Data Protection & Privacy Statement

UK GDPR & EU GDPR Compliant

Effective Date: 30 June 2026 | Version 1.1

---

 

1. About This Statement

This Data Protection & Privacy Statement explains how VUCITY LIMITED ("we", "us", "our") collects, uses, stores, and protects personal data in connection with the VU.CITY platform (the "Platform"). It applies to all business customers ("Customers") and the individual end users who access the Platform on their behalf.

We are committed to full compliance with the UK General Data Protection Regulation (UK GDPR) as retained in UK law by the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR) (Regulation 2016/679), as applicable to our operations and Customer base in the United Kingdom and European Union.

 

 

2. Who We Are - Data Controller Details

For the purposes of applicable data protection legislation, VUCITY LIMITED acts as:

• Data Controller for personal data we collect and process relating to our Customers’ account holders, billing contacts, and platform administrators.
• Data Processor for personal data uploaded to the Platform by Customers as part of their use of our visualisation, query and analysis services. In this capacity, we process such data solely on the Customer’s documented instructions as outlined in our (Data Processing Agreement) DPA.

 

Our registered details are:

 

3. Personal Data We Collect and Process

3.1 Account and Contact Data (Controller capacity)

When a business Customer contracts with us and creates an account, we collect and process the following personal data relating to their nominated contacts and administrators:

• Full name and job title of account holders and administrators
• Business email address and contact telephone number
• Billing and invoicing contact details
• IP addresses and device information for security and access logging

 

3.2 Financial and Billing Data (Controller capacity)

To process subscription payments, we collect billing information including payment card details and transaction records. Payment card data is processed exclusively by our payment processor Stripe and is not stored on our own systems. We retain invoicing records and transaction histories for statutory accounting purposes.

 

3.3 Usage and Behavioural Analytics (Controller capacity)

We collect data about how our users interact with the Platform, including feature usage, session duration, error logs, and navigation patterns. This data is used to improve platform performance and user experience. Where analytics tools process data that may be linked to an individual, this is governed by our sub-processor agreements.

 

3.4 Customer-Uploaded Data (Processor capacity)

Customers may upload datasets and proprietary data to the Platform for the purpose of data visualisation, query and analysis. Where such data contains personal data, we act solely as a Data Processor on the Customer’s instructions. Customers are responsible for ensuring they have a lawful basis for any personal data they upload, and for providing appropriate notices to their own data subjects. We do not access, analyse, or use Customer-uploaded data for any purpose other than delivering the contracted service.

 

 

4. Legal Basis for Processing

We rely on the following lawful basis under UK GDPR Article 6 and EU GDPR Article 6:

 

 

5. Sub-Processors and Third-Party Data Sharing

We engage the following sub-processors who may access or process personal data in the course of delivering our services. All sub-processors are bound by data processing agreements meeting the requirements of UK GDPR Article 28 and EU GDPR Article 28, and are required to implement appropriate technical and organisational security measures.

 

 

We do not sell personal data to third parties. We do not share personal data with any party other than our sub-processors listed above, unless required to do so by law or regulatory authority.

 

 

6. International Data Transfers

We will not transfer Customer Data outside the EEA without ensuring that at least one of the following safeguards is in place:

• Standard Contractual Clauses (SCCs) - UK Addendum to the EU SCC, incorporated into our sub-processor agreements.
• UK International Data Transfer Agreements (IDTAs) - as approved by the ICO for UK personal data transfers.

 

 

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this statement, or as required by applicable law.

 

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

8. Rights of Data Subjects

Where we act as Data Controller, individuals whose personal data we process have the following rights under UK GDPR and EU GDPR. Requests should be directed to our DPO at the contact details in Section 10.

Where we act as Data Processor (in relation to Customer-uploaded data), rights requests from end-users should be directed to the relevant Customer organisation as Data Controller. We will assist Customers in responding to such requests as required under our DPA.

 

 

9. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration, in accordance with UK GDPR Article 32 and EU GDPR Article 32. Our security measures include, but are not limited to:

• Encryption of personal data at rest and in transit (TLS 1.2+ / AES-256)
• Pseudonymisation of Customer Data where technically feasible and appropriate
• Role-based access controls and least-privilege principles
• Multi-factor authentication (MFA) for all administrative access
• Regular penetration testing and vulnerability assessments
• Ongoing confidentiality, integrity, availability, and resilience of processing systems
• Incident response and breach notification procedures (72-hour reporting to the ICO / relevant supervisory authority where required)
• Employee data protection training and confidentiality obligations
• Annual review of sub-processor security compliance

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay where the risk is high, in accordance with Articles 33–34 of the UK/EU GDPR.

 

10. Data Protection Officer

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy and ensuring compliance with applicable data protection legislation. The DPO is the first point of contact for all data protection queries, subject access requests, and complaints.

 

Contact our DPO:

• Name: Martin Denham
• Email: trust@vu.city
• Postal: 86-90 Paul Street, London, England, EC2A 4NE

 

11. Right to Lodge a Complaint

If you have concerns about how we handle your personal data and are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority:

 

• UK data subjects: Information Commissioner’s Office (ICO)
• EU data subjects: Your national data protection authority

We would welcome the opportunity to address your concerns before you approach a supervisory authority, and encourage you to contact our DPO in the first instance.

 

12. Changes to This Statement

We will review and update this Data Protection and Privacy Statement periodically, and in response to changes in applicable law, regulatory guidance, or our processing activities. Where changes are material, we will notify Customers via email or in-platform notification with at least 30 days’ advance notice.