Valla Solutions Privacy Policy

 

Privacy Notice

How Valla Solutions collects, uses, shares and protects personal information.

Effective date: 23 October 2026


1. Introduction

Valla Solutions respects your privacy and is committed to protecting your personal information.


This Privacy Notice explains how Valla Solutions collects, uses, stores, shares and protects personal information when you visit the website, enquire about services, engage Valla Solutions, act as a client, supplier or professional contact, or otherwise interact with the business.


2. Who we are

Valla Solutions is an independent UK consultancy providing practical governance, compliance, information governance and operational support, with a particular focus on healthcare organisations, private clinics, NHS-facing providers and small businesses.


Data controller: Ben Jones trading as Valla Solutions

Email: ben@vallasolutions.co.uk


Valla Solutions has not appointed a statutory Data Protection Officer for its own business. Questions about this notice or the use of personal information should be sent to Ben Jones.


3. Scope of this notice

This notice applies where Valla Solutions determines why and how personal information is used and therefore acts as a data controller.


During some client engagements, Valla Solutions may process personal information solely on a client’s documented instructions. In those circumstances, the client will normally be the controller and Valla Solutions will act as processor. The client’s privacy notice should explain that processing.


4. Personal information we may collect


4.1 Identity, professional and contact information

  • name, title, employer, role and professional contact details;
  • professional qualifications or registration details where relevant;
  • business address, biography and publicly available professional information;
  • email address, telephone number and communication preferences.

4.2 Enquiry, client and engagement information

  • emails, messages, enquiries and records of responses;
  • meeting notes, proposals, quotations and engagement terms;
  • project requirements, information supplied for review and agreed deliverables;
  • reports, policies, assessments, action plans and other consultancy outputs;
  • records of client decisions, approvals and project administration.

4.3 Financial and transaction information

  • billing, invoicing and payment-status information;
  • bank details provided for payments or refunds;
  • records required for accounting and taxation.

4.4 Website, technical and marketing information

  • IP address, browser and device information, security logs and cookie identifiers;
  • website activity and referral source;
  • areas of professional interest, marketing preferences, consent, objection and unsubscribe records.

4.5 Sensitive information

Valla Solutions does not ordinarily need special-category or criminal-offence information for routine business administration. Limited sensitive information may be encountered during healthcare governance, audit or compliance work. It will only be used where necessary for the agreed service, an applicable legal condition has been identified and proportionate safeguards are in place. Clients should avoid sending identifiable patient, employee or service-user information unless this is necessary, authorised and agreed in advance.


5. How we obtain personal information

  • directly from you;
  • from your employer, a client or an organisation you represent;
  • from advisers, suppliers or parties involved in an engagement;
  • from documents, records or systems made available during an agreed project;
  • through meetings, email, telephone, online communications or the website;
  • from publicly available professional sources, official registers, referrals and introductions.

6. Why we use personal information

  • respond to enquiries and assess potential work;
  • prepare proposals, quotations and engagement terms;
  • enter into and manage contracts;
  • provide consultancy, governance, compliance, audit and information-governance services;
  • communicate with clients, suppliers and professional contacts;
  • manage projects, meetings, deliverables, invoicing, accounting and taxation;
  • maintain appropriate records of work and advice;
  • protect information, systems, business and legal interests;
  • comply with legal, regulatory, insurance and professional requirements;
  • manage data-protection requests and complaints;
  • improve services and communicate relevant service information where lawful.


7. Our lawful bases


7.1 Contract

Information may be processed where necessary to take steps at your request before entering into a contract or to perform a contract with you.


7.2 Legitimate interests

Information may be processed where necessary for legitimate business interests, provided those interests are not overridden by your rights. These include operating a professional consultancy, responding to enquiries, managing relationships, maintaining professional records, protecting systems and legal interests, recovering money owed and developing services.


7.3 Legal obligation

Information may be processed where necessary to comply with taxation, accounting, data-protection, court, law-enforcement or other legal requirements.


7.4 Consent

Consent may be relied upon where required or appropriate. You may withdraw consent at any time without affecting processing carried out before withdrawal.


7.5 Special-category information and legal claims

Where special-category information is involved, an applicable Article 9 UK GDPR condition must also apply. Information may also be processed where necessary for the establishment, exercise or defence of legal claims.


8. Professional confidentiality and client information

Client information will be treated as confidential and used only for the agreed engagement, legitimate administration and applicable legal or professional requirements. Where possible, clients should provide anonymised, pseudonymised or redacted information. Access will be limited to authorised people and suppliers who need it.


9. Sharing personal information

Information may be shared only where there is a lawful and appropriate reason.

  • IT, cloud, email, website-hosting and data-storage providers;
  • accountants, bookkeepers, insurers, legal advisers and other professional advisers;
  • subcontractors or specialist consultants supporting an agreed service;
  • regulators, courts, government departments or law-enforcement bodies where required or permitted;
  • other organisations where you request disclosure or where necessary for an agreed engagement.


Valla Solutions does not sell personal information. Appropriate contractual and supplier-assurance arrangements will be used where another organisation processes information on our behalf.


10. International transfers

Some suppliers may process or provide remote access to personal information outside the United Kingdom. Where a restricted transfer takes place, Valla Solutions will seek to ensure that an appropriate transfer mechanism and safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another lawful mechanism.


11. How long we retain information

Valla Solutions retains personal information only for as long as reasonably required for the purpose for which it was collected and to meet applicable contractual, taxation, insurance, professional and legal requirements. The standard retention periods are:

  • General enquiries not resulting in an engagement: Two years after the last meaningful contact.
  • Unsuccessful proposals and quotations: Two years after the proposal or quotation is closed.
  • Client contracts, engagement records, project files and key deliverables: Six years after the engagement ends.
  • Financial, invoicing and taxation records: At least five years after the 31 January Self Assessment submission deadline for the relevant tax year.
  • Supplier and subcontractor records: Six years after the relationship ends.
  • Marketing consent and preference records: While marketing continues; a minimal suppression record may be retained to respect an objection or unsubscribe request.
  • Data-protection requests and complaints: Six years after the matter is closed.
  • Website security and technical logs: In accordance with the retention settings applied by the relevant website or hosting provider.

Information may be retained longer where necessary because of an ongoing legal claim, regulatory matter, insurance requirement, complaint, investigation or another overriding legal obligation. At the end of the applicable period, information will be securely deleted or anonymised unless there is a documented reason to retain it for longer.


12. Information security

Valla Solutions uses proportionate technical and organisational safeguards to protect information against accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access.

  • access controls and multi-factor authentication;
  • secure cloud services, devices and accounts;
  • encryption and controlled sharing where appropriate;
  • backups, supplier due diligence and confidentiality requirements;
  • secure deletion and incident-management arrangements.


13. Your information rights

Depending on the circumstances, you may have the following rights. These rights are not absolute and an exemption or other legal provision may apply.

  • to be informed about how information is used;
  • to request access, correction, deletion or restriction;
  • to object to processing based on legitimate interests;
  • to request data portability in certain circumstances;
  • to withdraw consent where consent is relied upon;
  • rights relating to applicable automated decision-making.


To exercise a right, email ben@vallasolutions.co.uk. Valla Solutions may need to verify your identity and clarify the scope of your request. Valla Solutions does not currently undertake solely automated decision-making producing legal or similarly significant effects.


14. Direct marketing

Valla Solutions may send service information to existing clients or relevant business contacts where permitted by law. Where consent is required, marketing will only be sent where valid consent has been obtained. You may object or unsubscribe at any time by emailing ben@vallasolutions.co.uk or using an unsubscribe facility where provided. A suppression record may be retained to respect your preference.


15. Cookies and website technologies

The Valla Solutions website is hosted using GoDaddy Websites + Marketing. The website uses cookies and similar technologies that are necessary for the website to operate securely and correctly.

GoDaddy may also use Advanced Tracking to collect aggregated, anonymised information for website insights, metrics and performance improvement where this feature is enabled. Where consent is required, non-essential tracking will not be activated until the visitor has made an appropriate choice through the website’s cookie controls.


Valla Solutions does not use a Google Analytics tracking ID or Meta Pixel on this website. Other third-party advertising or marketing pixels are not intentionally used.


Visitors can use the website’s cookie banner to accept or decline non-essential tracking. Information about the cookies and similar technologies currently in use, including their provider, purpose and duration, will be made available through the website’s cookie controls or Cookie Notice.


16. Data-protection questions and complaints

If you have a question or concern about how Valla Solutions has handled your personal information, or wish to make a data-protection complaint, contact:


Ben Jones

Email: ben@vallasolutions.co.uk


Please use the subject line “Data protection complaint” where possible.


Valla Solutions will:

  • acknowledge receipt of the complaint within 30 days;
  • take appropriate steps to investigate and respond without undue delay;
  • make appropriate enquiries, taking account of the nature and circumstances of the complaint;
  • keep the complainant informed about progress where appropriate;
  • inform the complainant of the outcome without undue delay.


Valla Solutions will keep a proportionate internal record of the complaint, its investigation, relevant communications, decisions and final outcome.


If you remain dissatisfied, you may raise the matter with the Information Commissioner’s Office using the complaints route published on the ICO website.


17. Links to other websites

The website or communications may link to websites operated by other organisations. Valla Solutions is not responsible for their privacy practices. You should review the relevant privacy information before providing personal information through an external website.


18. Children’s information

Valla Solutions provides services to organisations and adult professional contacts and does not knowingly offer services directly to children through its website. If children’s information is encountered during a client engagement, it will be handled only for the authorised engagement and in accordance with the responsibilities of the relevant client and applicable safeguards.


19. Changes to this notice

This notice may be updated when services, systems, suppliers, website functionality or legal requirements change, or where additional information would improve transparency. The current version will be published on the Valla Solutions website with its effective date.