Privacy Policy of Virsolus Limited

Privacy Policy for Virsolus Limited

Effective Date: 28 October 2025

Virsolus Limited (Company Number 13145816) (“Virsolus,” “we,” “us,” or “our”) is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data, and outlines your rights under UK data protection law.

1. Who We Are

Virsolus Limited is a management consultancy providing valuation, analytics, and advisory services.
For data protection purposes, Virsolus Limited is the Data Controller of the personal data you provide to us. This means we determine the purposes and means of processing your data.

2. The Data We Collect

We may collect, use, store, and transfer different types of personal data, grouped as follows:

• Identity Data – name, title, organisation.
• Contact Data – email address, postal address, telephone number.
• Financial Data – bank details and billing information.
• Transaction Data – details about payments, services purchased, and interactions      with Virsolus.
• Technical Data – IP address, browser type, device identifiers, login data.
• Usage Data – website usage information, interaction logs, analytics data.
• Marketing and Communications Data – your preferences regarding receiving      information from us.

We do not routinely collect Special Categories of Personal Data (e.g., health, racial or ethnic origin, religious beliefs). If such data is ever required, we will request explicit consent before collecting or processing it.

3. How We Collect Your Data

We collect personal data through:

a. Direct Interactions

You may provide Identity, Contact, Financial, or Marketing Data when you:

• Engage us for consultancy services
• Subscribe to publications or request marketing
• Communicate with us by email, phone, or in writing
• Provide feedback

b. Automated Technologies

As you interact with our website, we may automatically collect Technical and Usage Data through:

• Cookies
• Server logs
• Analytics tools (e.g., Google Analytics)

Non-essential cookies (including analytics) are used only with your consent, in accordance with PECR.

c. Third Parties and Public Sources

We may receive Technical or Usage Data from:

• Analytics providers (e.g., Google Analytics)
• Publicly available sources (e.g., Companies House)

4. Why We Use Your Personal Data (Purposes and Lawful Basis)

We process your personal data only when permitted by law. The table below summarises the main purposes, categories of data, and lawful basis:

Purpose/Activity

Type of Data Used

Lawful Basis for Processing

To provide consultancy services and manage our contract  with you

Performance of a contract

To process and deliver orders, payments, and invoices

Identity, Contact, Financial, Transaction

Performance of a contract; Legitimate interests   (recovering debts)

To manage our relationship with you, including notifying   you of changes

Identity, Contact, Marketing and Communications

Performance of a contract; Legal obligation; Legitimate   interests

To administer and protect our business and website   (troubleshooting, IT support, analytics, security)

Identity, Technical, Usage

Legitimate interests (running a secure, efficient business and website)

To send marketing communications

Identity, Contact, Marketing and Communications

Consent (where required); Legitimate interests (business development)

We do not use your personal data for automated decision-making or profiling.

5. International Transfers

Some of our service providers (e.g., email, cloud storage, analytics tools) may store or process your personal data outside the UK, including in the United States.

Where transfers occur, we ensure your data is protected through one or more of the following safeguards:

• Adequacy decisions issued by the UK Government
• The International Data Transfer Agreement (IDTA)
• The UK Addendum to the EU Standard Contractual Clauses (SCCs)
• Recognised  appropriate safeguards and technical protections

We will always ensure your personal data receives a level of protection essentially equivalent to that in the UK.

6. Sharing Your Personal Data

We may share your personal data with:

a. External Third Parties

• IT and system administration service providers
• Professional advisers (lawyers, accountants, insurers)
• Payment processors
• Regulators or authorities where required by law

All third parties are required to process your data securely and in accordance with UK GDPR. We do not sell your personal data to any third party.

7. Data Security and Retention

Security

We employ appropriate technical and organisational measures to prevent your data from being:

• Lost
• Misused
• Accessed without authorisation
• Altered or disclosed unlawfully

Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• Contractual obligations
• Legal, tax, accounting, or reporting requirements In general:
• Client-related data is retained for up to six years after the end of the      client relationship.
• Marketing data is retained until you withdraw consent or unsubscribe.

Where retention periods differ, we apply clear, documented criteria to determine appropriate timeframes.

8. Your Legal Rights

Under UK GDPR, you have the right to:

• Request access to your personal data
• Request correction of inaccurate or incomplete data
• Request erasure (“right to be forgotten”)
• Object to certain forms of processing
• Request restriction of processing
• Request transfer of your data to you or another party
• Withdraw consent at any time (for processing based on consent)

To exercise any of these rights, please contact us using the details below.

9. Cookies and Analytics

We use:

• Essential cookies (required for the functioning of the site)
• Analytics cookies (used only with your consent)

You can manage cookie preferences through our cookie banner and via your browser settings at any time.

10. Contact Details and Complaints

If you have questions about this Privacy Policy or wish to exercise your rights, please contact our Data Protection Lead:

Virsolus Limited
Email: privacy@virsolus.com

You have the right to lodge a complaint with:

The Information Commissioner’s Office (ICO)
www.ico.org.uk

We would, however, appreciate the opportunity to address your concerns before you contact the ICO.

This Privacy Policy May Be Updated

We may update this Privacy Policy from time to time. Any changes will be posted on our website with a revised "Effective Date."