DRAFT FOR SOLICITOR REVIEW. Not final, not in force, and not to be published (VEY-58).
Veydr privacy notice
Version: draft 1 (18 Oct 2026). Values in square brackets are for Amadis to fill in.
This notice explains how Amadis Consultancy Ltd uses personal data about people who visit the Veydr website, buy a Veydr assessment, or are named as contacts by a customer. How we handle the data inside a customer's systems during an assessment is covered by our data processing agreement with that customer, not this notice.
Who we are
Amadis Consultancy Ltd, [registered office], is the controller for the data described here. ICO registration C2050030. Contact: [role mailbox].
What we collect and why
| Data | Where it comes from | Why we use it | Lawful basis |
|---|---|---|---|
| Name, work email, company and billing address | You, at checkout | To take your order, send the contract pack and invoice you | Contract |
| Payment details | You, entered on Stripe's page | Stripe takes the payment; we never see or store card numbers | Contract |
| Contact details of named staff (for example the emergency stop contact) | The customer's scope form | To run the assessment safely and reach the right person | Legitimate interests: running the service the customer bought |
| Emails and call notes | Our correspondence with you | To deliver the assessment and answer questions | Contract; legitimate interests |
| Feedback you choose to give | The feedback form | To improve the service | Legitimate interests |
[To confirm once the sign-up page is built (VEY-61):] The Veydr website is a static page. It sets no cookies and runs no analytics of its own. Stripe's checkout page sets its own cookies, described in Stripe's privacy notice.
Who we share it with
- Stripe, to take payment (Stripe privacy notice).
- [Mail provider], which carries our email.
- [Feedback form provider], if you fill in the feedback form.
- Our professional advisers and insurers, where needed.
- Authorities, where the law requires it.
We do not sell personal data, and no AI system is given customer data.
How long we keep it
| Data | Kept for |
|---|---|
| Order, invoice and payment records | [6] years after the end of the financial year, for tax and accounting |
| Contract pack, scope form and report | [6] years after the engagement, as a record of what was authorised and delivered |
| Correspondence and contact details | Until the engagement ends, then [12] months |
Where it is processed
In the UK or the EU. Stripe may transfer data outside them under its own safeguards.
Your rights
You can ask for a copy of your data, or ask us to correct, delete or restrict it, to object to our use of it, or to move it to another provider. Write to [role mailbox]. You can complain to the Information Commissioner's Office (ico.org.uk), though we'd like the chance to put it right first.
Changes
We will publish any change here with its date.
Questions for the solicitor
- Are the lawful bases in the table right, particularly legitimate interests for a customer's named staff?
- Are the retention periods justified, and does the 6-year period for scope forms need a separate basis?
- Does Stripe's role as a separate controller for payment data need more than the link given?
- Does a static page with no cookies of its own still need a cookie notice, given Stripe's checkout sets cookies?
- Is anything missing that Articles 13 and 14 of the UK GDPR require?
- Which feedback form provider is acceptable, and does it need to be named?