1. Introduction

1.1 Vera and Vale is committed to safeguarding the privacy and confidentiality of our website visitors, clients, subjects of investigation, and service users.

1.2 This policy applies where we act as a data controller in respect of personal data, meaning we determine the purposes and means of processing that personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant professional standards.

1.3 In this policy, “we”, “us” and “our” refer to Vera and Vale.

2. How We Use Your Personal Data

2.1 This section explains:

(a) the categories of personal data we may process;
(b) the sources of that data where not obtained directly;
(c) the purposes of processing; and
(d) the lawful bases relied upon.

2.2 Usage Data

We may process data relating to your use of our website (“usage data”). This may include IP address, browser type, device information, pages visited, time and date of access, and navigation paths.

Purpose:

Website security, performance monitoring, and service improvement.

Lawful basis:

Legitimate interests.

2.3 Client and Enquiry Data

Where you contact us or engage our services, we may process personal data including name, contact details, role, employer, instructions provided, and related correspondence (“client data”).

Purpose:

  • Assessing enquiries
  • Providing investigative and advisory services
  • Contract management and communication

Lawful basis:

  • Performance of a contract
  • Legitimate interests
  • Legal obligations

2.4 Investigative Data

Due to the nature of our work, we may process personal data relating to:

  • Individuals who are subjects of investigation
  • Witnesses, associates, or third parties
  • Open-source intelligence and lawful surveillance outputs

This data may include special category data or data relating to alleged unlawful conduct where strictly necessary and lawful.

Purpose:

  • Conducting private, corporate, legal, and risk investigations
  • Public figure and personal risk advisory services
  • Prevention, detection, or investigation of wrongdoing

Lawful basis:

  • Legitimate interests
  • Establishment, exercise, or defence of legal claims
  • Substantial public interest (where applicable under Schedule 1 DPA 2018)

2.5 Communications Data

We may process information contained in communications you send to us (“communications data”), including emails, telephone notes, and contact form submissions.

Purpose:

Communication, record-keeping, and service delivery.

Lawful basis:

Legitimate interests and contractual necessity.

2.6 Legal, Insurance, and Risk Management

We may process personal data where necessary for:

  • Legal advice
  • Professional indemnity insurance
  • Risk management
  • Regulatory or professional compliance

Lawful basis:

Legitimate interests and legal obligations.

2.7 Confidentiality Notice

We do not accept unsolicited personal data about third parties unless explicitly requested. Any data provided without request may be deleted or returned.

3. Sharing Personal Data

3.1 We may disclose personal data to:

  • Legal advisers, insurers, and professional consultants
  • IT and secure communications providers
  • Law enforcement or regulatory authorities where legally required

3.2 All third parties are required to respect confidentiality and data protection obligations.

3.3 International transfers will only occur where appropriate safeguards are in place (such as UK-approved Standard Contractual Clauses).

4. Data Retention

4.1 Personal data is retained only for as long as necessary for the purposes for which it was collected.

4.2 Typical retention periods:

  • Website usage data: up to 24 months
  • Client and investigative records: 6–7 years following case closure, or longer where required for legal or regulatory reasons

4.3 Data may be retained longer where required for:

  • Legal proceedings
  • Professional obligations
  • Protection of vital interests

5. Amendments

5.1 We may update this policy from time to time.

5.2 The latest version will always be available on our website.

6. Your Rights

You have rights under UK data protection law, including:

  • Right of access
  • Right to rectification
  • Right to erasure (subject to legal limitations)
  • Right to restrict or object to processing
  • Right to data portability
  • Right to complain to the Information Commissioner’s Office (ICO)

Certain rights may be lawfully restricted where exercising them would prejudice investigations, legal claims, or the rights of others.

Requests may be made in writing using the contact details below.

7. Cookies

7.1 We use cookies for:

  • Website analytics
  • Security
  • Cookie consent management

7.2 Cookies do not typically identify you directly.

8. Managing Cookies

You can manage or disable cookies through your browser settings. Blocking cookies may affect website functionality.

9. Our Details

Business name: Vera and Vale

Email: contact@veraandvale.co.uk

Further contact details are available on our website.

10. Data Protection Contact

For privacy-related enquiries or data subject requests, please contact:

Email: contact@veraandvale.co.uk