Privacy Policy.

How Velstrian Systems Ltd collects, uses, and protects personal data under UK GDPR. Lawful bases, retention, sub-processors, your rights, and ICO contact info.

What this policy covers

Velstrian Systems Ltd is the data controller for personal data processed through the platform. These are the foundations. The full detail follows below.

ICO Registered Controller

Velstrian Systems Ltd is registered with the Information Commissioner’s Office under the Data Protection (Charges and Information) Regulations 2018.

UK GDPR lawful bases

We process on contract performance, legitimate interests, consent, and legal obligation, each mapped to a specific purpose.

Your rights, supported

Access, rectification, erasure, restriction, portability, and objection, exercised through our DSAR procedure.

Transparent AI handling

We use Google Gemini and Anthropic Claude as AI sub-processors. They process the text a task needs outside the EU, under contract. The sub-processors section below says where and on what terms.

The detail, in full

Every clause below is written for clarity. Jump to any section, or contact our Data Protection Officer with a question.

Data controller

Velstrian Systems Ltd, a private company limited by shares incorporated in England and Wales, is the data controller for personal data processed through the Velstrian platform. For the content you add to your account, we act for your organisation as its service provider (a processor), except for examples you choose to share, where we are a controller. See “Helping us improve Velstrian” below.

Velstrian Systems Ltd (the “Company”, “we”, “us”, or “our”) is committed to protecting and respecting your privacy. This policy (together with our terms of use and any other documents referred to on it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.

For data-protection enquiries: [email protected]

ICO data-controller registration

Velstrian Systems Ltd is registered as a data controller with the UK Information Commissioner’s Office (ICO) in accordance with the Data Protection (Charges and Information) Regulations 2018. Companies House No. 17076461.

Data we collect

We may collect and process the following data about you:

• Account data: Information that you provide by filling in forms on our site or via our application (app.velstrian.com). This includes email address, full name, and password hash (via Supabase Auth).
• Sustainability data: Activity and energy-consumption figures submitted through legacy reporting features, available to existing customers only. This is essential for the Velstrian platform.
• Social Value data: Procurement descriptions, National TOMs selections, and submissions you enter for social value scoring and Velstrian Bid narrative generation.
• Usage data: Details of your visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data, API call counts, feature usage events, timestamps, and subscription plan.
• Billing data: Stripe customer ID and subscription status. We do not store raw card numbers. These are handled directly by Stripe.
• Technical data: IP address, browser type, and error telemetry (collected by Sentry).
• Analytics data: Page views and feature interaction events (collected by PostHog with your consent).

How we use your data

We use information held about you in the following ways:

• To provide the Velstrian service, including Velstrian Bid and legacy features retained for existing customers, such as authentication, sustainability reporting, security-evidence preparation, and Social Value scoring based on National TOMs.
• To process billing and maintain financial records through Stripe.
• To improve the product through aggregate analytics and user feedback (consent-gated via PostHog).
• To monitor and fix errors, ensuring service stability (via Sentry).
• To provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes.

Legal basis for processing

Under the UK GDPR, the lawful bases we rely on for processing this information are:

• Contract performance (Article 6(1)(b) UK GDPR): processing necessary to provide the Velstrian service and fulfil our obligations arising from any contracts entered into between you and us.
• Legitimate interests (Article 6(1)(f) UK GDPR): processing necessary for our legitimate interests, including error monitoring, fraud prevention, service security, and general improvement of the platform.
• Consent (Article 6(1)(a) UK GDPR): processing where you have given clear consent for us to process your personal data for a specific purpose, such as analytics tracking via PostHog or marketing communications.
• Legitimate interests for shared examples (Article 6(1)(f) UK GDPR): only where your administrator has turned on example sharing and a person has ticked the box to share a draft. See “Helping us improve Velstrian” above.
• Legal obligation (Article 6(1)(c) UK GDPR): processing necessary for compliance with a legal obligation to which we are subject, such as financial records retention for HMRC.

Helping us improve Velstrian (optional)

Velstrian does not use the content you put into the platform to improve its AI unless you choose to. There are two choices. Both are off until an administrator in your organisation turns them on, and either can be turned off again at any time.

Sharing examples

A person on your team can choose to share one draft and its approved answer with us. We then use it only to test and improve Velstrian’s AI features.

• Our role: for a shared example, Velstrian decides how it is used, so we are a data controller for it, as well as your service provider for everything else you do on the platform. Our Data Processing Agreement says the same.
• What we do with it: we use it to test and improve our AI features. We never share it with other customers, and we never use it to train any AI model.
• Why we are allowed to: our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR). Our interest is making our AI features better. Two safeguards protect you: an administrator in your organisation must turn sharing on, and a person must tick the box to share each example. Nothing is shared without both.
• How long we keep it: until sharing is turned off. When an administrator turns sharing off, every shared example from your organisation is deleted straight away.
• Your control: an administrator can turn sharing off at any time in settings. If a shared example contains your personal data, you can also ask us to delete it, see “Your rights under UK GDPR” above.

Adding your win and loss counts

If an administrator turns this on, the number of bids you won and lost in each sector is added to counts across Velstrian. Only counts are shared. No words, documents or names are included, so the counts do not identify a person. The counts are shown only once 10 organisations take part, so no one can pick out yours.

Data retention

We retain personal data only for as long as necessary for the purposes set out in this policy, in line with UK GDPR Article 5(1)(e) (storage limitation). When we no longer need your personal data, we will securely delete or anonymise it.

Your rights under UK GDPR

You have the following rights in respect of personal data we hold about you. To exercise any right, see the DSAR procedure below.

• Right to access (Art 15): You have the right to ask us for copies of your personal information.
• Right to rectification (Art 16): You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Right to erasure (Art 17): You have the right to ask us to erase your personal information in certain circumstances.
• Right to restriction (Art 18): You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Right to portability (Art 20): You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
• Right to object (Art 21): You have the right to object to the processing of your personal information in certain circumstances.
• Withdraw consent (Art 7(3)): For consent-based processing, you can withdraw your consent at any time.
• Lodge ICO complaint (Art 77): You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

Data Protection Officer

Our Data Protection Officer is the canonical contact for all data-protection enquiries, subject access requests, erasure requests, and incident notifications. You can contact our DPO for any matter related to Velstrian Bid or to any legacy feature retained for existing customers data handling.

Contact the DPO

Email: [email protected] | [email protected]

Cookies

Velstrian sets a minimal set of cookies. Analytics and non-essential cookies are gated behind explicit consent (PECR & UK GDPR). Essential cookies are required for the platform to function correctly.

• Supabase Auth: Session cookies for sign-in. (No consent required, essential for service)
• PostHog: Product analytics and feature flags. (Consent required)
• Stripe: Billing session and fraud prevention. (No consent required, essential for service)

Sub-processors

We use other companies (sub-processors) to run the service, such as our database host, email provider and AI providers. The full, current list, with what each one does, the data it handles, where it processes it and the contract we rely on, is kept in one place on our Sub-processors page. We tell customers at least 30 days before a new sub-processor starts. Our Data Processing Agreement sets out how they are bound to protect your data.

Integrations you connect: You control which third-party services you link, and you can disconnect any of them at any time from your settings.

• Accounting ledger: The Xero and QuickBooks Online connectors have been withdrawn, and there is no Sage connector. We do not link to an accounting ledger, we do not read one, and we never move money. Where you upload a spreadsheet that you exported from an accounting package yourself, we read only the file you upload, and we send nothing back to the package it came from.
• Single sign-on: You can sign in with a Microsoft (Entra ID) or Google account. We receive only the identity profile needed to authenticate you (name, email, and a stable account identifier). We do not read your mailbox, files, or directory through sign-in.
• Notification and document delivery: You can connect Slack, Microsoft Teams, or Google Drive. Slack and Microsoft Teams receive only the notification messages we post and the names of the channels you offer as a destination. Google Drive is requested on the drive.file scope, which reaches only the files this app creates in your Drive and never the files already there. The read-only Microsoft 365 and Google Workspace security posture connectors have been withdrawn. We do not read your security configuration, and you upload security-certification evidence yourself.

International data transfers

Where personal data is transferred outside the UK, we rely on UK IDTA or EU SCCs + UK Addendum, or adequacy decisions, together with a transfer risk assessment where the law requires one. This ensures that your data receives an equivalent level of protection to that provided under UK law.

Automated decisions & AI

In accordance with Article 22 UK GDPR, we confirm that Velstrian does not make any decision about you that is based solely on automated processing and that produces legal effects. Velstrian uses AI models from Google (Gemini) and Anthropic (Claude) to draft content, such as bid answers and social value narratives. All such outputs are advisory and must be reviewed and signed off by a human before use.

Subject Access Request (DSAR) procedure

You can exercise your data-subject rights (Articles 15-21 UK GDPR) by emailing [email protected] with the subject line “DSAR, [type of request]”. Please include the email address associated with your Velstrian account and a brief description of the request. We will verify your identity where necessary and respond within one calendar month of receipt.

Google Gemini AI processing

Velstrian Bid and Velstrian Buy use Google Gemini models (the current generation Gemini text models and Gemini embeddings) to draft answers, read tender and company documents, search your library and run the chat assistants. We call it through Google’s Gemini API from our own servers, under Google’s Gemini API terms.

What is sent: the text the task needs, which can include tender documents, your answers, your library and documents you upload, and what you type into a chat. This can contain personal data, such as a name in a CV, and we do not remove it before sending.

Where it is processed: the Gemini API does not let us choose a region. Google may store or cache the text in any country where Google or its agents have facilities, so we treat it as an international transfer and rely on the safeguards in the “International data transfers” section above.

Anthropic (Claude) AI processing

Velstrian uses Anthropic’s current Claude models as an AI sub-processor for the buyer pre-read of supplier responses in Velstrian Buy, and to check the quality of drafted answers.

What data is sent

The text the task needs. For the buyer pre-read that is a supplier’s full response, which can include named staff, CVs, referees and subcontractors. We do not send account credentials or billing details to Anthropic.

How it is used

The inputs are processed only to produce the output, which is returned to you. You review every output before use. AI output is advisory and is not a final decision.

Where it is processed and under what contract

Anthropic runs Claude on its global service, which offers no UK or EU location. For UK and EEA customers our contract is with Anthropic Ireland, Limited, under Anthropic’s Commercial Terms, which include the EU Standard Contractual Clauses and the UK International Data Transfer Agreement. By default Anthropic does not train its models on what we send, and deletes inputs and outputs within 30 days, or up to 2 years where they are flagged for a usage policy breach. Anthropic acts as a data processor on our behalf.

Sentry retention & error scrubbing

We use Sentry for error monitoring to ensure the stability of the Velstrian platform and its modules. Error events are retained for 30 days. Session replay is not turned on, so Sentry keeps no recording of your screen. The Sentry SDK is configured to scrub sensitive keys such as passwords and tokens before they are transmitted from your browser.

Contact & ICO complaint

Company

Velstrian Systems Ltd

Companies House No.

17076461

Registered office

Reading, Berkshire, RG1 6SP, GB

Data Protection

[email protected]

If you are not satisfied with our response to a data protection request, you have the right to complain to the UK Information Commissioner’s Office (ICO).

ICO Website: ico.org.uk/make-a-complaint | Helpline: 0303 123 1113 | Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Security Sub-processors Cookie Policy