top of page

Privacy Policy

​

Last updated: 14 September 2026

​

Validay Ltd respects your privacy and is committed to protecting your personal information.

​

This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, contact us, work with us, attend a meeting or event, or use our consultancy and professional services.

Validay Ltd is a company registered in England and Wales under company number 15262430.

​

Website: https://validay.co.uk
Email: luke@validay.co.uk

For the purposes of UK data protection law, Validay Ltd will normally act as the data controller for the personal information described in this Privacy Policy.

Where we process personal information solely on behalf of a client as part of an engagement, we may instead act as a data processor, with the client remaining responsible as the data controller.

 

Information we collect

Depending on how you interact with Validay, we may collect and process information including:

  • your name;

  • job title and organisation;

  • business address;

  • email address and telephone number;

  • information you provide through our website or contact forms;

  • information provided when arranging a discovery call, meeting or consultation;

  • correspondence with us by email, telephone, messaging platforms or social media;

  • information relating to proposals, contracts, projects and client engagements;

  • billing, invoicing and payment information;

  • meeting notes and project records;

  • feedback, testimonials and survey responses;

  • information about how you interact with our website;

  • technical information such as IP address, browser type, device information and website usage data; and

  • publicly available professional or business information.

We may also receive your details through professional networking platforms, referrals, business directories, publicly available sources, events or other legitimate business sources.

​

Client and project information

As part of our work in areas such as testing, quality, transition, operational readiness and delivery assurance, clients may provide Validay with access to systems, documentation, project information or data.

Where this contains personal information, we will only access and process it where necessary for the relevant engagement.

Where Validay processes personal information on behalf of a client, our responsibilities will normally be governed by the relevant contract, data processing agreement and the client's documented instructions.

We encourage clients to use anonymised, pseudonymised or representative test data wherever reasonably possible.

We do not intentionally request special category personal information unless it is genuinely required for an engagement and an appropriate lawful basis, contractual arrangement and security measures are in place.

​

How we use your information

We may use personal information to:

  • respond to enquiries;

  • arrange meetings and discovery calls;

  • prepare quotations, proposals and statements of work;

  • provide our consultancy and professional services;

  • manage client and supplier relationships;

  • communicate about projects and engagements;

  • carry out testing, quality assurance, delivery assurance and transition activities;

  • manage contracts, invoicing and payments;

  • maintain appropriate business and project records;

  • improve our services and ways of working;

  • operate and improve our website;

  • protect our systems and information;

  • investigate security incidents or suspected misuse;

  • comply with legal, regulatory, tax and accounting requirements;

  • establish, exercise or defend legal claims;

  • request feedback or testimonials;

  • communicate relevant Validay services, insights, events or business updates where permitted by law; and

  • develop legitimate professional and business relationships.

We will not use personal information for purposes that are incompatible with the reason it was originally collected unless permitted or required by law.

 

Our lawful bases

Under UK data protection law, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on:

​

Contract

Where processing is necessary to enter into or perform a contract with you, including providing services, managing engagements and processing payments.

​

Legitimate interests

We may process information where necessary for our legitimate business interests and where those interests are not overridden by your rights and freedoms.

These interests may include:

  • responding to and managing business enquiries;

  • developing professional relationships;

  • providing and improving our services;

  • managing existing and prospective client relationships;

  • maintaining appropriate records;

  • protecting our business, systems and information;

  • understanding how our website and services are used; and

  • undertaking proportionate business-to-business marketing and business development.

Where we rely on legitimate interests, we consider whether the processing is necessary, proportionate and reasonably expected.

​

Legal obligation

Where processing is necessary for us to comply with a legal or regulatory obligation, including accounting, taxation and company-law requirements.

​

Consent

Where we rely on your consent, for example for certain marketing activities or non-essential website technologies where consent is required.

You can withdraw your consent at any time.

Withdrawing consent will not affect processing that was lawful before the withdrawal.

 

Business development & marketing

Validay may use relevant professional and business contact information to develop relationships with organisations and individuals who may have a legitimate interest in our services.

This may include contacting appropriate business representatives regarding services relating to testing, quality, transition, delivery assurance and related professional services.

Where we carry out direct marketing, we will comply with applicable UK data protection and electronic communications requirements.

You can ask us to stop sending marketing communications at any time by contacting us or using any unsubscribe mechanism provided.

We will maintain a limited suppression record where necessary to ensure that we respect an opt-out request.

​

Who we share information with

We do not sell your personal information.

We may share information where reasonably necessary with organisations including:

  • cloud hosting and IT providers;

  • website hosting and technology providers;

  • email and communications providers;

  • professional advisers such as accountants, insurers or legal advisers;

  • payment and banking providers;

  • CRM, project management and business administration providers;

  • analytics and website service providers;

  • subcontractors or specialist delivery partners involved in an engagement;

  • clients where necessary for the delivery of an agreed service;

  • law enforcement, regulators, courts or public authorities where required by law; and

  • prospective purchasers, investors or advisers in connection with a legitimate business transaction.

Where suppliers process personal information on our behalf, we expect appropriate contractual, confidentiality and security arrangements to be in place.

​

International transfers

Some organisations that provide technology or other services to Validay may process information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate safeguard is in place as required by UK data protection law.

Depending on the destination and circumstances, this may include:

  • UK adequacy regulations;

  • the UK International Data Transfer Agreement;

  • the UK Addendum to approved contractual clauses; or

  • another legally recognised transfer mechanism.

 

How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, regulatory and contractual requirements.

Typical retention periods may include:

  • general enquiries and prospective client information: normally up to 24 months after the most recent meaningful interaction;

  • client, contractual and project records: normally up to 6 years following completion or termination of the relevant relationship, where required for legitimate legal or business purposes;

  • financial and accounting records: for the period required by applicable tax and accounting legislation;

  • marketing information: until you opt out or it is no longer reasonable or necessary to retain it;

  • website and technical information: according to the purpose of the relevant technology and our operational and security requirements.

Some information may be retained for longer where necessary to establish, exercise or defend legal claims or comply with legal requirements.

Information that is no longer required will be securely deleted, anonymised or otherwise disposed of where reasonably practicable.

​

Information security

We take appropriate technical and organisational measures designed to protect personal information against:

  • unauthorised access;

  • accidental loss;

  • misuse;

  • alteration;

  • disclosure; and

  • destruction.

Measures may include appropriate access controls, authentication, encryption, secure cloud services, confidentiality requirements, backups, security monitoring and restricted access based on business need.

No internet or electronic storage system can be guaranteed to be completely secure. However, we regularly consider the security measures appropriate to the nature and sensitivity of the information we process.

​

Cookies and website technologies

Our website may use cookies and similar technologies to operate correctly, maintain security, remember preferences and understand how visitors use the website.

Some technologies are strictly necessary for the website to operate and may not require consent.

Where consent is legally required for non-essential cookies or similar technologies, they should not be activated until you have made an appropriate choice.

You can manage your preferences through the cookie controls available on our website and through your browser settings.

More detailed information about the cookies and technologies used by the Validay website may be provided through our cookie notice or consent management tool.

​

Your data protection rights

Depending on the circumstances, UK data protection law gives you rights including:

  • the right to be informed about how your information is used;

  • the right of access to personal information we hold about you;

  • the right to rectification of inaccurate or incomplete information;

  • the right to erasure in certain circumstances;

  • the right to restrict processing in certain circumstances;

  • the right to data portability where applicable;

  • the right to object to certain processing, including direct marketing;

  • the right to withdraw consent where processing relies on consent; and

  • rights relating to certain forms of automated decision-making and profiling.

These rights do not apply in every circumstance and may be subject to exemptions under applicable law.

To exercise a data protection right, contact:

Email: luke@validay.co.uk

We may need to verify your identity before completing a request.

You will not normally be required to pay a fee to exercise your rights.

 

Automated decision-making

Validay does not currently use personal information to make solely automated decisions that produce legal effects or similarly significant effects on individuals.

If this changes, we will update this Privacy Policy and provide any additional information required by law.

​

Links to other websites

Our website may contain links to third-party websites or services.

Validay is not responsible for the privacy practices of third-party websites. We recommend reviewing the privacy information provided by those organisations before supplying personal information.

 

Children's information

Validay's website and services are primarily intended for businesses and professional users.

We do not intentionally collect personal information directly from children through our website for marketing purposes.

Where an engagement may involve information relating to children or young people, appropriate contractual, legal and safeguarding considerations will be addressed with the relevant client before processing takes place.

​

Complaints

If you have concerns about how Validay handles your personal information, please contact us first so that we can investigate the matter.

Email: luke@validay.co.uk

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)
Website: https://ico.org.uk
Telephone: 0303 123 1113

 

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, business activities, technology or legal obligations.

The latest version will be published on our website with the date of the most recent update shown at the top of the policy.

Validay Ltd
Company number: 15262430
Registered in England and Wales
https://validay.co.uk
luke@validay.co.uk

bottom of page