Data Protection & Privacy Statement

UK GDPR & EU GDPR Compliant

Effective Date: 09 December 2026 | Version 1.3 (previous version)

---

 

1. About This Statement

This Data Protection & Privacy Statement explains how VUCITY LIMITED ("we", "us", "our") collects, uses, stores, and protects personal data in connection with the VU.CITY platform (the "Platform"). It applies to all business customers ("Customers") and the individual end users who access the Platform on their behalf.

We are committed to full compliance with the UK General Data Protection Regulation (UK GDPR) as retained in UK law by the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR) (Regulation 2016/679), as applicable to our operations and Customer base in the United Kingdom and European Union.

 

 

2. Who We Are - Data Controller Details

For the purposes of applicable data protection legislation, VUCITY LIMITED acts as:

• Data Controller for personal data we collect and process relating to our Customers’ account holders, billing contacts, and platform administrators
  
  
• Data Processor for personal data uploaded to the Platform by Customers as part of their use of our visualisation, query and analysis services. In this capacity, we process such data solely on the Customer’s documented instructions as outlined in our Data Processing Agreement (DPA)
  

 

Our registered details are:

 

3. Personal Data We Collect and Process

3.1 Account and Contact Data (Controller capacity)

When a business Customer contracts with us and creates an account, we collect and process the following personal data relating to their nominated contacts and administrators:

• Full name and job title of account holders and administrators
  
  
• Business email address and contact telephone number
  
  
• Billing and invoicing contact details
  
  
• IP addresses and device information for security and access logging
  

 

3.2 Financial and Billing Data (Controller capacity)

To process subscription payments, we collect billing information including payment card details and transaction records. Payment card data is processed exclusively by our payment processor Stripe and is not stored on our own systems. We retain invoicing records and transaction histories for statutory accounting purposes.

 

3.3 Usage and Behavioural Analytics (Controller capacity)

We collect data about how our users interact with the Platform, including feature usage, session duration, error logs, and navigation patterns. This data is used to improve platform performance and user experience. Where analytics tools process data that may be linked to an individual, this is governed by our sub-processor agreements.

 

3.4 Customer-Uploaded Data (Processor capacity)

Customers may upload datasets and proprietary data to the Platform for the purpose of data visualisation, query and analysis. Where such data contains personal data, we act solely as a Data Processor on the Customer’s instructions. Customers are responsible for ensuring they have a lawful basis for any personal data they upload, and for providing appropriate notices to their own data subjects. We do not access, analyse, or use Customer-uploaded data for any purpose other than delivering the contracted service.

 

3.5 AI-Powered Features (Processor capacity)

The Platform includes AI-powered features, such as Data Lab, which uses a large language model to carry out data tasks that a user asks for in plain language. These features are used only when a user elects to do so, and AI-generated output is labelled as AI in the Platform.

 

• How it works: The feature works only with data the user already has permission to access in the Platform, through a controlled set of operations. It produces text summaries and analysis that can lead to new data layers
  
  
• Human review: The user reviews the output before anything is added to the Platform. Outputs are advisory and must not be the sole basis for planning decisions, legal or compliance conclusions, or decisions about individuals. We do not use these features to make decisions about individuals. Users are told in the Platform that outputs are advisory
  
  
• Personal data: Customers should be mindful of the data they include in a request. Where a request, or the data it uses, contains personal data, we process it as a Data Processor on the Customer’s instructions under our DPA. Users are told in the Platform to be careful about including sensitive data in a request
  
  
• Model and location: The AI model is provided through Amazon Web Services (Amazon Bedrock) and runs in the UK, the EEA or Switzerland. Customer data is not used to train the model

 

4. Legal Basis for Processing

We rely on the following lawful basis under UK GDPR Article 6 and EU GDPR Article 6:

 

 

 

5. Sub-Processors and Third-Party Data Sharing

We engage the following sub-processors who may access or process personal data in the course of delivering our services. All sub-processors are bound by data processing agreements meeting the requirements of UK GDPR Article 28 and EU GDPR Article 28, and are required to implement appropriate technical and organisational security measures.

 

 

Our professional advisers, such as our accountants, receive personal data (for example customer and prospect contact and contract details) only as far as they need it to do their work. They are bound by confidentiality and, where they process personal data on our behalf, by written terms meeting UK GDPR Article 28.

We do not sell personal data to third parties. We do not share personal data with any party other than our sub-processors listed above and our professional advisers, unless required to do so by law or regulatory authority.

 

6. International Data Transfers

We will not transfer Customer Data outside the EEA without ensuring that at least one of the following safeguards is in place:

 

• Standard Contractual Clauses (SCCs) - UK Addendum to the EU SCC, incorporated into our sub-processor agreements
  
  
• UK International Data Transfer Agreements (IDTAs) - as approved by the ICO for UK personal data transfers

 

 

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this statement, or as required by applicable law. Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

 

8. Rights of Data Subjects

Where we act as Data Controller, individuals whose personal data we process have the following rights under UK GDPR and EU GDPR. Requests should be directed to our DPO at the contact details in Section 10.

Where we act as Data Processor (in relation to Customer-uploaded data), rights requests from end-users should be directed to the relevant Customer organisation as Data Controller. We will assist Customers in responding to such requests as required under our DPA.

 

 

 

9. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration, in accordance with UK GDPR Article 32 and EU GDPR Article 32. Our security measures include, but are not limited to:

 

• Encryption of personal data at rest and in transit (TLS 1.2+ / AES-256)
  
  
• Pseudonymisation of Customer Data where technically feasible and appropriate
  
  
• Role-based access controls and least-privilege principles
  
  
• Multi-factor authentication (MFA) for all administrative access
  
  
• Regular penetration testing and vulnerability assessments
  
  
• Ongoing confidentiality, integrity, availability, and resilience of processing systems
  
  
• Incident response and breach notification procedures (72-hour reporting to the ICO / relevant supervisory authority where required)
  
  
• Employee data protection training and confidentiality obligations
  
  
• Annual review of sub-processor security compliance

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay where the risk is high, in accordance with Articles 33–34 of the UK/EU GDPR.

 

10. Data Protection Officer

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy and ensuring compliance with applicable data protection legislation. The DPO is the first point of contact for all data protection queries, subject access requests, and complaints.

Contact our DPO — Name: Martin Denham. Email: trust@vu.city. Postal: 86-90 Paul Street, London, England, EC2A 4NE.

 

11. Right to Lodge a Complaint

If you have a concern about how we handle your personal data, you can complain to us directly through our DPO (Section 10). We will acknowledge your complaint within 30 days and aim to respond within 20 working days, keeping you informed. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority: UK data subjects with the Information Commissioner’s Office (ICO); EU data subjects with their national data protection authority.

 

12. Changes to This Statement

We will review and update this Data Protection and Privacy Statement periodically, and in response to changes in applicable law, regulatory guidance, or our processing activities. Where changes are material, we will notify Customers via email or in-platform notification with at least 30 days’ advance notice.

 

Use of Cookies

A cookie is a simple text file that is stored on your computer or mobile device by a website’s server and only that server will be able to retrieve or read the contents of that cookie. Each cookie is unique to your web browser. It will contain some information such as a unique identifier and the site name and some digits and numbers.

Cookies do lots of different jobs, like letting you navigate between pages efficiently, storing your preferences, analysing web traffic and generally improving your experience of a website. Cookies make the interaction between you and the website faster and easier. If a website doesn’t use cookies, it will think you are a new visitor every time you move to a new page on the site – for example, when you enter your login details and move to another page it won’t recognise you and it won’t be able to keep you logged in.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes. Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not.

Most browsers allow you to turn off the cookie function. If you want to know how to do this please look at the help menu on your browser.