1. Introduction

Welcome to VCL (Virtual Compliance Log). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, store, and protect your information when you use our compliance management system.

VCL is a multi-tenant business compliance and task management system that helps businesses track and manage their compliance obligations.

Data Controller: VCL
Contact: support@vcl.uk

2. Information We Collect

2.1 Information You Provide

When you use VCL, we collect the following information that you provide directly:

• Account Information: Business name, contact details, email addresses, phone numbers
• User Information: Names, email addresses, job titles, roles within your organization
• Business Data: Tasks, compliance records, completion logs, signatures, notes, photos
• Business Branding: Logos, banners, brand colors
• Holiday Schedules: Opening hours, special messages, contact information

2.2 Information Collected Automatically

When you access VCL, we automatically collect:

• Usage Data: Login times, features used, pages viewed
• Device Information: IP address, browser type, device type, operating system
• Performance Data: Error logs, system performance metrics
• Audit Logs: User actions, data changes, timestamps

2.3 Device Registration

When you register a mobile device with VCL:

• Device Information: Device name, manufacturer, model, unique device identifier
• Purpose: To authenticate devices and restrict access to authorized devices only
• Control: Business admins can view and remove registered devices at any time

3. Third-Party Integrations

3.1 Google Business Profile Integration

If you choose to connect your Google Business Profile to VCL:

What We Access:

• Your Google Business Profile location(s)
• Business hours (regular and special hours)
• Basic location information (name, address)

What We Do:

• Sync holiday opening hours from VCL to your Google Business Profile
• Update special hours when you click "Sync to Google"

What We DON'T Access:

• ❌ Gmail or email messages
• ❌ Google Drive files
• ❌ Customer reviews or ratings
• ❌ Customer data or analytics
• ❌ Any other Google services

Your Control:

• You can disconnect Google Business Profile at any time from VCL settings
• You can revoke VCL's access from Google: myaccount.google.com/permissions
• Disconnecting removes all stored tokens and stops all syncing

4. How We Use Your Information

4.1 To Provide Our Services

• Create and manage your VCL account
• Enable compliance task tracking and management
• Generate reports and PDFs
• Send automated email notifications and reminders
• Manage user access and permissions
• Sync holiday hours to Google Business Profile (if connected)

4.2 To Improve Our Services

• Analyze usage patterns to improve features
• Monitor system performance and fix bugs
• Develop new features based on user needs

4.3 For Security and Compliance

• Maintain audit logs for data changes
• Prevent fraud and unauthorized access
• Comply with legal obligations

5. Data Retention

5.1 Soft Deletes

VCL uses "soft delete" functionality:

• When you delete records (tasks, users, etc.), they are marked as inactive but not permanently removed
• This maintains complete audit trails and allows data recovery if needed
• Soft-deleted data is hidden from normal views but retained in the database

5.2 Account Closure

If you close your VCL account:

• We will retain your data for 90 days to allow account recovery
• After 90 days, we will permanently delete your data
• Some data may be retained longer if required by law

6. Data Sharing and Disclosure

6.1 Service Providers

We may share data with trusted service providers who help us operate VCL:

• Hosting Providers: To store data and run the application
• Email Services: To send notifications and reports
• Backup Services: To maintain secure backups

6.2 Multi-Tenant Isolation

VCL is a multi-tenant system:

• Your data is logically isolated from other businesses
• Business admins can only see data for their own business
• System admins can access data across businesses for support purposes

7. Your Rights (GDPR & UK DPA)

If you are in the UK or EU, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in machine-readable format
• Right to Object: Object to processing in certain circumstances
• Right to Complain: Lodge a complaint with the ICO (ico.org.uk)

To exercise these rights, contact us at: support@vcl.uk

8. Cookies

VCL uses cookies to provide essential functionality. For detailed information about our cookie usage, please see our Cookie Policy.

Essential Cookies

• Session Cookies: Keep you logged in
• Authentication Cookies: Remember your login
• Security Cookies: Protect against CSRF attacks

9. Data Security

We implement appropriate security measures:

• Encryption: HTTPS/SSL encryption for data in transit
• Access Control: Role-based permissions
• Password Security: Passwords are hashed and salted
• Audit Logs: Complete tracking of data changes
• Regular Backups: Automated daily backups

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by:

• Updating the "Last Updated" date
• Sending email notification
• Displaying a notice in VCL