Skip to content
Vancross

Privacy policy

Contact details

Vancross Consulting Limited, registered in England and Wales, company number 17508359.

Registered office: 203 West Street, Fareham, Hampshire, PO16 0EN

Email: info@vancross.ai

What information we collect, use, and why

We collect or use the following information to provide and improve products and services for clients:

  • Names and contact details
  • Occupation
  • Third party information (such as the person who referred you, or colleagues you mention)
  • Usage data (including information about how you interact with and use our website, products and services)
  • Records of meetings and decisions
  • Account access information
  • Company name, and details of how your business works that you give us in the booking questions

We collect or use the following personal information for information updates or marketing purposes:

  • Names and contact details
  • Marketing preferences

We collect or use the following personal information to comply with legal requirements:

  • Name
  • Contact information
  • Any other personal information required to comply with legal obligations

We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details
  • Correspondence
  • Your enquiry message and the company you work for

We collect or use the following personal information to record and transcribe calls, where you agree, and to use AI tools to analyse them and prepare your plan:

  • Names and contact details
  • Occupation
  • Third party information (such as colleagues you mention)
  • Records of meetings and decisions
  • Audio and video recordings of calls, and their transcripts

We may also collect the following special category information for this purpose:

  • Health information. We don't ask for it, but it sometimes comes up on a call, for example when someone explains what's taking up their time

Lawful bases and data protection rights

Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:

  • Contract - we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests are:

We use this information to provide the free AI opportunity assessment and our wider services, and to improve them. When someone books an assessment, they give us their name, contact details, their role and some details about how their business works, in answer to our booking questions. We use this to prepare for the call, run it, and write the free plan they asked for. We can't produce a useful plan without understanding how their business works, so this information is necessary. We only ask for what the plan needs, and our booking questions ask for job roles rather than staff names.

If someone tells us who referred them, we use that name only to thank the person who referred them.

If you enquire about AI training, you give us your name, contact details, your organisation, and roughly how many people would attend, through the booking questions or by email. We use this to arrange and run the enquiry call and to plan the session. If you go ahead, you may send us a list of attendees (names and work email addresses). We use it only to deliver the session and keep it secure, and we don't use the booking answers for anything else.

When we carry out work for a client, they give us access to their own accounts so we can build inside them. We use that access only for the agreed work, and the client can remove it at any time.

We also collect basic website usage information (page views, approximate location and device type) without cookies, to understand how our website is used and improve it. It doesn't identify individual visitors.

The person benefits directly: they get a free plan, and a better service if they go on to work with us. People who book a call or contact us expect us to use their details to respond and prepare. We keep the information to what's needed, keep it only as long as this notice says, and don't sell it or share it for anyone else's marketing. Because of these limits, we believe the benefits outweigh the possible impact on the people involved.

Our lawful bases for collecting or using personal information for information updates or marketing purposes are:

  • Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests are:

We send occasional emails about our services to people who have contacted us through our website about working with us. We use their name, email address and marketing preferences to do this. This is legitimate because they have already shown an interest in our services, and our emails only cover similar services to the ones they asked about. It's necessary because email is how we stay in touch with people who are deciding whether to work with us.

Every email includes a simple way to unsubscribe, and we record and respect that choice. We don't send marketing to anyone who hasn't contacted us, we don't buy or rent contact lists, and we don't share anyone's details for other organisations' marketing.

People who enquire about a service would reasonably expect to hear more about it, and they can stop it at any time with one click. Because of this, we believe the benefits outweigh the impact on them.

Our lawful bases for collecting or using personal information to comply with legal requirements are:

  • Legal obligation - we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Legal obligation - we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests are:

We use this information to answer enquiries sent through our website, and to deal with questions, complaints and data protection requests. When someone contacts us, we use their name, contact details, the company they work for, their message and any correspondence that follows. This is legitimate because they've asked us to respond, and necessary because we can't answer without it. We use AI tools to help draft our replies, and a person checks and approves every reply before it's sent.

If someone makes a complaint or a data protection request, we use their details and our records of what happened to look into it and respond properly. People who contact us expect us to use their details to reply. We only use what's needed to deal with their query, keep it only as long as this notice says, and don't share it for anyone else's marketing. Because of this, we believe the benefits outweigh the impact on them.

Our lawful bases for recording and transcribing calls, and using AI tools to analyse them and prepare your plan, are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Because health information can come up on a call, we also rely on your explicit consent for any special category information. We ask for your permission at the start of the call, before we start recording. If you say no, we don't record. You can withdraw your consent at any time by emailing info@vancross.ai, and we'll delete the recording and transcript.

For more information on our use of legitimate interests or consent as a lawful basis, you can contact us using the contact details set out above.

Where we get personal information from

  • Directly from you
  • Publicly available sources
  • Information collected automatically when you use our website (pages viewed, approximate location, device type, and your IP address, used briefly to prevent spam)
  • People who book with us, when they tell us who referred them

How long we keep information

We keep personal information only for as long as we need it, then delete it.

  • Enquiries and related emails: up to 24 months from our last contact with you.
  • Training enquiry booking answers and attendee lists: up to 24 months from our last contact with you.
  • Free assessment booking answers, notes and plans: up to 24 months from the call.
  • Free assessment call recordings and transcripts (including the call to go through your plan): up to 6 months from the call, unless you go on to work with us.
  • Discovery call recordings and transcripts: up to 6 months from the call, unless you go on to work with us.
  • Client call recordings and transcripts: for as long as we work together, and up to 12 months after our work ends.
  • If you ask us to delete a recording sooner, we will.
  • Client contracts, invoices and payment records: 6 years after our work together ends, because the law requires us to keep financial records.
  • Complaints and data protection requests: 6 years after they are closed.
  • Unsubscribe requests: we keep a record of your email address for as long as we send marketing emails, so we can make sure you don't receive them again.

Who we share information with

Data processors (organisations that handle personal information on our behalf as part of a service they provide to us):

  • Vercel: hosts our website and provides cookieless visitor analytics
  • Cal.com: call bookings and booking answers
  • Google Workspace: email, calendar and video calls
  • Fathom: records and transcribes calls, where you agree
  • Anthropic (Claude): AI used to help draft replies and prepare plans
  • Airtable: our record of enquiries and contacts
  • n8n: runs our enquiry and email automations
  • Resend: sends our emails
  • ntfy: phone alerts about new enquiries

Others we share personal information with:

  • Professional or legal advisors
  • Organisations we're legally obliged to share personal information with
  • Professional consultants

Sharing information outside the UK

Where necessary, we may transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.

  • Vercel Inc. (website hosting and analytics), USA: UK data bridge (UK Extension to the EU-US Data Privacy Framework)
  • Resend (email sending service), USA: UK data bridge (UK Extension to the EU-US Data Privacy Framework)
  • Fathom (call recording and transcription), USA: UK data bridge (UK Extension to the EU-US Data Privacy Framework)
  • Google (email, calendar and video calls), USA: UK data bridge (UK Extension to the EU-US Data Privacy Framework)
  • Airtable (database for enquiries and contacts), USA: UK Addendum to the EU Standard Contractual Clauses
  • Anthropic (AI provider), USA: UK Addendum to the EU Standard Contractual Clauses
  • n8n (workflow automation), Germany: adequacy regulations (the UK recognises the EU as providing adequate protection)
  • Cal.com (booking and scheduling), USA: UK data bridge (UK Extension to the EU-US Data Privacy Framework)

Where necessary, our data processors will share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

  • Amazon Web Services (cloud hosting used by several of our processors), USA: UK data bridge (UK Extension to the EU-US Data Privacy Framework)
  • Google Cloud (cloud hosting and AI infrastructure used by some of our processors), USA: UK data bridge (UK Extension to the EU-US Data Privacy Framework)

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: info@vancross.ai

If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO.

The ICO's address:

ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL

Helpline number: 0303 123 1113

Website: ico.org.uk/make-a-complaint