Skip to content
VelinorDiscuss a requirement
Legal

Privacy Policy

Last updated: 3 October 2026

This policy explains what personal data Velinor collects, why we collect it, and what you can do about it.

Velinor AI Ltd (“Velinor”, “we”, “us”, “our”) is a UK cyber security and assurance delivery partner registered in England and Wales (company no. 15700539). Our registered office is 55 Ringwood Road, Bath BA2 3JL, United Kingdom. We are registered with the Information Commissioner’s Office (ICO registration ZB845813).

For any data protection enquiry, contact contracting@velinor.io.

Information you provide directly:

  • Name, email, organisation, role and the content of your enquiry when you contact us or book a call.
  • Information you provide during a discovery call, an assurance diagnostic, or an advisory engagement.
  • Email address and organisation name if you subscribe to a Velinor briefing.
  • If you work with us as an associate, or send us your CV to join our bench: your CV and professional history, your security clearance level and status, your availability, and the company you contract through.

Information collected automatically:

  • Server access logs (IP address, user agent and requested URL), retained for security and abuse prevention.
  • Email engagement data (opens, clicks) for communications you have subscribed to.

We do not run advertising trackers, and we do not use Google Analytics or any third-party analytics on this website.

Business contact information from public professional sources: name, job title, employer and professional profile, taken from LinkedIn, from certifications and announcements that organisations publish themselves, and from Companies House.

Publicly available data: the AI Blindspot Framework is calibrated against documented real-world AI failures drawn from public OSINT sources such as regulator decisions, court rulings and established media. Where such cases reference individuals acting in a public or senior capacity, those individuals may be referenced in our published methodology. All such references are subject to editorial review and PII redaction.

  • To respond to your enquiry and arrange a discovery conversation.
  • To deliver the assurance and advisory engagements you have commissioned.
  • To match associates and candidates to specific roles, and to propose named people to a client, only with that person’s agreement for that role.
  • To send briefings you have subscribed to.
  • To contact people, in their professional capacity, about services relevant to their role.
  • To improve our website, our framework and our services.
  • To comply with our legal and regulatory obligations.
  • Consent: for briefing subscriptions. You may withdraw at any time.
  • Contract: when you engage Velinor as a client, we process your data to deliver the contracted services.
  • Legitimate interest and steps before a contract: when you send us your CV or join our bench, we hold it to match you to roles you have agreed to be put forward for. We never send your CV to a client without your agreement for that role.
  • Legitimate interest: we contact named professionals about services relevant to their role, having assessed that this does not override their rights. Any reply asking us to stop ends contact permanently.
  • Legitimate interest: we process publicly available information about AI incidents to maintain the AI Blindspot Framework, having assessed that this does not override the rights of the individuals concerned, given the data is drawn from public-interest reporting and regulator publications.

We do not sell your personal data. We share it only with:

  • Google Workspace (Google Ireland Ltd): email and document storage.
  • LeadConnector / HighLevel Inc.: booking and CRM. Our booking calendar opens on LeadConnector’s own page when you choose to book. Nothing from LeadConnector loads on velinor.io.
  • Professional advisers (legal, accounting, insurance) where strictly necessary.
  • Regulators or law enforcement where required by law.

A copy of our data processing agreement is available on request from contracting@velinor.io.

  • Enquiry data: up to 24 months from last contact, then deleted unless you become a client.
  • Client data: the duration of the engagement plus 6 years, for accounting and legal purposes.
  • Subscription data: until you unsubscribe, then deleted within 30 days.
  • Prospecting data: 12 months from last contact, then deleted unless a business relationship exists.
  • Associate and candidate data: while you remain on our bench, then deleted within 12 months of last contact unless you ask us to keep it.
  • Server access logs: about two weeks.

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase your data, subject to legal obligations.
  • Restrict our processing in certain circumstances.
  • Object to processing based on legitimate interest.
  • Receive your data in a structured, machine-readable format.

To exercise any of these rights, email contracting@velinor.io. We will respond within 30 days. If you are not satisfied with our response, you may complain to the Information Commissioner’s Office at ico.org.uk.

Velinor holds Cyber Essentials (Basic) certification.

We apply appropriate technical and organisational measures to protect your data, including encrypted transport, enforced email authentication, access controls and regular review of our security posture. Our security practices and vulnerability disclosure policy are set out on our Trust and security page.

We may update this policy from time to time. The “last updated” date above indicates the most recent revision.

Email: contracting@velinor.io

Post: Velinor AI Ltd, 55 Ringwood Road, Bath BA2 3JL, United Kingdom