Privacy Policy

1. Who we are

Valome Media Ltd is a private limited company registered in England and Wales (company number 17539032).

Registered office: 34 Benbow Avenue, Eastbourne, England, BN23 6EB Email: hello@valomemedia.com ICO registration number: ZC172791

We provide Email Automation, Website Development, Software Development, and SEO & Google Business services, including separately agreed ongoing support.

This notice explains how we handle personal information through our website, enquiries, business communications, internal administration and invitation-only Client Portal.

2. Our role

We act as a data controller when deciding how to use information for our own business purposes, including managing enquiries, delivering and administering client relationships, billing, security and appropriate business marketing.

When we handle personal information on a client’s instructions as part of their services - for example, their customer records - we may act as a data processor. That processing is governed by the relevant client agreement and our Data Processing Addendum.

Our role depends on the particular activity, rather than the system in which information is stored.

3. Information we collect

Depending on your interaction with us, we may collect:

• Enquiry and contact information: name, email address, telephone number, business name, website, services of interest and messages.
• Project and relationship information: requirements, proposals, approvals, notes, correspondence, support requests and agreed deliverables.
• Billing information: billing contact details, invoice information, payment status and payment-provider references.
• Portal information: account details, business profile, invitations, authentication records, preferences, questionnaire answers, task submissions and uploaded files.
• AI interaction information: website-chat messages and conversation context, and relevant information processed by our internal AI-assisted tools.
• Technical and security information: IP addresses or derived identifiers, browser/device information, access records, request logs and account activity.
• Analytics and preference information: where collected in accordance with your choices and our Cookie Policy.

Our systems do not receive or store full payment-card numbers or security codes when you pay through our hosted payment provider.

Please do not submit passwords, payment-card details, special-category information such as health records, or information about criminal convictions through general enquiries or chat. Any service requiring sensitive information must be discussed and agreed separately.

4. Where information comes from

We receive information directly from you through forms, email, telephone calls, messages, the Portal and project work.

We may also receive business-contact information from referrals, your colleagues, clients, public business websites, professional directories or social-media profiles.

Technical information may be collected automatically when you use our online services.

We do not record or automatically transcribe our telephone calls. We may make written notes of relevant discussions.

5. Why we use information

We use personal information for the following purposes and lawful bases:

Where we rely on legitimate interests, we consider whether the processing is necessary and how it affects your rights and reasonable expectations.

Required form fields are identified. If you do not provide information necessary to respond, establish an account or deliver a service, we may be unable to complete that activity.

6. Marketing and outreach

We may contact relevant businesses about our services by email or social media where permitted by applicable law.

The rules differ according to the recipient and communication. We do not treat a publicly available email address as blanket consent to marketing.

You can object to direct marketing at any time by replying or emailing hello@valomemedia.com. We retain the minimum suppression information needed to respect that choice.

Enquiring about a project does not automatically subscribe you to a newsletter. We do not use email-open or click tracking for our business outreach.

Necessary service and security communications are separate from marketing.

7. AI-assisted processing

Our website assistant sends your messages and relevant conversation history to an AI service to generate responses automatically.

Authorised Valome Media staff may also use AI-assisted tools to extract document text, search relevant information, summarise notes or enquiries, and support project administration. Depending on the task, this may involve sending document contents or relevant extracts to a contracted AI provider.

We limit information to what is needed for the task. Staff determine when internal AI features are used. There is no general self-service setting to exclude individual records from AI processing.

Where we process information on a client’s behalf, AI processing must remain within the agreed instructions, authorised supplier arrangements and applicable data-protection requirements.

We do not use these tools to make solely automated decisions producing legal or similarly significant effects about individuals.

See our AI Policy for further information.

8. Who receives information

Information is available to authorised Valome Media personnel and may be shared with providers supporting:

• Hosting, databases, file storage and authentication.
• Business email and transactional notifications.
• Payment processing.
• AI-assisted functionality.
• Analytics, where enabled appropriately.
• Security and technical operations.

We may also share relevant information with professional advisers, authorities where legally required, or people you authorise us to work with.

Some providers act on our instructions; others, including payment providers for certain activities, act under their own legal responsibilities.

We do not sell personal information.

9. International processing

Some suppliers and their authorised providers may process information outside the UK.

Where a restricted international transfer occurs, we must use an applicable lawful mechanism, such as UK adequacy regulations or appropriate contractual safeguards, together with any required assessment and supplementary measures.

Contact us for information about the safeguards applicable to your information and how to obtain a relevant copy, subject to necessary redactions.

10. How long we keep information

We apply retention periods according to the information’s purpose:

• Unsuccessful enquiries: normally up to 24 months after the last meaningful contact, unless there is a justified reason to retain particular records longer.
• Active clients: relevant information for the duration of the services and any necessary follow-up.
• Financial records: for applicable tax and accounting retention requirements.
• Contracts, approvals and dispute records: for a justified period needed to evidence the relationship, meet obligations or establish, exercise or defend legal claims.
• Working files and client-supplied information: only as needed for delivery, agreed access, handover and any applicable DPA obligations.
• Security logs, AI histories and operational records: for periods proportionate to security, troubleshooting and the relevant business purpose, with review and deletion when no longer needed.
• Marketing suppression information: for as long as necessary to respect an objection.

After the last relevant project and ongoing service end, Portal access normally continues for 90 days, with notice before closure, unless another arrangement requires continued access. We then normally complete export/return and delete unnecessary working copies within a further 30 days.

Necessary financial, contractual and other justified records are handled separately. Ending Portal access does not erase your ownership of deliverables or automatically delete every record.

Our working retention schedule covers relevant copies in our systems, business email and local working files. Backup deletion may follow the provider’s documented cycle; retained backup copies must remain protected and unavailable for ordinary use.

11. Portal accounts and security

The Portal is invitation-only. Each client business has one account assigned to one nominated individual. It does not provide separate staff accounts within the same business.

Do not share credentials. Contact us if the nominated individual changes so that access can be transferred appropriately.

We use technical and organisational measures appropriate to the information and risks. These include access restrictions, private file storage, secure transmission and controlled service-to-service access. No online system can be guaranteed completely secure.

12. Your rights

Depending on the circumstances, you may have rights to:

• Access your personal information.
• Correct inaccurate information.
• Request deletion.
• Restrict processing.
• Object to processing, including an absolute right to object to direct marketing.
• Receive applicable information in a portable format.
• Withdraw consent where processing relies on consent.

Withdrawal does not affect the lawfulness of processing before withdrawal.

Email hello@valomemedia.com to exercise your rights. We may request proportionate identity verification. We normally respond within one month, subject to lawful extensions or other applicable exceptions.

Where we act on a client’s instructions, we may refer your request to that client and assist them as required.

13. Complaints

You can make a data-protection complaint by emailing hello@valomemedia.com or writing to our business address.

We will acknowledge it within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay.

You can also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint or telephone 0303 123 1113. You do not have to waive that right to use our complaint process.

14. Cookies, children and updates

Our Cookie Policy explains device storage, tracking and available controls.

Our services are aimed at businesses, not children. If you believe a child has provided information that needs attention, contact us.

We may update this notice when our activities or legal requirements change. The publication date appears above, and significant changes will be communicated where appropriate.