Privacy Policy

1. Who is responsible for your data

Velkeep is the controller for data about our website visitors, our customers' account holders and billing contacts.

If you are a guard or member of staff using Velkeep through your employer, your employer is the controller of your data and we process it on their behalf under a Data Processing Agreement. Please contact your employer first about your data; we will help them answer you.

2. What we collect

• Account details: name, username, email, phone number, company name, address, company and VAT numbers, password (stored only as a secure hash), and two-factor settings.
• Work records (on behalf of your employer): photos of assets, the time, GPS location and accuracy when a photo or check-in is taken, shift start and end times, rota shifts, swap requests and incident reports.
• Technical data: IP address, browser and device type, sign-in times and an audit log of important actions, used to keep the service secure.
• Billing data: plan, invoices and payment status. Card and PayPal details are handled by Stripe and PayPal; we never see full card numbers.
• Messages you send us and alert settings, including phone notification subscriptions.

3. Why we use it and our lawful basis

• To provide the service you signed up for (contract).
• To keep accounts secure, prevent fraud and abuse, and fix problems (legitimate interests).
• To keep financial and tax records (legal obligation; HMRC requires records to be kept for 6 years).
• To send product news, only if you opted in (consent; you can withdraw it at any time).
• Work records are processed only on your employer's instructions.

4. Who we share it with

We do not sell personal data. We use carefully chosen service providers ("sub-processors") to run Velkeep:

We may also share data if the law requires it, or to protect our rights or someone's safety.

5. Data sent outside the UK

Some providers above process data outside the UK, including in the USA. When they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or on the UK International Data Transfer Agreement or Addendum, so your data stays protected.

6. How long we keep it

• Account and work records: while the customer's account is open. After it closes we delete or anonymise them within 90 days, unless the customer asks us to delete them sooner.
• Invoices and payment records: 6 years after the end of the financial year they relate to.
• Security logs: up to 2 years.
• Website enquiries: up to 2 years after our last contact.

7. How we protect it

Data is encrypted in transit. Passwords are stored as salted hashes. Secret keys are encrypted. Sign-ins are rate-limited, managers can use two-factor sign-in, and every important action is logged. Access to production systems is restricted.

8. Your rights

You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, to have it transferred, and to withdraw consent. Contact us at the email address on our website. We will reply within one month.

If you are unhappy, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to put things right first.

9. Cookies

We only use the cookies and browser storage needed to make Velkeep work. See our Cookie Policy.

10. Children

Velkeep is a workplace tool and is not meant for children.

11. Changes

We will update this policy when our practices change and show the date of the latest version at the top.