Privacy Policy
This Privacy Policy explains how VIAVO LTD collects, uses, stores, shares and otherwise processes personal data in connection with viavo.design and with the administrative management, office operations, virtual assistant, records management, billing coordination, facilities support, corporate back-office outsourcing and workflow optimisation services that we provide from Flintshire, Wales, United Kingdom. It is written for website visitors, enquirers, clients, client personnel, suppliers and other professional contacts. It is not a substitute for a data processing agreement where we act as a processor for a client.
We process personal data in accordance with the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), each as amended. Please read this Policy with our Cookie Policy, Terms of Service and Terms and Conditions. If you are a client, the written service agreement and any data processing addendum prevail over this Policy to the extent they conflict about processing carried out on your documented instructions as a processor.
1. Identity of the data controller
The data controller for personal data processed for VIAVO LTD’s own business purposes, including the operation of viavo.design, enquiries addressed to us, our own client and supplier files, our own billing and statutory records, and the management of our own staff and applicants, is:
VIAVO LTD
24 St. Davids Drive
Connah's Quay
Deeside
CH5 4SR
United Kingdom
You may contact us about this Policy or any data-protection matter by writing to that address, by telephoning +44 7911 123456, or by emailing executive@viavo.design. Please mark correspondence “Data Protection”.
VIAVO LTD is a private limited company operating from Flintshire, Wales. The law of England and Wales applies to this Policy. The Information Commissioner’s Office (ICO) is the supervisory authority. If we determine purposes and means jointly with another organisation, we will identify that joint controller where practicable and put in place an Article 26 arrangement. In ordinary administrative work the client is usually the controller of its operational records and VIAVO LTD is a processor.
2. Scope of this Policy
This Policy applies to personal data processed in connection with visits to viavo.design; communications with us by email, telephone, post or in person from 24 St. Davids Drive, Connah's Quay, Deeside, CH5 4SR, United Kingdom; contracts for our administrative and support services; our own supplier relationships; recruitment of our own personnel; and compliance with our legal obligations as a United Kingdom company.
This Policy also describes how we handle personal data when we act as a processor for clients who outsource administrative, virtual assistant, records, billing, facilities or back-office functions to us. The client’s own privacy notice is then the primary notice for the client’s customers, employees and contractors. Describing those activities here does not make VIAVO LTD the controller of the client’s operational data.
This Policy does not apply to processing by third-party websites or tools that we do not control, even if reached from a link on viavo.design, or to processing carried out solely by a client on systems the client owns or licences independently of us. Nothing in this Policy limits any right that cannot be limited under the UK GDPR or the Data Protection Act 2018. We provide administrative management and office support. We are not a locksmith, physical security contractor, cybersecurity vendor, surveillance operator or access-control hardware provider. Brand language on our website about profiles, alignment or clearance refers to workflow and administrative coordination, not to a security product.
3. Controller and processor
A controller determines the purposes and means of processing. A processor processes personal data on behalf of a controller. VIAVO LTD occupies both roles. That distinction matters for an administrative services firm because much of our work involves other organisations’ records under instruction, while a separate stream of processing relates to running our own company.
We act as controller when we decide why and how personal data are processed for VIAVO LTD’s own purposes. Typical controller activities include operating viavo.design, recording and answering enquiries, maintaining our own client relationship records and invoices issued in our name, keeping supplier files, managing accounts and tax records, handling complaints, establishing or defending our own legal claims, and recruiting our own staff. If you complete a contact form, telephone +44 7911 123456, or email executive@viavo.design about our services, we are the controller of the personal data you supply and of the records we create from it.
We act as processor when a client engages us to perform administrative, virtual assistant, records management, billing coordination, facilities support, back-office outsourcing or workflow optimisation tasks involving personal data of which the client is the controller. We then process on documented instructions for the duration of the engagement and do not use those data to build a marketing list or sell insights.
Administrative work often sits close to the boundary. If VIAVO LTD needs a piece of personal data in order to run its own company, we are the controller. If we handle a piece of personal data only because a client has asked us to perform an administrative task on that client’s behalf, we are a processor. We are not the controller of a client’s employee payroll file merely because we see names, hours or bank details while coordinating bookkeeping packs. We are not a mere processor of the invoice we issue for our own fees, nor of the identity of the authorised signatory with whom we contract.
Where a client requires a written data processing agreement, we will enter into one. Article 28 of the UK GDPR requires a contract setting out the subject matter, duration, nature and purpose of the processing, the types of personal data, the categories of data subjects, and the obligations and rights of the controller. If a data subject whose data we hold only as a processor contacts us to exercise UK GDPR rights, we will not decide the request as if we were the controller. Unless legally prohibited, we will inform the client promptly and assist so that the client can respond within the statutory period.
Where we act as processor we process only on documented instructions, including with regard to transfers, unless United Kingdom law requires otherwise. Persons authorised to process personal data are under confidentiality duties. We take Article 32 measures proportionate to the risk, respect the client’s authorisation model for further processors, and assist the client with data-subject rights and breach notification so far as the nature of the processing allows.
4. Categories of personal data
The categories below describe the types of personal data we typically handle. We do not collect all of them in every case. What we collect depends on how you interact with us and, where we act as processor, on what the client instructs. We do not seek special category data as a routine part of administrative services.
Website visitors and enquirers. When you visit viavo.design we may process technical and usage data such as internet protocol address, browser and device type, pages viewed, date and time of visit, and similar diagnostic information generated by the site or by cookies as described in our Cookie Policy. When you contact us we process name, job title, organisation, email address, telephone number, postal address if supplied, the content of your message, and a record of our reply.
Clients and prospective clients. For organisations that enquire about or purchase our services we process business contact details of authorised individuals, contractual data such as services selected, commercial terms, authorised signatories, billing entity details and records of instructions, and financial data needed to raise and collect our own fees. We do not store full payment-card numbers in our ordinary administrative files. If a payment is made through a regulated payment provider, that provider is the controller of the card data it collects.
Suppliers, contractors and professional contacts. We process identity, contact, contractual and payment data relating to suppliers and independent contractors who support VIAVO LTD, together with correspondence needed to manage those relationships. Where a supplier’s staff attend our premises or access our systems, we may process visitor or access-log data limited to office administration of our own environment.
Our own staff and applicants. If you apply to work with VIAVO LTD we process the information you submit, typically identity and contact details, curriculum vitae, work history, qualifications, right-to-work information, interview notes and, if appointed, the data needed to pay you and meet employment, tax and immigration law. This website is not a recruitment portal unless we expressly say so on a given page.
Client operational records processed as a processor. When a client outsources administrative work to us, the personal data we see are those that already exist in, or are created for, the client’s own operations. They commonly include names and business contact details of the client’s customers, suppliers and counterparties; diary entries and meeting logistics; correspondence we are asked to draft, file or send; board or management packs; facilities records such as contractor attendance and room bookings; and workflow metadata such as task owners and due dates. Virtual assistant services frequently involve access to a client’s email, calendar and document stores, which can reveal personal data of third parties who never dealt with VIAVO LTD directly. We treat that access as processor activity and expect personnel to open and act only on what the engagement requires.
Client workforce data in bookkeeping, billing and administrative coordination. Billing coordination and bookkeeping support are a regular part of corporate back-office outsourcing. We may process personal data relating to a client’s employees, workers, contractors and, occasionally, their dependants if such details appear on a payroll, expenses or benefits record that the client has asked us to compile, check, format or pass to the client’s accountant or payroll bureau. Typical elements include name, employee or contractor identifier, department, job title, hours or attendance summaries, expense amounts, bank details for reimbursement where supplied, and tax identifiers if they appear on the documents. We are not, unless a written engagement says otherwise, the client’s employer, payroll operator or professional accountant. The client remains the controller of its workforce data and must ensure that its staff privacy notice covers an administrative outsourcing provider. We will not use client workforce data to contact those individuals for VIAVO LTD’s own marketing, combine one client’s employee data with another’s, or retain payroll or bank details of a client’s staff in our sales systems.
Records management holdings. Records management may involve structured and unstructured files containing personal data of many kinds. We may index, scan, name, store, retrieve, redact under instruction, or prepare files for destruction under instruction. We do not read every page of a large archive unless the client has commissioned a review. If we discover special category data, children’s data, or material that appears to have been collected unlawfully, we will notify the client and pause wider use until instructions are confirmed. We do not use a client’s records as training material for unrelated artificial-intelligence models, and we do not permit personnel to upload client records to consumer generative-AI tools that are not approved for that engagement.
Special category and criminal offence data. Special category data include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for uniquely identifying a person, data concerning health, and data concerning a person’s sex life or sexual orientation. Criminal offence data are subject to additional rules in the Data Protection Act 2018. We do not request those data through viavo.design. If they appear incidentally in a client file, for example a sickness note in an expenses pack, we process them only as a processor on the client’s instructions and only as needed to complete the instructed administrative step. The client must have a lawful basis and an Article 9 condition and, for criminal offence data, a valid condition under the Data Protection Act 2018.
Facilities and office operations. When we provide facilities support to a client, we may handle visitor names, contractor company names, arrival times, delivery contacts and maintenance descriptions that identify a member of staff. Those data are the client’s operational records. The client should tell its visitors that an administrative provider may process the log. We will not use visitor logs to market our services.
5. How we collect personal data
We collect personal data directly from you when you browse viavo.design, complete a form, call us, email us, write to us, meet us or contract with us. We collect personal data from the organisation that employs or engages you when that organisation is our client or supplier and nominates you as a contact or includes your details in operational files.
When we act as processor, the client is the principal source and may grant us access to inboxes, shared drives, accounting exports, facilities systems or paper files. We may also receive personal data from third parties the client has authorised us to contact, solely to complete the instructed task. We do not buy consumer marketing lists or harvest personal email addresses for unsolicited electronic marketing.
6. Lawful bases
Where we act as controller, we rely on one or more of the lawful bases in Article 6 of the UK GDPR. We do not process personal data without a lawful basis. The basis depends on the purpose. We do not treat consent as the default basis for ordinary business operations, because much of our processing is necessary for contract or for legitimate interests, or is required by law.
Contract. Article 6(1)(b) applies where processing is necessary to take steps at your request before entering a contract or to perform a contract with you, including delivering administrative services to an individual client, invoicing, and taking pre-contract steps an applicant has requested. It does not apply to a company’s employee merely because the company is our client; in that case we usually rely on legitimate interests as controller of the business contact record, or we act as processor for the employer.
Legal obligation. Article 6(1)(c) applies where processing is necessary to comply with a legal obligation to which VIAVO LTD is subject, including tax and company records, binding requests from a competent United Kingdom authority, right-to-work checks for our own staff, and accounting requirements laid down in United Kingdom law.
Legitimate interests. Article 6(1)(f) applies where processing is necessary for legitimate interests pursued by VIAVO LTD or by a third party, except where those interests are overridden by your interests or fundamental rights and freedoms. Our legitimate interests include operating a professional website, responding to business enquiries, keeping records of what was agreed, managing relationships with corporate clients and nominated contacts, preventing misuse of our communications channels, establishing or defending legal claims, and conducting limited business-to-business communication about our services where PECR allows. You may object to processing based on legitimate interests.
Consent. Article 6(1)(a) applies where you have given clear consent for a specific purpose. We use consent for non-essential cookies as described in the Cookie Policy, and for electronic marketing to individual subscribers where PECR requires consent. Consent must be freely given, specific, informed and unambiguous. You may withdraw it at any time by using the cookie controls or by contacting executive@viavo.design. Withdrawal does not affect prior lawful processing.
We do not ordinarily rely on vital interests or public task. VIAVO LTD is not a public authority. Where we act as processor, we do not select the Article 6 basis for the client’s processing; that is the client’s responsibility. We may refuse or pause work if it is obvious that the instructed processing would infringe the UK GDPR. Special category data processed as controller would also need an Article 9 condition. Such processing is not part of our ordinary website or service sales activity.
7. Purposes of processing
We process personal data as controller for the purposes below. We do not process personal data for incompatible further purposes unless we obtain a new lawful basis, we anonymise the data, or the UK GDPR otherwise permits.
We process technical data to operate viavo.design, diagnose faults and prevent abuse, subject to cookie rules, and we process enquiry data to reply and keep a record of the exchange. We process client-contact and contractual data to prepare proposals, agree scope, deliver administrative services, take instructions, invoice, collect payment and manage variations and endings of contracts. Where the contract is with an organisation, we process the personal data of the people who represent that organisation in dealing with us.
When acting as processor we process client operational data, including client customer, supplier and workforce data, solely to perform the instructed administrative, virtual assistant, records, billing, facilities or workflow tasks and to meet our duties of confidentiality, quality and assistance. We do not use those data to market VIAVO LTD to the client’s customers or staff. We process business contact data to administer the professional relationship, to send necessary service communications, and, where the law allows, to tell business contacts about relevant administrative services. Service messages required to perform a contract are distinguished from marketing, which is subject to PECR.
We process visitor and contractor data as needed to receive people at 24 St. Davids Drive, Connah's Quay, and to keep a proportionate attendance record. We process billing and accounting data to maintain books, file returns, deal with HMRC and Companies House as required, obtain legal advice, and establish or defend legal claims. We process applicant and staff data to recruit, meet employment law, pay people and manage our own personnel. That purpose is separate from any client workforce data we see as a processor. Workflow optimisation performed as a processor looks at process rather than private lives; we minimise use of live personal data where a redacted sample would suffice, and we do not implement monitoring of client staff productivity unless the client has commissioned that work, has a lawful basis, and has informed its staff.
8. Sharing personal data
We do not sell personal data and we do not share personal data for third parties’ independent marketing. We share only what is needed for a lawful purpose. Within VIAVO LTD, personal data are available to personnel who have a need to know, with role-based access so that work on one client’s files does not confer casual access to another client’s files.
We share personal data with service providers who process data for us as our processors, which may include website hosting, email and productivity suites, secure storage, accounting software, telecommunications, professional advisers acting for VIAVO LTD, and IT support contractors bound by confidentiality. We require those processors to enter into written terms that meet Article 28.
We may share personal data with a client’s other suppliers where the client instructs us to do so as part of administrative coordination, for example sending an invoice pack to the client’s accountant or confirming a delivery with a courier the client uses. In those cases we act as the client’s processor. We do not appoint additional sub-processors for client operational data without the client’s authorisation.
We may share personal data with competent authorities if required by law, including HMRC, Companies House, the ICO, the courts of England and Wales, and other public bodies with a legal power to compel disclosure. We may share personal data with insurers, professional indemnity advisers and legal representatives where necessary to obtain advice or to handle a claim.
9. International transfers
VIAVO LTD is established in the United Kingdom and operates from Flintshire, Wales. Our primary place of processing for our own files is the United Kingdom. Some of our service providers, or the infrastructure they use, may be located outside the United Kingdom. Where we transfer personal data to a country that is not covered by a United Kingdom adequacy regulation, we will put in place an appropriate safeguard as required by Chapter V of the UK GDPR, typically the UK International Data Transfer Agreement or the UK Addendum to the EU Commission Standard Contractual Clauses, together with a transfer risk assessment proportionate to the data and destination.
Where we act as processor, we will not transfer the client’s personal data outside the United Kingdom except as the client authorises, or as required by United Kingdom law. If a client instructs us to use a particular overseas platform that the client already uses, the client is responsible for satisfying itself that the transfer arrangement is lawful. Our personnel ordinarily work in the United Kingdom.
10. Retention
We keep personal data no longer than is necessary for the purposes for which they are processed, taking into account legal, regulatory, tax, accounting and reporting requirements, and the need to keep evidence in case of complaints or legal claims. Necessity is assessed by category and purpose, not by an arbitrary single date for every record we have ever seen.
Website enquiry records that do not lead to a contract are typically retained for up to twenty-four months after the last meaningful contact, unless a longer period is needed because a dispute is reasonably in prospect. If an enquiry becomes a client engagement, the correspondence is retained as part of the contractual file. Our own contractual, billing and accounting records are typically retained for six years from the end of the financial year to which they relate, or longer if a tax enquiry or unresolved dispute makes continued retention necessary.
Recruitment records for unsuccessful applicants are typically retained for six to twelve months after the process ends, unless a longer period is justified by a discrimination or other claim risk. Staff files are retained for the duration of the relationship and then for a period determined by employment, tax and limitation rules. Cookie data follow the periods stated in the Cookie Policy.
When we act as processor, retention of client operational records is determined by the client’s instructions and by the processing agreement. At the end of the engagement we will, at the client’s choice, delete or return the personal data, and delete existing copies, unless United Kingdom law requires storage, or unless a limited copy must be retained by us as controller because it forms part of our own contractual correspondence, invoices, or evidence in an actual or reasonably anticipated claim.
11. Security
We implement technical and organisational measures appropriate to the risk, taking into account the state of the art, cost, the nature and purposes of processing, and the likelihood and severity of harm to individuals. Administrative services involve concentrated access to other organisations’ files, so confidentiality is a central risk we manage. This Policy describes how an administrative firm protects personal data in its care; it is not a security-product specification.
Organisational measures include need-to-know access, confidentiality briefings, written processor terms, and a clear distinction between VIAVO LTD’s own files and client operational repositories. Technical measures appropriate to our size typically include authenticated access, unique credentials, encryption in transit for web and email services provided through reputable platforms, and least-privilege permissions on shared drives. We do not publish client personal data on viavo.design.
No method of transmission or storage is completely secure. We cannot guarantee absolute security of information sent to executive@viavo.design or submitted through a website form. Do not send special category data, full bank details of third parties, or large employee files through an ordinary website form unless we have agreed that channel. Where we are controller and a personal data breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the ICO, normally within 72 hours of becoming aware of it, and we will notify affected individuals where the law requires. Where we are processor, we will notify the client without undue delay after becoming aware of a breach affecting that client’s data.
12. Your rights
If we process your personal data as controller, you have the rights summarised below, subject to the conditions and exemptions in the UK GDPR and the Data Protection Act 2018. If we process your personal data only as a processor for a client, you should address your request primarily to that client, and we will assist the client as described in section 3.
Right to be informed. This Policy is the principal means by which we inform website users and people who deal with VIAVO LTD in its own right. We provide additional information at the point of collection where needed to make the processing fair.
Right of access. You may request confirmation of whether we process your personal data and, if so, a copy of that data together with the supplementary information required by the UK GDPR, including purposes, categories, recipients, retention, your other rights, the source of the data if not collected from you, and any Article 22 automated decision-making.
Right to rectification. You may ask us to correct inaccurate personal data and to complete incomplete personal data. A record of what you said at a given date is not inaccurate merely because you later changed your mind, although we can note the later position.
Right to erasure. You may ask us to erase personal data in the circumstances set out in Article 17. The right is not absolute. We may refuse where processing is necessary for a legal obligation or for the establishment, exercise or defence of legal claims. Erasure of our own invoice records before the end of the tax retention period will usually be refused.
Right to restriction. You may ask us to restrict processing where you contest accuracy, where processing is unlawful and you oppose erasure, where we no longer need the data but you require them for legal claims, or where you have objected and we are considering the balancing test.
Right to data portability. Where we process personal data by automated means on the basis of consent or contract, you may request those data in a structured, commonly used and machine-readable format, and you may request transmission to another controller where technically feasible. This right does not apply to paper-only files or to data we process solely as a processor.
Right to object. You may object, on grounds relating to your particular situation, to processing based on legitimate interests. You may object at any time to processing for direct marketing. If you object to direct marketing we will stop. For other legitimate-interest processing we will stop unless we demonstrate compelling legitimate grounds or the processing is for legal claims.
Rights related to automated decision-making. We do not currently make solely automated decisions that produce legal or similarly significant effects about website visitors, enquirers or clients. Human review is involved in whether we accept an engagement, how we staff it, and how we handle a complaint. Simple business rules, such as routing an email or flagging a duplicate invoice, assist human administrators and are not Article 22 decisions.
Right to withdraw consent. Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect prior lawful processing.
You may exercise rights by writing to VIAVO LTD, 24 St. Davids Drive, Connah's Quay, Deeside, CH5 4SR, United Kingdom, by telephoning +44 7911 123456, or by emailing executive@viavo.design. We may ask for information to confirm identity where we have reasonable doubts. We will respond without undue delay and within one month of a valid request, with a possible extension of two months for complex or numerous requests. We will not charge a fee as a rule, but we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.
13. Complaints to the ICO
We hope to resolve concerns directly. Please contact executive@viavo.design or write to us at 24 St. Davids Drive, Connah's Quay, Deeside, CH5 4SR, United Kingdom. You have the right to lodge a complaint with the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. Helpline: 0303 123 1113. Website: ico.org.uk.
Because VIAVO LTD operates from Flintshire, Wales, under the law of England and Wales, the ICO remains the relevant supervisory authority. You also have the right to seek a judicial remedy in the courts of England and Wales. Nothing in this Policy requires you to waive that right.
14. Cookies, PECR and electronic communications
viavo.design uses cookies and similar technologies as described in our Cookie Policy, which you should read together with this Policy. That page explains what cookies are, which categories we use, the difference between strictly necessary cookies and other cookies, how long they last, how you can control them in your browser, and how consent is obtained and withdrawn.
PECR sits alongside the UK GDPR for cookies and for electronic marketing. We do not store or access information on your device unless it is strictly necessary for a service you have requested, or you have consented, subject to the limited exceptions PECR allows. We do not send unsolicited marketing emails or SMS messages to individual subscribers without a PECR-compliant consent or another PECR-permitted ground. We honour opt-out requests. Service messages about an existing engagement, invoices and replies to your enquiries are not treated as marketing.
15. Children
Our website and our administrative services are directed at organisations and at adults acting in a professional capacity. We do not knowingly offer services directly to children, and we do not knowingly collect personal data from children through viavo.design. If we act as a processor and a client’s files include personal data of children, for example a dependant named on a benefits document in a bookkeeping pack, we process those data only on the client’s instructions and only as needed for the administrative task. We will not use such data for VIAVO LTD’s own purposes. If we discover that a child has submitted personal data through the website, we will delete it unless we are required to retain it for a safeguarding or legal issue.
16. Third-party sites and client systems
viavo.design may contain links to other websites. Those sites have their own privacy notices and we are not responsible for their processing. If you grant us access to a client system, we use it only to perform instructed administrative work and we relinquish access when the engagement ends.
17. Operations in Wales and England
VIAVO LTD operates from 24 St. Davids Drive, Connah's Quay, Deeside, CH5 4SR, in Flintshire, Wales, United Kingdom. Deeside sits in North Wales, close to the border with England. Our personnel may deal with clients, suppliers and counterparties in Wales, in England, and elsewhere. The governing law of this Policy, and of our ordinary contracts unless otherwise agreed in writing, is the law of England and Wales.
We produce this Policy in English. Operating from Wales does not reduce the application of the UK GDPR. Physical files, if any, are handled at or from the Flintshire office; telephone calls to +44 7911 123456 are received in the United Kingdom; and postal notices to the address above are the proper method of giving us written notice. Visitor or contractor data we collect on a client’s site for the client’s purposes are processed as a processor. Our own timesheets and fee records generated from that visit are processed as controller.
18. Changes to this Policy
We will review this Policy whenever our processing, our services or the law changes in a way that makes the current text inaccurate. The date at the top of this page shows when the current version took effect. Material changes will be indicated by updating that date and, where appropriate, by a notice on viavo.design or a message to affected clients. Contracted processing as a processor will not be changed to a new purpose by a website update alone.
19. How to contact us
For any question about this Privacy Policy, for any request to exercise data-protection rights where VIAVO LTD is the controller, and for any privacy complaint about our own processing, please contact:
VIAVO LTD
24 St. Davids Drive
Connah's Quay
Deeside
CH5 4SR
United Kingdom
Email: executive@viavo.design
Telephone: +44 7911 123456
Website: viavo.design
Please do not send special category data, third-party bank details or large employee files to the website contact form unless we have agreed that method. If you are contacting us about personal data that we hold only as a processor for a named client, please identify the client if you can. This Policy applies from 2 September 2026 and should be read with the Cookie Policy, Terms of Service and Terms and Conditions.