Legal
Privacy Policy
1. Data controller
Varqyst Ltd, a company registered in England and Wales (company number 16293847), with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ (referred to as "Varqyst", "we", "our", "us").
- Email: hello@varqyst.co.uk
- Data Protection Officer: dpo@varqyst.co.uk
2. Data we collect
We collect the following data through our website:
Contact form: name, email address, subject, message.
Newsletter subscription (optional): email address.
Browsing data: IP address, browser type, pages visited, visit duration — via cookies (see Cookie Policy).
3. Purposes and legal bases
| Purpose | Legal basis (UK GDPR Art. 6) |
|---|---|
| Responding to contact enquiries | Legitimate interest (Art. 6.1.f) |
| Sending newsletter (if subscribed) | Consent (Art. 6.1.a) |
| Website analytics (Cookiebot) | Consent (Art. 6.1.a) |
| Spam protection (reCAPTCHA) | Legitimate interest (Art. 6.1.f) |
4. Data retention
| Category | Retention period |
|---|---|
| Contact form data | 12 months after last correspondence |
| Newsletter subscription | Until consent is withdrawn |
| Cookies | See Cookie Policy |
5. Data recipients
Your data is processed exclusively by Varqyst Ltd. The following processors may access certain data in the course of their services:
- Hosting provider: servers in the United Kingdom / European Economic Area
- Cookiebot: consent management (Cybot A/S, Denmark — EEA)
- Google reCAPTCHA: spam protection (Google LLC, United States — transfer governed by the UK International Data Transfer Agreement and EU-US Data Privacy Framework)
6. International transfers
Google reCAPTCHA may involve data transfer to the United States. This transfer is governed by the UK International Data Transfer Agreement (IDTA) and the EU-US Data Privacy Framework, in accordance with UK GDPR Article 46.
7. Your rights
Under UK GDPR and the Data Protection Act 2018, you have the following rights:
- Right of access (Art. 15) — obtain confirmation of processing and a copy of your data
- Right to rectification (Art. 16) — correct inaccurate or incomplete data
- Right to erasure (Art. 17) — request deletion of your data
- Right to restriction (Art. 18) — restrict processing in certain circumstances
- Right to data portability (Art. 20) — receive your data in a structured format
- Right to object (Art. 21) — object to processing based on legitimate interest
- Right to withdraw consent — at any time, without affecting the lawfulness of prior processing
To exercise these rights: dpo@varqyst.co.uk or by post to Varqyst Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.
Response time: 30 days.
8. Complaints
If you believe our processing of your data violates UK GDPR, you may lodge a complaint with the Information Commissioner's Office (ICO):
- ICO — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- Website: ico.org.uk
- Phone: 0303 123 1113
9. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. The site uses HTTPS (TLS 1.2+).
10. Cookies
For cookie management, please see our Cookie Policy.
11. Changes to this policy
We may update this policy from time to time. The date of the last update is shown below. Material changes will be communicated via a notice on the website.
Last updated: 16 April 2026