Privacy notice
This privacy notice explains how [Legal entity name] ("VectraComm", "we") processes personal data when you visit vectracomm.com, request a walkthrough, download a PDF summary, rate or share the page, or use the VectraComm service. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the CPRA, India's Digital Personal Data Protection Act 2023, Singapore's Personal Data Protection Act, Brazil's LGPD and similar laws. Where a law gives you more rights than described here, that law applies.
1. Who is responsible
Controller: [Legal entity name and legal form], [registered address], registered under [register and number].
Data protection contact: [privacy@vectracomm.com]. [Name of data protection officer, if appointed].
EU representative (Article 27 GDPR, if the controller is outside the EU): [name and address].
UK representative (if outside the UK): [name and address].
2. What we process, why, and on what legal basis
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Walkthrough request form | Name, work email, organization, monthly volume band, interests, free-text notes, consent timestamp, language | Answering your request, preparing a walkthrough and an offer | Consent (Art. 6(1)(a)); steps before a contract (Art. 6(1)(b)) | 12 months after the last contact, or until deletion is requested |
| PDF summary download | Name, work email, consent timestamp, the estimator settings you chose | Sending or generating the summary and following up on your interest | Consent (Art. 6(1)(a)) | 12 months |
| Product news (optional tick box) | Email, name, opt-in timestamp | Occasional product updates | Consent (Art. 6(1)(a)); withdraw with the unsubscribe link in every email | Until you unsubscribe, then 3 years in a suppression list so we do not write again |
| Usage measurement (after consent in the banner) | Section and button clicks, scroll depth, estimator settings, screen width, random session id, time | Understanding which parts of the page help visitors | Consent (Art. 6(1)(a); ePrivacy rules on storage access) | 13 months |
| Page rating (thumbs up or down) | Your rating, optional comment, random session id, time | Improving the page | Legitimate interest in improving our site (Art. 6(1)(f)); the comment field is free text, so please do not put personal data in it | 13 months |
| Translation (after consent) | Page text and your language choice, processed by Google | Showing the page in your language | Consent (Art. 6(1)(a)) | Google's own retention; the googtrans cookie lasts for the session or until cleared |
| Server logs | IP address, time, requested page, browser and referrer | Security, abuse prevention, delivering the page | Legitimate interest in a secure service (Art. 6(1)(f)) | [14 days] |
| Preferences | Theme, text size, language, consent choices, whether you rated the page, stored in your browser's local storage | Remembering your choices | Strictly necessary for a service you asked for (no consent needed) | Until you clear browser data; the consent record expires after 12 months |
We do not use the data for automated decisions with legal or similar effects, and we do not sell personal data or share it for cross-context behavioural advertising.
3. Where the data goes
- Hosting and delivery: [hosting provider and region], delivered through Cloudflare, Inc., which also records cookieless performance measurements (a beacon to cdn-cgi/rum) for site reliability. Processors under their data processing terms.
- Form and lead handling: FormSubmit (formsubmit.co), which forwards form submissions to our mailbox. Processor under a data processing agreement.
- Fonts: Google Fonts loads from Google's servers, which receive your IP address. [Confirm whether fonts will be self-hosted before launch; if so, delete this line.]
- Translation: Google LLC, only when you accept translation and pick a language. Google acts as an independent controller for that processing.
- Analytics tooling: [name the tag manager or analytics provider, if any, and its location].
When data leaves the European Economic Area or the United Kingdom, we rely on an adequacy decision (for example the EU-US Data Privacy Framework for certified recipients) or on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, plus supplementary measures where needed. You can ask for a copy of the safeguards.
4. Your rights
Depending on where you live, you can ask us to: access the data we hold about you and receive a copy; correct it; delete it; restrict its use; give it to you or another provider in a portable format; stop processing based on legitimate interest; stop direct marketing at any time; and withdraw any consent you gave, without affecting processing before the withdrawal. You also have the right not to be discriminated against for exercising these rights.
Write to [privacy@vectracomm.com] or to the postal address above. We answer within one month (45 days for California residents) and may ask for enough information to confirm your identity. You may appoint an authorised agent where the law allows. If you are unhappy with our answer, you can complain to a supervisory authority: your EU member state authority, the UK Information Commissioner's Office (ico.org.uk), the California Privacy Protection Agency, the Data Protection Board of India, Singapore's PDPC, or [another competent authority].
Global Privacy Control. When your browser sends the GPC signal, we treat it as a request to opt out of usage measurement and of any sale or sharing, and the banner keeps measurement off.
5. The VectraComm service
When an organization subscribes to VectraComm, the organization is the controller of the recipients' personal data it sends through the service, and VectraComm acts as its processor under the agreement accepted on AWS Marketplace and the Data Processing Addendum at [link]. Recipients who receive messages sent by a VectraComm customer should contact that customer about their data; we help customers answer such requests.
6. Security
Data on this site is transmitted over TLS and stored in access-controlled systems. Form submissions are limited to the people who answer them. The service itself is designed for isolation per customer, customer-controlled encryption keys and audit logging; details are in our security documentation available on request.
7. Children
This site addresses businesses and public bodies. We do not knowingly collect data from anyone under 16, and we delete such data when we learn of it.
8. Changes
We update this notice when our processing changes and show the date at the top. Material changes are announced on the site; where consent is needed for a new purpose, we ask for it.