request or concern, including your name, contact details, and a description of the issue.

We will acknowledge receipt of your complaint as soon as reasonably practicable and aim to investigate and respond within one calendar month. Where a complaint is particularly complex or additional time is required, we will keep you informed of our progress.

If, after we have responded, you remain dissatisfied with the way your personal data has been handled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Information about making a complaint to the ICO is available at:
https://ico.org.uk/make-a-complaint/

13. Cookies

Our website uses cookies to distinguish you from other users and to help us improve our website.

Analytics Cookies

We use analytics cookies (such as Google Analytics or similar services) to collect information about how visitors use our website. These cookies collect information in an aggregated and anonymous form, including:

Pages visited

Time spent on pages

Traffic sources

Device and browser information

Analytics cookies help us understand how our website is used so we can improve its performance and usability.

Managing Cookies

You can control and manage cookies through your browser settings. You may choose to block or delete cookies; however, doing so may affect website functionality.

Analytics cookies will only be placed on your device where you have provided your consent through our cookie consent mechanism.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The most current version will always be published on our website.