Privacy Notice

Being finalised. This page will be completed and reviewed before services launch.

This notice explains what information VeraCrest holds about you, why, and for how long. Contact us at enquiries@veracrest.co.uk about anything on this page.

Visiting Our Websites

Our public pages do not use analytics, advertising or third-party scripts, and do not set cookies. Our hosting provider keeps standard server logs, which record things like the pages requested and the address they were requested from, to keep the sites running and secure.

Emailing Us

If you email us, we use your message and contact details to reply to you. Please do not send us your customers' personal details.

The Client Area

Clients and VeraCrest staff can sign in to the Client Area at veracrest.co.uk/account. Accounts are set up by VeraCrest; nobody can create one themselves.

What we hold about clients: the email address we set up for you, your name if given, your business name, which services and how many seats are on your plan, and when you last signed in. There is no password. Each time you sign in we email you a 6-digit code, and we store only a scrambled version of it.

VeraTrain training records: each person a client business adds is given their own sign-in. For each person we hold their name, work email, role (staff or manager), the business they belong to, and when they last signed in. When they finish a quiz, scenario, Spot The Risk exercise or the final assessment, we save the score and the date. We do not save their individual answers or how long they spend on pages. The person can see their own scores, and the managers of their business can see the scores of everyone in that business.

Why we hold training records: so the person and their managers can see progress, so managers can send reminders to people who have not finished, and to produce completion records.

What we hold about staff: name, email address, role, a scrambled version of the password, and the key for the authenticator app used for two-step sign-in.

Why we use it: to let you sign in and reach the services you have paid for, to email you sign-in codes, invitations, a welcome message and training reminders your manager asks us to send, and to keep the Client Area secure. For security we keep a sign-in log (sign-ins, failed attempts and account changes) and short-lived records that limit repeated attempts.

Cookies: signing in sets one essential cookie, called vc_s, which keeps you signed in. See our Cookies page.

Who else handles it: IONOS, our hosting and email provider, stores the Client Area and sends our emails on our behalf. We do not sell your information or share it for marketing.

No automated decisions: we do not make decisions about people by automated means.

How Long We Keep It

• Sign-in codes: deleted within a day; each code stops working after 15 minutes.
• Records that limit repeated sign-in attempts: deleted within a day.
• Sign-in log: 12 months.
• Client accounts and training records: while the business is a client. When a client leaves, we deactivate the business and it is deleted automatically 90 days later, with its people and their scores. When a manager removes a person, that person's sign-in stops straight away and their details and scores are deleted 90 days later.
• Staff accounts: while the person works with us.
• Emails: as long as needed to deal with your enquiry.

Your Rights

You can ask us for a copy of the information we hold about you, and ask us to correct it, delete it or limit how we use it. You have the right to object to how we use your information. To do any of these, email enquiries@veracrest.co.uk.

If you are unhappy with how we have used your information, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

Still To Be Added

Our company details and the legal basis for each use of your information will be added here once our company registration and legal review are complete.