Legal Document

Privacy Policy

Version 1.0 Effective 4 July 2026 MJB Training and Consultancy Services t/a Vector Business Solutions

Important — whose data this covers. This policy covers data about our own customers (business owners and account administrators). It does not cover the personal data our customers load into Vector Velocity about their own clients and staff. For that data, our customer is the data controller and we act only as their processor, under the separate Data Processing Agreement. If you are a client or employee of a business that uses Vector Velocity, please contact that business directly.

1 Who we are

For the personal data described in this policy, MJB Training and Consultancy Services trading as Vector Business Solutions (VBS) is the data controller. We are established on the Isle of Man and registered with the Isle of Man Information Commissioner.

Registered address: 12 Mona Street, Douglas, Isle of Man IM1 2QD
Company / Registration No.: 031338B · Trading Name No.: 031789B
Privacy contact: enquiries@vectorsoftware.co.uk

2 What data we collect about you

Account and profile data

Your name, business name, email address and telephone number
Your login credentials (passwords are stored only in hashed form)
Your account settings, branding and preferences

Billing data

Your subscription plan and the modules you have enabled
Billing contact details and payment records
Card details are collected and stored directly by Stripe, not by us; we receive only limited information such as the last four digits, card type and payment status

Usage and technical data

Log data such as IP address, device and browser type, and timestamps
Records of your acceptance of our Terms, DPA and this policy (version, date, time and IP), kept as proof of agreement
Actions taken in the Service for security, troubleshooting and audit purposes

Support and communications

Messages you send us and our correspondence with you

3 How and why we use your data

Purpose	Lawful basis
Create and administer your account and provide the Service	Performance of our contract with you (Art. 6(1)(b))
Take payment and manage billing	Performance of contract; legal obligation for tax records
Secure the Service, prevent fraud and abuse, and maintain audit logs	Legitimate interests in running a secure service (Art. 6(1)(f))
Provide support and respond to your enquiries	Performance of contract; legitimate interests
Send service and administrative messages (billing, security, changes to terms)	Performance of contract; legitimate interests
Send marketing about VBS products, where permitted	Consent, or legitimate interests with an opt-out
Meet legal, tax and regulatory obligations	Legal obligation (Art. 6(1)(c))

We do not sell your personal data, and we do not use it to build advertising profiles.

4 Who we share it with

We share your personal data only with the infrastructure providers we rely on to run the Service, and only as needed:

Provider	Purpose	Location / transfer basis
Supabase	Database hosting and storage of account and application data	AWS EU (Frankfurt) — within EEA
Netlify	Application hosting and serverless functions	United States — EU SCCs / UK IDTA
Resend	Sending transactional email	United States — SCCs / applicable framework
Stripe	Payment processing — acts as independent controller for payment data under its own terms	US / Ireland — Stripe's own transfer terms

We may also disclose data where required by law, to protect our rights or the security of the Service, or in connection with a business sale or reorganisation. Our full sub-processor list is maintained in the Data Processing Agreement.

5 International transfers

Your core account data is hosted within the European Union. Some providers (Resend and Stripe) are based in the United States. Where personal data is transferred outside the Isle of Man / EEA, we rely on an appropriate safeguard — such as Standard Contractual Clauses or an applicable adequacy or certification framework — so that your data remains protected to an equivalent standard. Details are set out in the Data Processing Agreement, Annex B.

6 How long we keep it

Account and profile data — for as long as your account is active, then deleted within 90 days of your account closing
Billing and tax records — retained for up to 6 years to meet Isle of Man / UK tax and accounting requirements
Security and audit logs — retained for a limited period appropriate to their purpose
Acceptance records — retained for the life of the account and a reasonable period afterwards as proof of agreement

7 Your rights

Under the applied GDPR and the Isle of Man Data Protection Act 2018 you have the right to:

Access your personal data
Have inaccurate data corrected
Have your data erased
Restrict or object to certain processing
Receive your data in a portable format
Withdraw consent at any time
Opt out of marketing at any time

To exercise any of these rights, contact us at enquiries@vectorsoftware.co.uk. We will respond within one month. If you are unhappy with how we handle your data, you may complain to the Isle of Man Information Commissioner at inforights.im.

8 Security

We protect your data using appropriate technical and organisational measures, including encryption in transit and at rest, access controls, tenant isolation at the database level, and multi-factor authentication for administrative access. Our full security measures are described in the Data Processing Agreement, Annex C.

9 Changes to this policy

We may update this policy from time to time. Each version carries a version number and date, and material changes will be notified to you. The version in force is the one referenced at your most recent acceptance.