Privacy Policy

Vigil Labs Ltd is a company registered in England and Wales under company number [17267620], with its registered office at [66 Paul Street, London, England, United Kingdom, EC2A 4NA]. We are registered with the Information Commissioner's Office (ICO) under registration number C2058392. Contact for privacy questions: founder@vigillabs.co.uk, or write to us at the address above, marked "Privacy".

How we handle your data depends on why we have it. Where we are the controller. We decide how and why the data is used. This applies to: - people who visit our website or contact us - our customers' account holders and staff users (names, log-ins, usage) - billing and contract information - prospects, partners and suppliers we deal with This policy covers all of the above. Where we are a processor. Venues use Vigil to keep their own records. These might include incident reports, refusals, bans, personal emergency evacuation plans (PEEPs), staff training records and CCTV-related information. For these records: - the venue is the controller and decides what is recorded and why - we are the processor, and we handle that data only on the venue's instructions, under a Data Processing Agreement (DPA) If you are a guest, a member of the public, or someone named in a venue's records, the venue is responsible for your data. Please contact the venue directly to ask about it or to exercise your rights. If you contact us instead, we will pass your request to the venue promptly and help them respond. We will not decide on it ourselves (see Your rights).

Website visitors - Information you send us. This includes your name, work email, phone number, organisation, role and message when you fill in a form, sign up for updates or email us. - Usage information. This includes pages viewed, referring site, device and browser type, approximate location (country/city level from IP address) and time on site. We only collect this through analytics cookies if you agree to them (see Cookies). Customers and users of the platform - Account details. These include name, work email, phone number, job title, the venues you're linked to, your role and permissions, and your log-in credentials. Passwords are stored only in hashed form. - Billing details. These include billing contact, company details, VAT number and payment history. Card details are handled directly by our payment provider, and we do not see or store full card numbers. - Usage and security data. This includes log-in times, IP addresses, device information, actions taken in the platform and audit logs of who viewed or changed a record. Audit logs are part of what makes Vigil's records tamper-evident. - Support and feedback. This includes messages, call notes and any information you share when asking for help. Prospects, partners and suppliers This includes contact details, organisation, role, and notes of our conversations and meetings. It may come from you directly, from someone who introduced us, or from public business sources such as company websites, Companies House and LinkedIn..

Under the UK GDPR, we need a lawful basis for each use of personal data. Ours are: - Providing the platform, setting up and managing accounts, giving support. Basis: contract. This is necessary to provide the service you or your organisation signed up for. - Billing customers and keeping financial records. Basis: contract and legal obligation (tax and accounting law). - Keeping the platform secure, detecting misuse and maintaining audit logs. Basis: legitimate interests, which are protecting our customers, their records and our service. - Improving the platform, fixing bugs and understanding which features are used. Basis: legitimate interests, which are running and developing our business. - Replying to enquiries and demo requests. Basis: legitimate interests, which are responding to people who contact us. - Sending service updates such as maintenance, security notices and changes to terms. Basis: contract and legitimate interests. - Sending product news to business contacts. Basis: legitimate interests for existing business customers, with an easy opt-out in every email. Consent for newsletter sign-ups. - Website analytics cookies. Basis: consent. - Complying with legal requests and defending legal claims. Basis: legal obligation and legitimate interests. Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for more detail about that assessment.

Some features of Vigil are designed to hold information that needs extra care. Venues decide whether and how to use them, as controllers. These include: - Personal emergency evacuation plans (PEEPs), which may include health or disability information - Incident and ban records, which may include allegations of offences or behaviour - Images and CCTV-related information - Optional facial recognition features, which are off by default and process biometric data only if a venue chooses to enable them For this data, the venue is responsible for having a lawful basis and any additional condition required under the Data Protection Act 2018. They are also responsible for being transparent with the people concerned. We support them by: - processing it only on their instructions - restricting access by role - logging every view and change - storing it in the UK and EEA - deleting it according to the retention rules the venue sets We do not use venue records for our own purposes, and we do not sell them.

Some Vigil features use artificial intelligence, for example answering questions about a venue's records and the law, summarising information, or producing readiness and risk scores. Where these features process personal data: - they are provided by carefully selected AI providers acting as our sub-processors (see Who we share data with) - data is sent only to produce the requested output, and is not used to train third-party AI models - outputs are suggestions for staff to review. No decision about a person is made solely by automated means. Decisions on entry, refusals, bans or evacuation are always made by people. We do not carry out automated decision-making that produces legal or similarly significant effects on individuals. 7. Cookies [ID: cookies] Our website uses: - Essential cookies. These are needed for the site and platform to work, for example keeping you logged in, security and remembering your cookie choices. These don't need consent. - Analytics cookies. These help us understand how the site is used. We only set them if you click "Accept" on our cookie banner, and you can change your choice at any time. We don't use advertising or cross-site tracking cookies.

We never sell personal data. We share it only with: Service providers (sub-processors) who help us run Vigil, under written contracts that require them to protect the data and use it only to provide their service to us: - [Provider]: database hosting and authentication ([region]) - [Provider]: infrastructure and file storage ([region]) - [Provider]: AI features ([region]) - [Provider]: payments ([region]) - [Provider]: transactional and service emails ([region]) - [Provider]: website hosting and forms ([region]) Professional advisers, such as our accountants, lawyers and insurers, where necessary. Authorities, where we are legally required to share data, for example with a court, the police, HMRC or a regulator with legal power to require it. Where the request concerns a venue's records, we will tell the venue first where the law allows. A buyer or successor, if Vigil Labs Ltd or its business is sold, merged or reorganised. Personal data may transfer to the new owner, who will be bound by this policy and our existing customer agreements. We will tell affected customers. Other venues, only at a venue's choice. Where a venue chooses to share records through a scheme feature such as Pubwatch, that sharing is the venue's decision as controller.

Under UK data protection law you have the right to: - access the personal data we hold about you - have inaccurate data corrected - have data erased in certain circumstances - restrict how we use it in certain circumstances - object to our use of it where we rely on legitimate interests, and at any time to direct marketing - data portability, which means receiving data you gave us in a usable format, where we rely on contract or consent - withdraw consent at any time, where we rely on consent To exercise any of these, email founder@vigillabs.co.uk. We will respond within one month. This can be extended by up to two further months for complex requests, in which case we'll tell you why. We may need to confirm your identity first. There is normally no charge. About a venue's records? If your request is about information a venue holds about you (for example an incident report or a ban), the venue is the controller. Contact them directly. If you contact us, we will forward your request to the venue promptly and help them respond within the legal deadline.

We store personal data in the United Kingdom and the European Economic Area. If any provider needs to process personal data outside these areas, we make sure appropriate safeguards are in place. These include a UK adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details.

- Website enquiries that don't become customers: [24 months] from last contact - Newsletter subscribers: until you unsubscribe - Customer account data: for the life of the account, then [number] days for export, then deleted - Billing and financial records: 6 years after the end of the financial year (tax law) - Security and audit logs: [number] months/years - Support correspondence: [number] years after the issue is closed - Venue records (processor): according to the retention rules each venue sets, and deleted [number] days after the customer's account ends Backups are overwritten on a rolling cycle of [60] days.

We protect personal data with appropriate technical and organisational measures, including: - encryption in transit (TLS) and at rest - role-based access, so people only see what their role needs - logging of access to records - tamper-evident sealing of records, so changes can be detected - secure development practices, automated testing and regular review of our suppliers No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify the ICO within 72 hours where required, and tell affected customers and individuals without undue delay.

Vigil is a business service and is not intended for children. We don't knowingly collect children's data as a controller. Venue records may sometimes include information about young people, for example a PEEP for an under-18 staff member or guest. In those cases the venue is the controller and is responsible for handling that data appropriately.

If you're unhappy with how we've handled your data, please contact us first at founder@vigillabs.co.uk. We will acknowledge your complaint within [30] days and respond without undue delay. You also have the right to complain to the Information Commissioner's Office: - Website: ico.org.uk - Helpline: 0303 123 1113

We may update this policy from time to time. We'll post the new version here and change the date at the top. If a change significantly affects how we use your data, we'll tell customers by email or in the platform before it takes effect.