Privacy notice
How we process personal data collected through this website and related direct communications, under UK GDPR Articles 13 and 14.
Last updated: 12 June 2026
1. Who we are (the controller)
Vula Capability Systems Ltd is the data controller for personal data collected through this website and related direct communications.
- Registered in England and Wales
- Company number: 17243290 (incorporated 26 May 2026)
- Registered office: 14 Hurricane Court, Heron Drive, Langley, Slough, SL3 8FA, United Kingdom
- Privacy contact: privacy@vulacap.com
For general commercial enquiries unrelated to data protection, use hello@vulacap.com.
2. What personal data we collect
2.1 Data you provide via website forms or direct contact
When you complete an enquiry or founding cohort application form on this site, or contact us directly, we collect:
- Your name
- Your work email address
- Your organisation
- Your role (optional)
- The nature of your interest and any context you choose to provide in the message field
- Where you tick the optional marketing consent box, a record of that consent
We do not knowingly collect special category data through this site. Please do not submit special category personal data through the enquiry form — if a discussion requires it, we will agree a secure channel.
2.2 Technical data collected automatically
When you visit the site, we may also collect limited technical information such as your IP address, browser type, device information, pages visited, timestamps, server logs, and your cookie preference record. This information is used to operate the site, protect it from misuse, and meet basic security and accountability obligations.
2.3 Analytics data (where applicable)
We do not currently set analytics cookies. If we introduce analytics in future and you have given consent (or where an applicable PECR exemption applies — see our cookie notice for the DUAA 2025 position), we may process aggregate analytics information about how visitors use the site.
3. Why we process your personal data and the lawful basis
We process personal data for the following purposes, each with its own lawful basis under UK GDPR Article 6:
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Responding to business enquiries from organisations and their representatives | Art. 6(1)(f) — legitimate interests (operating a professional services and training practice and answering enquiries directed to us). Balancing assessment available on request. |
| Assessing an individual's own cohort application or other application for an individual credential | Art. 6(1)(b) — steps prior to entering into a contract at the request of the individual; or Art. 6(1)(f) — legitimate interests where the contract is with the individual's organisation |
| Maintaining business contact records, learner administration, assessment records, and credential management | Art. 6(1)(f) — legitimate interests; or Art. 6(1)(b) where the contract is directly with the individual |
| Sending optional marketing updates where you have ticked the marketing-consent box on a form | Art. 6(1)(a) — consent (you can withdraw at any time) |
| Optional analytics cookies (if and when enabled) | Art. 6(1)(a) — consent (where consent is required under PECR) |
| Meeting legal, tax, accounting, sanctions-screening, anti-fraud, and regulatory obligations where applicable | Art. 6(1)(c) — legal obligation |
4. Provision of personal data is voluntary
Providing information through our website forms or direct contact is voluntary. However, if you do not provide the information requested, we may not be able to respond to your enquiry, assess your application, issue or maintain a credential, or progress a potential engagement.
5. How long we keep your personal data
- Enquiry and cohort application data where no engagement follows: 24 months from the last contact, then deleted.
- Where an engagement begins: retained for the life of the engagement and for the period required by professional record-keeping and tax obligations (typically 6 years from the end of the engagement).
- Marketing consent and contact records: retained until consent is withdrawn, then deleted. We re-confirm consent at appropriate intervals.
- Credential records: retained for the validity period of the credential and a further period appropriate to credential governance.
- Server logs and technical data: retained for a short operational period (typically 30 days) for security, troubleshooting, and accountability purposes.
6. Who we share your personal data with
We use a small number of carefully selected service providers to run this site and our practice:
- Netlify, Inc. — website hosting and form processing.
- Microsoft Corporation — email and document infrastructure (Microsoft 365).
- Any other service providers and sub-processors named in our register, available on request and surfaced in the Trust Centre.
We do not sell personal data. We do not share personal data with marketing networks.
7. International transfers
Some service providers (notably Netlify and Microsoft) may process personal data outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on an appropriate transfer mechanism, such as:
- A UK adequacy regulation (UK GDPR Art. 45);
- The UK Extension to the EU-US Data Privacy Framework, where the recipient is certified and the transfer is covered;
- The UK International Data Transfer Agreement (IDTA);
- The UK Addendum to the EU Standard Contractual Clauses;
- Another applicable safeguard under UK GDPR Article 46.
The mechanism used for a specific transfer is recorded in our service provider register.
8. Automated decision-making
We do not use personal data collected through this website to make decisions based solely on automated processing that produce legal or similarly significant effects on you (UK GDPR Art. 22).
9. Security
We apply appropriate technical and organisational measures to protect personal data (UK GDPR Art. 32). Further information about our security posture is available in our Trust Centre.
10. Your rights
Under UK GDPR Articles 12–22 you have the right to:
- Be informed about how we use your personal data — that is the purpose of this notice and the Trust Centre
- Access the personal data we hold about you (Art. 15)
- Rectify inaccurate or incomplete personal data (Art. 16)
- Erase personal data where the relevant grounds apply (Art. 17)
- Restrict processing in defined circumstances (Art. 18)
- Receive a copy of personal data in a portable format (Art. 20) where applicable
- Object to processing carried out on the basis of legitimate interests, including for direct marketing (Art. 21)
- Withdraw consent at any time where processing relies on consent (Art. 7(3)) — this does not affect the lawfulness of processing carried out before the withdrawal
- Not be subject to a decision based solely on automated processing with legal or similarly significant effects (Art. 22) — we do not currently make any such decisions
These rights are not absolute and may apply differently depending on the lawful basis for processing and the circumstances of the request.
To exercise any of these rights, contact our DPO at privacy@vulacap.com. We will respond within one calendar month (UK GDPR Art. 12(3)), with the right to extend by a further two months for complex requests — we will tell you within the first month if an extension applies.
11. Complaining to the supervisory authority
You have the right to lodge a complaint with the UK Information Commissioner's Office:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
For EU residents, you may complain to a supervisory authority in the Member State where you live, where you work, or where the alleged infringement took place.
We would, of course, appreciate the opportunity to address your concern first — please write to privacy@vulacap.com. You are not required to contact us before complaining to the ICO.
12. Source of the personal data we hold about you
Personal data we hold about you is provided directly by you through this website, our forms, or subsequent direct communication. Where we hold any personal data about you that you have not provided directly — for example, professional information from LinkedIn or other public sources — we will tell you about it on first contact (UK GDPR Art. 14).
13. Changes to this notice
We will update this notice as our processing changes or the regulatory landscape evolves. The "Last updated" date at the top reflects the most recent revision. Material changes will be notified to known data subjects with a substantive contact relationship.