At a glance
This notice explains who is responsible for personal data, what information we collect, why we use it, the lawful bases we rely on, who receives it, how long we keep it, international transfers, and the rights available to individuals.
| Topic | Summary |
| Who is responsible | The relevant Vyta Group company that decides why and how personal data is used. Vyta Secure Ltd is the principal contact for this notice. |
| Customer assets | For customer-instructed sanitisation, the customer is normally the controller and Vyta is the processor. |
| Website and business contacts | Vyta normally acts as controller for website enquiries, customer and supplier contacts, marketing preferences, security, CCTV and corporate administration. |
| Questions or rights requests | Contact DPO@vyta.com or info@vyta.com. |
| Complaints | You may complain to the UK Information Commissioner’s Office or, where EU GDPR applies, the competent EU supervisory authority. |
1. About this notice
Vyta respects your privacy and is committed to protecting personal data. This notice explains how we handle personal data when you visit https://vyta.com, use our website chat, submit an online form, subscribe to communications, interact with website content or otherwise contact us through the public website.
This notice does not govern employee or recruitment processing, which is addressed through separate privacy information. It also does not govern third-party websites, platforms or services that have their own privacy notices.
In this notice, “personal data” means information relating to an identified or identifiable individual. “Processing” includes collecting, recording, organising, storing, using, sharing, restricting, erasing and destroying personal data.
2. Who we are and how to contact us
“Vyta Group”, “Vyta”, “we”, “us” or “our” refers to the Vyta Group company that determines why and how your personal data is processed in the relevant circumstances. The particular controller will normally be the Vyta company with which you interact or contract.
| Contact item | Details |
| Principal legal entity | Vyta Secure Ltd |
| Company number | NI040520 |
| Registered / postal address | Unit 1 Mallusk View, Central Park, Newtownabbey, Northern Ireland, BT36 4FR |
| General email | info@vyta.com |
| Data Protection Officer | Richard Duckett |
| Data protection email | DPO@vyta.com |
| ICO registration | Z1628515 |
| Website | https://vyta.com |
If another Vyta Group company is the controller for a particular activity, we will identify it in the relevant contract, form, communication or supplementary notice where appropriate.
3. When Vyta is controller and when Vyta is processor
3.1 When Vyta acts as controller
Vyta acts as controller when it determines the purposes and essential means of processing. Examples include managing website enquiries, business relationships, supplier administration, invoicing, security, CCTV, legal and regulatory compliance, marketing preferences and the operation and security of our own systems.
3.2 When Vyta acts as processor
Vyta acts as processor where it processes personal data on behalf of a customer and in accordance with that customer’s documented instructions. In that situation, the customer is responsible for its Article 6 lawful basis and its transparency obligations, while Vyta is responsible for complying with its processor obligations and the applicable data processing agreement.
Role depends on the processing activity
The same organisation may be a controller for one activity and a processor for another. Ownership of an IT asset does not, by itself, determine controllership of personal data stored on that asset.
4. Customer data and IT asset sanitisation
As part of our IT asset disposition, reuse, recycling, data erasure, sanitisation and destruction services, Vyta may receive data-bearing equipment that contains personal data relating to a customer’s employees, customers, suppliers or other individuals.
- Where the customer determines why the data is processed and instructs Vyta how it must be handled, including the required method of erasure, sanitisation or physical destruction, the customer acts as controller and Vyta acts as processor.
- Vyta processes that personal data only on the customer’s documented instructions, subject to the applicable data processing agreement and Article 28 of the applicable GDPR.
- The customer, as controller, is responsible for selecting and documenting the appropriate lawful basis and providing required privacy information to affected individuals.
- Transfer of ownership of the physical equipment to Vyta does not, by itself, transfer controllership of personal data remaining on the equipment.
- Vyta does not access or use customer data for unrelated purposes. Processing is limited to secure handling, instructed sanitisation, erasure or destruction, verification, incident management, and appropriate records and audit evidence.
If Vyta is required by law to process personal data beyond the customer’s instructions, or independently determines a new purpose for processing, we will assess and document our role and obligations for that separate activity.
5. Personal data we collect
Depending on how you interact with us, we may collect the following categories of personal data:
| Category | Examples |
| Identity and contact data | Name, title, job title, employer, business address, email address, telephone number and signatures. |
| Customer and supplier data | Account details, service requests, collection information, site contacts, contract information, correspondence and relationship history. |
| Financial and transaction data | Bank account or payment information, invoices, credits, refunds, payment history and transaction records. |
| Technical and usage data | IP address, browser and device information, operating system, referring page, date and time of access, website activity, log data and online identifiers. |
| Marketing and communications data | Marketing preferences, consent records, unsubscribe status, event registrations, survey responses and communication history. |
| Security and access data | Visitor records, access-control information, CCTV images, incident information and system-security logs. |
| Public and professional information | Business contact details, professional role and information made public through corporate websites, registers or professional networking platforms. |
| Correspondence and enquiries | Information contained in emails, calls, meetings, forms, complaints, rights requests and other communications. |
| Website chat data | Name, business contact details, organisation, chat messages, enquiry content, timestamps and associated technical or session data. |
Please do not provide more personal data than is reasonably necessary. If personal data is required by law or to enter into or perform a contract and it is not provided, we may be unable to provide the relevant service or proceed with the relationship. We will explain this where applicable.
6. Personal data obtained from other sources
We may obtain personal data from sources other than directly from the individual. This may include information received from:
- customers, suppliers, business partners and professional advisers;
- other Vyta Group companies;
- public registers, company websites and professional networking platforms;
- analytics, security, IT and communications providers;
- persons who identify you as a business contact, representative, visitor, collection contact or authorised user; and
- law enforcement, regulators and public authorities where legally permitted or required.
Where Vyta acts as controller and obtains personal data indirectly, we will provide the information required by Article 14 of the applicable GDPR within the required timeframe, normally within one month, or sooner if we contact the individual or disclose the information, unless an applicable exemption applies. We will explain the categories of data, source, purpose, lawful basis, recipients, retention and applicable rights.
Where Vyta receives personal data solely as a processor on behalf of a customer, the customer remains responsible for its controller transparency obligations.
7. How we use personal data and our lawful bases
We use personal data only where we have an appropriate lawful basis. The basis depends on the purpose, the individual’s relationship with us and the applicable UK or EU data protection regime. We may rely on more than one basis where different purposes apply.
| Purpose | Data | Lawful basis / role |
| Respond to enquiries and requests | Identity, contact and correspondence data | Steps requested before a contract, where applicable; otherwise legitimate interests in responding to enquiries and developing business relationships. |
| Provide services to an individual who is party to the contract | Identity, contact, transaction and service data | Contract, where processing is objectively necessary to enter into or perform the contract with that individual. |
| Manage business customer and supplier relationships | Business contact, contractual and correspondence data | Legitimate interests in administering commercial relationships, providing services and maintaining effective communications; legal obligation where applicable. |
| Customer-instructed sanitisation of data-bearing assets | Residual personal data on customer assets | Vyta acts as processor. The customer, as controller, determines the Article 6 lawful basis; Vyta acts under documented instructions and the Article 28 arrangement. |
| Billing, payments, tax and accounting | Identity, financial and transaction data | Legal obligation; contract where applicable; legitimate interests in financial administration and recovering debts. |
| Security, fraud prevention and incident management | Security, access, technical, CCTV and correspondence data | Legitimate interests in protecting people, premises, systems, assets and information; legal obligation where applicable. |
| Operate, secure and improve our website and systems | Technical, usage and communication data | Legitimate interests in secure and effective operations; consent where required for non-essential cookies or similar technologies. |
| Direct marketing and events | Business contact, preference and engagement data | Consent where required; otherwise legitimate interests where permitted by applicable law and electronic-marketing rules. |
| Publish testimonials | Name, role, organisation, image or testimonial | Consent, which may be withdrawn for future use. |
| Establish, exercise or defend legal claims | Relevant identity, contract, transaction, security and correspondence data | Legitimate interests and/or legal obligation. |
| Comply with law and regulatory requests | Any relevant category | Legal obligation; public task or recognised legitimate interest where applicable under the relevant law. |
| Respond to and administer website chat enquiries | Identity, business contact, chat content and technical/session data | Steps requested before entering a contract, where applicable; otherwise legitimate interests in responding to enquiries, providing assistance, maintaining service records and protecting the chat service. |
7.1 Our legitimate interests
Where we rely on legitimate interests, those interests may include operating and improving our business; responding to business enquiries; managing customer and supplier relationships; ensuring network and information security; protecting people, premises and assets; preventing fraud; maintaining accurate business records; pursuing or defending legal rights; and communicating relevant services to business contacts where legally permitted.
Before relying on legitimate interests, we assess the purpose, necessity and impact on individuals, including their reasonable expectations and available safeguards. You may object to processing based on legitimate interests as described in section 17.
8. Special category and criminal offence data
We do not routinely seek to collect special category personal data through our public website or ordinary business-contact activities. However, it may occasionally be provided or processed in connection with health and safety, accessibility, incidents, legal claims, occupational health arrangements or other specific circumstances.
Where Vyta acts as controller and processes special category data, we will identify an Article 6 lawful basis and an applicable Article 9 condition. Where we process criminal offence data, we will ensure that an appropriate lawful basis and condition under applicable law is available and that suitable safeguards are in place.
Where special category or criminal offence data is present on customer equipment and processed solely under customer instructions, Vyta handles it as processor under the applicable data processing arrangements.
9. CCTV and site security
We use CCTV and related security measures at Vyta sites for purposes including protecting people and property, managing health and safety, deterring and investigating crime or misconduct, controlling access, investigating incidents and supporting legal or insurance claims.
Our usual lawful basis is legitimate interests in site safety and security and, where applicable, compliance with legal obligations. CCTV is signposted where required. Access is restricted to authorised personnel and relevant service providers or authorities.
CCTV footage is normally retained for no longer than 100 days, unless it is required for an incident, investigation, legal claim, law-enforcement request or another justified purpose. Where footage is preserved for such a purpose, it is retained only for as long as necessary for that purpose.
10. Marketing and testimonials
10.1 Marketing
We may use business contact information to provide information about Vyta services, events and relevant updates. We will obtain consent where required by applicable electronic-marketing law. Where legally permitted, we may rely on legitimate interests for proportionate business-to-business communications.
You can opt out at any time by using the unsubscribe link in a marketing email or contacting DPO@vyta.com. Opting out of marketing does not prevent service, contractual, security or legal communications.
10.2 Testimonials
We publish identifiable customer testimonials, names, roles, photographs or quotations only where we have an appropriate permission, normally consent. Consent may be withdrawn for future publication, although this does not affect uses already made before withdrawal or materials that cannot reasonably be recalled.
11. Cookies and website technologies
Our website may use cookies, pixels, tags, web beacons, log files and similar technologies. Some are necessary for website operation or security. Others may support analytics, preferences, functionality or marketing.
Where consent is required, non-essential technologies will not be used until you make an affirmative choice through the available cookie controls. You can change or withdraw your choices through those controls. Browser settings may also allow you to block or delete cookies, although doing so may affect website functionality.
For details of the technologies used, providers, purposes, durations and controls, please read our Cookie Policy at https://vyta.com/cookie-policy/.
12. Website chat
When you use the chat facility on our website, Vyta may collect and process the information you provide during the conversation. This may include your name, business contact details, organisation, the content of your enquiry, timestamps and associated technical or session information.
We use this information to respond to enquiries, provide information about our services, assist with customer or service-related queries, maintain an appropriate record of the communication, protect the chat service and, where relevant, take steps requested before entering into a contract.
Our lawful basis will normally be legitimate interests in responding to enquiries, providing assistance, maintaining effective business communications and securing the chat service. Where processing is objectively necessary to take steps at your request before entering into a contract with you, we may rely on Article 6(1)(b).
Please do not provide special category data, criminal offence data, payment-card details, passwords or other sensitive information through website chat unless it is specifically requested and necessary. Chat information may be retained where required for service administration, security, legal, regulatory or claims purposes, in accordance with section 16 and our retention schedule.
A short privacy message and a prominent link to this notice should be displayed when the website chat is opened or before a visitor submits information through the chat.
13. Sharing personal data
We may share personal data only where necessary and proportionate for the purposes described in this notice, including with:
- other Vyta Group companies;
- customers where necessary to provide contracted services or manage the business relationship;
- IT, cloud-hosting, communications, analytics, marketing and cyber-security providers;
- payment, banking, accounting and debt-recovery providers;
- professional advisers, auditors, insurers and certification bodies;
- logistics, facilities, security and other operational service providers;
- HM Revenue & Customs, regulators, supervisory authorities, law enforcement, courts and other public authorities where required or permitted by law; and
- buyers, sellers, lenders or advisers involved in a proposed or actual corporate transaction, subject to appropriate confidentiality and data-protection controls.
Processors may use personal data only for the contracted purposes and in accordance with our instructions, unless the law requires otherwise. Some recipients act as independent controllers and are responsible for their own compliance.
We do not sell personal data to third parties for their own commercial purposes.
14. International transfers
Vyta operates internationally and may use service providers or group companies located outside the country in which personal data was collected. Where a transfer is restricted under the applicable UK GDPR or EU GDPR, we use an appropriate legal transfer mechanism.
- an applicable UK adequacy regulation or EU adequacy decision;
- the UK International Data Transfer Agreement;
- the UK Addendum to the EU Standard Contractual Clauses;
- the EU Standard Contractual Clauses;
- the UK Extension to the EU-US Data Privacy Framework or the EU-US Data Privacy Framework, where the recipient is validly certified and the mechanism applies; or
- another legally recognised safeguard or permitted exception.
Where required, we also carry out the applicable transfer risk assessment or data protection test and implement supplementary safeguards. You may contact the DPO for further information about the safeguard used for a particular transfer, subject to protection of confidential and security-sensitive information.
15. Data security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures are selected according to the nature of the processing and risks involved and may include access controls, authentication, encryption, logging, monitoring, secure disposal, staff training, confidentiality obligations, supplier assurance, incident response and business continuity arrangements.
Access to personal data is limited to personnel and service providers with an authorised business need. We maintain procedures for identifying, managing and reporting personal data breaches and will notify affected individuals and regulators where legally required.
16. Data retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, regulatory, tax, accounting, reporting, security and claims requirements. Retention periods vary by category and purpose and are governed by our retention schedule.
| Category | Typical retention approach |
| Customer, supplier and contractual records | For the active relationship and normally up to six years afterwards where required for tax, accounting, contractual or legal-claims purposes, subject to applicable local law. |
| Enquiries that do not become a contract | For a reasonable follow-up period based on the nature of the enquiry and expected business relationship. |
| Marketing records | Until consent is withdrawn, an objection is made, or the information is no longer needed. Suppression records may be retained to respect an opt-out. |
| CCTV | Normally no longer than 100 days, unless preserved for an incident, investigation, claim or legal requirement. |
| Website and security logs | For the period necessary for security, diagnostics, fraud prevention and operational purposes, according to the relevant system schedule. |
| Customer asset processing records | In accordance with the customer contract, data processing agreement, legal requirements and the applicable audit/certification schedule. |
| Rights requests and complaints | For the period necessary to respond, demonstrate compliance and manage related legal or regulatory issues. |
When personal data is no longer required, we securely delete or anonymise it. Anonymous information that can no longer identify an individual may be retained and used for statistical, research, reporting or service-improvement purposes.
17. Your data protection rights
Subject to applicable law and any conditions or exemptions, you may have the following rights:
| Right | What it means |
| Access | Request confirmation of whether we process your personal data and obtain a copy and related information. |
| Rectification | Ask us to correct inaccurate personal data or complete incomplete information. |
| Erasure | Ask us to delete personal data where there is no lawful reason to retain it. |
| Restriction | Ask us to restrict processing in specified circumstances. |
| Objection | Object to processing based on legitimate interests, including direct marketing. Direct-marketing objections will be honoured. |
| Portability | Receive certain personal data you provided in a structured, commonly used and machine-readable format where the legal conditions apply. |
| Withdraw consent | Withdraw consent at any time where consent is the lawful basis, without affecting earlier lawful processing. |
| Automated decisions | Request appropriate safeguards in relation to qualifying solely automated decisions, where applicable. |
To exercise a right, contact DPO@vyta.com. We may ask for information needed to verify identity and authority. We normally respond within one month, although an extension may be available for complex or multiple requests. We will explain any extension or lawful reason for not fully complying.
There is normally no charge. A reasonable fee may be charged, or a request refused, where permitted by law because it is manifestly unfounded or excessive.
Where Vyta processes data only as a processor, we may refer the request to the relevant customer/controller and assist that controller as required by the applicable agreement and law.
18. Automated decision-making and profiling
Vyta does not currently make decisions about website visitors or ordinary business contacts based solely on automated processing, including profiling, that produce legal effects or similarly significant effects. If this changes, we will provide the information and safeguards required by applicable data protection law, including meaningful information about the logic involved and the expected consequences where required.
19. Children
Our website and business services are directed primarily to organisations and adults. We do not knowingly use the public website to collect personal data from children for online services directed at children. If you believe a child has provided personal data to us inappropriately, contact DPO@vyta.com so that we can assess and take appropriate action.
20. Complaints
Please contact us first if you have concerns about how we use personal data. We will investigate and aim to resolve the matter promptly.
You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection. Information is available at https://ico.org.uk. Where the EU GDPR applies, you may also have the right to complain to the competent supervisory authority in the relevant EU Member State.
21. Changes to this notice
We review this notice regularly and update it when our processing, suppliers, services, technology or legal obligations materially change. The current version and effective date are shown at the beginning of the notice. Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected individuals before the new use begins, where required.
22. Contact details
| Contact | Details |
| Data Protection Officer | Richard Duckett |
| Data protection enquiries and rights requests | DPO@vyta.com |
| General enquiries | info@vyta.com |
| Postal address | Vyta Secure Ltd, Unit 1 Mallusk View, Central Park, Newtownabbey, Northern Ireland, BT36 4FR |
| Website | https://vyta.com |