DraftDraft: to be reviewed by legal counsel. This text is a template and is not yet legally binding. Details in [square brackets] are placeholders.
On this page
In short
- We collect only what we need to reply to you and deliver our work.
- We never sell your personal data.
- You can ask to see, correct or delete your data at any time.
Last updated 27 September 2026
1. Who we are
This policy explains how VAUG [legal entity name] ("VAUG", "we", "us") handles personal data when you visit vaug.in, contact us, or work with us. We are registered in [country] under company number [number], with our registered office at [address].
For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the EU General Data Protection Regulation (EU GDPR), we are the controller of the personal data described here. Where we process data on a client's behalf as part of a project, we act as a processor under a separate data processing agreement.
If you have any questions, email privacy@vaug.in. [If appointed: our Data Protection Officer can be reached at the same address. Our EU representative is [name, address].]
2. Data we collect
We collect personal data in three ways:
- Data you give us: your name, work email, company, phone or WhatsApp number, budget range and the details of your project when you fill in a form, email us or book a call.
- Data we collect automatically: technical information such as IP address, browser type, device, pages visited and referring site, collected through essential cookies and, with your consent, analytics tools.
- Data from others: business contact details from public sources such as LinkedIn or company websites, or from partners who introduce you to us.
We do not intentionally collect special category data (such as health or biometric data) through this website. Please don't send it to us unless we've agreed a secure way to handle it.
3. How we use your data and our lawful basis
We only use personal data when the law allows us to. In practice:
- To reply to your enquiry and prepare a proposal: legitimate interests, or steps taken at your request before entering a contract.
- To deliver and manage a project, send invoices and keep records: performance of a contract and legal obligation.
- To send occasional updates or newsletters: consent, which you can withdraw at any time using the unsubscribe link.
- To measure and improve our website: consent, for non-essential analytics cookies.
- To keep our website and systems secure and prevent fraud or spam: legitimate interests.
- To handle job applications: steps taken at your request, and legitimate interests in hiring the right people.
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that assessment.
4. AI tools and automated decisions
We use AI tools to help us work faster, for example to summarise enquiries or draft documents. We only use providers that do not train their models on data we submit, under contracts that protect confidentiality.
We do not make decisions that have legal or similarly significant effects on you using automated processing alone. A person always reviews enquiries, proposals and job applications.
6. International transfers
Our team works across India, the UK and the USA, so your data may be accessed from outside the UK or the European Economic Area.
When that happens, we protect it with appropriate safeguards: adequacy regulations or decisions where they exist, and otherwise the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses, together with supplementary measures where needed. You can ask us for a copy of the relevant safeguards.
7. How long we keep data
We keep personal data only as long as we need it:
- Enquiries that don't become projects: up to [24] months after our last contact.
- Client and project records: for the length of the contract plus [6] years, for legal and tax purposes.
- Job applications: up to [12] months after the role is filled, unless you agree to a longer period.
- Marketing preferences: until you unsubscribe, after which we keep a suppression record so we don't contact you again.
After that, we delete or anonymise it securely.
8. How we protect data
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls on a need-to-know basis, multi-factor authentication, and regular reviews of our suppliers. Our practices are aligned with recognised frameworks such as ISO 27001; formal certification is on our roadmap.
No system is perfectly secure. If a breach is likely to put your rights at risk, we will tell you and the relevant regulator as the law requires.
9. Your rights
Under UK and EU data protection law you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data deleted in certain circumstances.
- Restrict or object to how we use your data, including for direct marketing.
- Receive your data in a portable format.
- Withdraw consent at any time, where we rely on it.
To use any of these rights, email privacy@vaug.in. We'll reply within one month, and there's usually no charge.
If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) in the UK, or to your local supervisory authority in the EU.
11. Children
Our website and services are for businesses and are not directed at children under 16. We do not knowingly collect their personal data.
12. Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. If we make significant changes, we'll let active clients know directly.
13. Contact us
VAUG [legal entity name], [registered address]. Email: privacy@vaug.in.