Privacy notice

[manifest]
form    = "stanza, then commentary"
regime  = "UK GDPR, Data Protection Act 2018"
governs = "stanza, where the two could be read apart"

Every numbered part below opens with a block like the one above. The block states the position. The prose under it explains why the position is what it is, in the same way the configuration on the front page carries its reasoning in comments beside it rather than somewhere else entirely.

Articles 13 and 14 fix what a document like this owes a reader: who settled the processing, which fields are involved, to what end, on what footing, who else receives them, for how long, and by what routes any of it can be challenged. All of that is here, pitched at the level of the field rather than the category, because a category is a heading and not a disclosure.

[controller]
entity = "VAIR LTD"
number = "16938467"
seat   = "England and Wales"
base   = "London"
inbox  = "[email protected]"
dpo    = "not a mandatory appointment here"

VAIR LTD settles the purpose and the means wherever the records belong to this company's own operation: the pages you are reading, the mailbox, the contract file, the ledger. Article 4(7) calls that being the controller, and this document is the disclosure the role carries with it.

One address takes everything, privacy work included. Head the subject line Data protection and it is routed as such. There is no portal to register with, no reference to quote and no intake form standing between a question and a person.

2.1 Data protection officer

Article 37(1) fixes three triggers for a mandatory appointment: a public authority, watching people at scale as the core of what the business does, or handling Article 9 and Article 10 material at scale. This company builds tooling for engineering teams, and none of the three reaches that. Privacy correspondence goes to the inbox in the stanza and is answered from it. Should the shape of the work ever meet one of those triggers, an appointment follows, the stanza changes, and the regulator is told.

2.2 Representative under Article 27

The company is established in the United Kingdom and processes from here, so the requirement to appoint a representative does not reach it.

[processor]
scope            = "client repositories, pipelines, runners"
authority        = "written client instruction only"
chooses_purpose  = false
sets_basis       = false
decides_requests = false
contract         = "art. 28(3), signed before access"

An engagement runs inside records the client owns. A repository, the pipeline definition beside it, the log output of a run and the metrics collected from it all stay theirs. Personal data sits in those records incidentally: the name and address attached to a commit, the account name printed into a build log, whoever triggered a pipeline at half past two. The client stays the controller of every one of those fields, and Article 4(8) puts this company in the second role.

3.1 What the role forbids

In that role there is no purpose to pick, no footing to choose and no request to rule on. Those decisions belong to the client. What is left is carrying out the instruction as written, and saying plainly where an instruction looks like it would break data protection law rather than carrying it out quietly and leaving the point for somebody else.

3.2 The written terms

Access is issued after a contract meeting Article 28(3) exists, never before. Its obligations, in the order they tend to matter:

• act on documented instruction and nothing else, transfers included;
• put every person given access under a duty of confidence;
• hold to the measures set out in part 11;
• bring in no further processor unless the client has agreed to it in writing;
• help with requests, with security work, with notification, and with any assessment the client has to run;
• at the close of the work, hand the material back or destroy it, whichever the client picks;
• make available whatever an audit of the above would need.

3.3 Asking for less

Where a question can be answered from a redacted log or an aggregated metrics export, that is what gets requested. A build system rarely has to be handed over whole in order to be measured. Material that never changes hands does not have to be destroyed afterwards, which is the cheapest minimisation available to anyone.

3.4 Requests that land here by mistake

A request about records held in a client's system is forwarded to that client promptly, and whoever sent it is told where it went and who will be answering. Deciding it here would be acting without authority, and Article 28 gives a processor none.

[site]
build     = "static files, no build step"
database  = false
accounts  = false
forms     = false
analytics = false
storage_written = 0

What is published at vairworks.co.uk is a directory of files. No query runs, no session opens, no visit is counted and nothing is reported onward. A page is requested, the browser draws it, and that is the whole of the transaction. There is no tag manager in the markup, no advertising pixel, no embedded player and no widget belonging to anybody else.

Two hosts are reached while a page draws: the one this site is served from, and the one holding the font files it is set in. Inventory 4.1 records both, field by field.

Scrolls sideways on a narrow screen.

[mail]
address = "[email protected]"
form    = none   # nothing here collects on your behalf
list    = none
keep    = "2 years after the last reply"

Everything in the mailbox arrived because somebody chose to write. Nothing on the site gathers a detail and posts it here for you, so there is no quiet path into these records: the message you sent is the whole of what exists.

Scrolls sideways on a narrow screen.

Writing in enrols you in nothing. Part 20 sets out what the company may and may not send you afterwards.

[records]
parties   = "organisations, reached through named people"
statutory = "Companies Act 2006, ss. 386 and 388"
ledger    = "6 financial years"

A contract with an organisation is negotiated, signed and performed by individuals, so running one means holding data about them: whoever agreed the scope, whoever the invoice goes to, the engineers at the other end of the thread. Deciding what a working file and a lawful ledger need puts this company back in the controller role.

Scrolls sideways on a narrow screen.

The table is published ahead of any engagement so a prospective client can read the handling before signing, instead of discovering it in an appendix afterwards.

[recipients]
sold     = false
brokered = false
enriched = false
list     = "below, in full"

Nothing here is put on a market, passed to a broker, or combined with a bought-in dataset to make it worth more. The organisations in the table are the complete set of destinations, and the table is the disclosure rather than a sample of it.

Scrolls sideways on a narrow screen.

In the processor role the rule is stricter still: nobody joins the work without the client agreeing to it beforehand in writing, and whoever joins takes on the same duties this company owes that client, which is what Article 28(4) demands.

[lawful_bases]
in_use  = ["6(1)(b)", "6(1)(c)", "6(1)(f)"]
consent = "relied on nowhere"
test    = "purpose, necessity, balance"

Each row in the inventories above carries its own footing. Three appear across the whole operation, and consent is not among them, which is why no banner interrupts a page and nothing here asks you to agree to something before it will work.

Writing down the lawful basis as legitimate interests and stopping there discloses nothing: it names a doorway rather than what came through it. Every reliance below has been put through the three questions the assessment asks. Is the interest a real one. Would the purpose fail without this processing. Does the interest still hold once the individual's own interests and freedoms are set against it.

Scrolls sideways on a narrow screen.

Any row above can be objected to under Article 21(1). An objection that succeeds ends the processing. One that does not gets the countervailing reasons set out for you in writing, rather than asserted at you.

[retention]
rule   = "a period with no reason is a habit"
clock  = "stated per record, below"
expiry = "removal, not archival drift"

Article 5(1)(e) lets a record live only as long as its purpose needs it. Every period in the schedule therefore carries the reason that fixed it. Periods with no reason behind them are how a mailbox quietly turns into an archive nobody meant to build.

Scrolls sideways on a narrow screen.

Removal means gone from the live system straight away, and gone from routine backups as those rotate out on their own cycle. A record frozen under part 13 instead of removed is kept, but not worked with.

[transfers]
routes = ["recognition", "IDTA", "UK addendum"]
review = "destination examined before reliance"
copy   = "on request"

Some of what the company depends on runs on infrastructure spread across many countries. An international transfer of that kind is permitted only down one of the routes Chapter V sets out, and part 7 records which route each recipient sits on.

10.1 Where the destination is recognised

Where the destination carries a formal United Kingdom finding, nothing further is needed. That covers the European Economic Area, the other jurisdictions holding such a finding, and any United States organisation certified under the arrangement usually called the UK–US data bridge.

10.2 A standalone agreement

Where recognition does not reach, the fallback is the transfer agreement the Information Commissioner publishes for exactly this purpose: a self-contained contract binding the importer, used where a supplier will sign something drafted for the United Kingdom rather than adapted into it.

10.3 An addendum to the European clauses

Most suppliers of any size contract on the European standard contractual clauses and will not vary them. For those, the route is the addendum published to sit alongside that agreement, which bends the European text into a workable UK instrument. It is the route this site's hosting sits on.

10.4 Looking at the destination first

A signed instrument on its own settles nothing. Before either route is relied on, the destination gets examined: what its law permits by way of state access, how much data is going and of what kind, and whether encryption in transit and at rest brings the residual risk down far enough. With volumes this small and no sensitive categories in play the examination is short, but it happens rather than being presumed.

10.5 Getting a copy

Article 15(2) lets you ask to see the safeguard a transfer runs on. Where the terms are public, you get pointed at them. Where they were negotiated, you get the operative parts, with the commercial figures blacked out.

[measures]
transport = "HTTPS only, HSTS asserted"
surface   = "no application server, no database, no panel"
accounts  = "second factor on every one"
devices   = "whole-disk encryption, automatic lock"

Article 32 asks for measures matching the risk. These are the ones running, written so they can be checked rather than admired:

• the site answers over HTTPS alone, with strict transport security asserted, and the response headers in its _headers file constrain framing, content type guessing, and how much of a URL leaks in a referrer;
• there is no application server, no database and no administrative interface behind it, which removes a category of risk rather than defending one;
• the accounts controlling the domain, the hosting and the mailbox each carry a second factor;
• machines used for the work encrypt their disks and lock themselves without being asked;
• getting into a client system is done with credentials that client issues, scoped to the work and cancelled by them at the end;
• client material is not copied onto personal accounts or personal machines at any stage;
• suppliers are picked partly on what they publish about their own security, and are held to written processing terms.

[breach]
covers      = "records destroyed, altered, exposed, or opened"
regulator   = "72 hours, where risk is likely"
individuals = "where the likely harm is high"
file        = "opened either way"

The law's idea of a breach runs wider than the word suggests. It reaches records destroyed or lost by accident, altered when they should not have been, exposed to somebody with no business seeing them, or opened by somebody with no authority to. An attachment sent to the wrong recipient qualifies. So does a laptop left on a train. An intrusion is only the most dramatic member of the set.

12.1 The sequence

1. Stop it spreading. Pull the credential, kill the link, isolate the account, get the exposure to stand still.
2. Open the file. What happened, when it surfaced, which categories and roughly how many people and records, what is likely to follow, what has been done. Article 33(5) wants this whether or not anybody outside ever has to be told.
3. Judge the risk. Decide whether people's rights and freedoms are likely to suffer for it.
4. Tell the regulator where that judgement says so. Notification goes to the ICO promptly and, where it can be managed, inside 72 hours of the company becoming aware, with an explanation attached to any part that runs late. Where notification is not owed, the reasoning for that goes in the file too.
5. Tell the people where the harm is high. Article 34 turns on severity: where the likely harm is high, those affected hear it directly, in plain words, with what happened, who to ask, what may follow, and what has been done about it.
6. Close the hole, and write up what changed.

12.2 When individuals need not be told

Article 34(3) lifts that last duty in three situations: the data was unreadable to whoever got it, typically through strong encryption; steps taken since have brought the severity back down; or reaching everyone individually would take effort out of all proportion, in which case a public notice does the work instead. Whichever applied, and why, is written into the file.

12.3 Where the incident is a client's

Under Article 33(2) a processor's duty runs to the controller. The client hears first, quickly, with everything known at that moment, including the parts still uncertain. Whether the regulator and the affected people are told is theirs to decide, and no notification goes out on their behalf unless the contract puts that job here.

[rights]
cost   = 0
window = "one month"
route  = "[email protected]"
note   = "as processor: run them against the client"

What follows applies where VAIR LTD settled the processing. Where a client settled it, the same entitlements exist but are exercised against that client, as part 3 explains. None of this costs anything to use.

13.1 Being told

Articles 13 and 14 entitle you to know what becomes of data about you. This document is how that is discharged, and it is written down at the level of the field.

13.2 Getting a copy

Article 15 lets you ask whether anything about you is held and, if so, to receive it, along with the purposes, the categories, who else has seen it, how long it stays, where it came from if not from you, and the rest of what is in this part. Copies go out electronically unless you would rather have them another way. Where releasing something would expose another person, that part is masked, and you are told the masking happened.

13.3 Correcting it

Article 16 covers data that is wrong, and data that stops halfway. Send the right version and the record is amended. Where the old version had already gone to a recipient in part 7, that recipient is told, unless telling them is impossible or out of all proportion, and you learn who was contacted.

13.4 Having it removed

Article 17(1) reaches data no longer needed for its purpose, data whose consent has been withdrawn, data left over after an objection succeeds, data handled unlawfully, and data the law says must go. The entitlement has limits. Where a statutory duty forces a record to stay — most often the six year accounting span in part 9 — or where the record is what a live claim turns on, the request is refused with the exemption named, and the record is then frozen instead, so it sits untouched until its period runs out. Part 15 takes deletion of data further.

13.5 Freezing it

Article 18 lets you require that data stop being used while something is settled: an accuracy dispute, an objection under consideration, or a situation where you need a record preserved for a claim rather than deleted. Frozen data is retained and otherwise left alone, and you hear from us before any freeze is lifted.

13.6 Taking it elsewhere

Article 20 reaches processing that runs on consent, or on a contract with you, and is carried out by automated means. Where it applies you can receive what you provided as a structured file in a common format another system can read, and ask for it to be sent onward where that is technically possible. Most of what is held here rests on legitimate interests, so the entitlement often does not engage; the answer says which parts qualify rather than refusing the whole thing.

13.7 Objecting

Article 21(1) lets you object to anything resting on legitimate interests, for reasons particular to your own circumstances. The processing then stops unless there are grounds weighty enough to outweigh your interests and freedoms, or the data is bound up in a legal claim. Article 21(2) makes objection to direct marketing absolute, and part 20 explains why that limb has nothing to bite on here.

13.8 Withdrawing consent

Article 7(3) lets consent be withdrawn whenever you like, as easily as it was given, without unsettling what was lawfully done beforehand. Since stanza 8 relies on consent for nothing, this one has no work to do on this site.

13.9 Automated decisions

Article 22 protects you against being dealt with by machine alone where the outcome carries legal weight, or something close to it. Part 18 sets out the position.

13.10 Going to the regulator, or to court

Article 77 opens a complaint route to the ICO, described in part 21, and Article 79 preserves a route to court on top of it. Neither requires you to come here first, though a direct complaint is usually the quickest way to get something corrected.

[requests]
wording   = "no particular form needed"
identity  = "proportionate to what is asked"
clock     = "starts once you are identified"
extension = "two months, intricacy only"

14.1 How to ask

Write to [email protected]. No formula is required and no template exists. It moves faster if you name which entitlement you are using and, for a copy request, whether you want everything or a defined slice of it.

14.2 Establishing who you are

Article 12(6) permits reasonable steps to confirm identity where there is genuine doubt. The approach scales with the request rather than reaching for documents by reflex:

• writing from the address the data is already attached to normally settles it outright;
• from a different address, the ask is either a reply from the original one, or some detail only the right person would hold, such as when a thread ran and what it was headed;
• photographic documents are asked for only where the request is broad, the material sensitive, or the cost of handing it to the wrong person real. Where that happens, the reason is explained, a redacted copy is accepted, and it is destroyed inside thirty days.

The month runs from the point identity is settled, and identity is settled by asking early rather than by letting a request sit.

14.3 Timing

Article 12(3) sets one month, and that is the target. Where a request is genuinely intricate, or several arrive at once, a further two months is available, but only if you are told inside the first month and told why. Receipt is confirmed as soon as the message is read, so nobody is left wondering whether it arrived.

14.4 Refusals

Article 12(5) allows a request to be turned down, or charged for, where it is plainly baseless or repeated past the point of reason. The exemptions in the Data Protection Act 2018 apply as well, including material covered by legal privilege and confidential references. On top of those: removal can be refused where a statutory duty or a live claim requires the record to stay; a copy can be partly refused where releasing it would expose somebody else, in which case the exposed part is masked rather than the whole request declined; and portability does not reach processing resting on legitimate interests or on a legal obligation.

Any refusal comes inside the month, names its ground, and carries the routes onward: the regulator, and the courts. Nothing is refused by going quiet, and an inconvenient request is not treated as an excessive one.

14.5 Cost

Using an entitlement costs nothing. A charge arises only in the narrow case above, and the amount and its ground would be put in writing before any work started.

[deletion]
ask         = "one line of email is enough"
covers      = "correspondence, request files, contact details"
blocked_by  = ["statutory record", "live claim"]
client_data = "the client instructs, not us"

Deletion of data is asked for in one line, and no reasoning has to be attached to it. Say what you want gone and it goes, subject only to the two blockers in the stanza. Since this site carries no account system, there is no account to close first, no settings screen to hunt for, and no confirmation loop to survive.

What can be removed on request: correspondence and its transport detail, the file kept about an earlier request, contact details held for an enquiry that went nowhere, and material sent in with a security report once the underlying issue is shut. What cannot: an entry in the ledger the Companies Act 2006 obliges the company to keep, and any record a live or reasonably anticipated claim turns on. In both cases the record is frozen under part 13 rather than kept in use, and it goes when its period in part 9 runs out.

Deletion of data held for a client works differently. There, the instruction has to come from the client, because Article 28 leaves that decision with the controller. A request arriving here is forwarded the same day it is read, and the sender is told who now holds it.

A confirmation goes back when the work is done, naming what was removed and what, if anything, had to stay and why.

[children]
audience             = "professional engineering teams"
directed_at_children = false
knowingly_collected  = "none"

Both this site and the tooling behind it are addressed to people who maintain build systems for a living. Nothing here is designed to catch the attention of children, nothing is presented in a way pitched at them, and no data is knowingly taken from anyone under thirteen. Anything the company releases is addressed to that same professional audience.

If you have reason to think a child's details have reached this company, write to [email protected] and they will be removed without argument. Because what is offered here is not a service held out to children, the age threshold in Article 8 does not arise and the regulator's code on age appropriate design is not engaged. Should that ever change, this part is rewritten before the change reaches anybody, rather than afterwards.

[special_category]
sought     = false
condition  = "none currently relied on"
incidental = "read once, copied nowhere"

Article 9 marks out a protected set: health, belief and philosophical conviction, political opinion, union membership, ethnic and racial origin, sexual orientation and sex life, genetic material, and biometrics used to identify somebody. Article 10 deals separately with records of offences and convictions. Neither set is asked for anywhere in this operation.

17.1 The position

The site asks for nothing, the mailbox asks for nothing, the contracting process asks for nothing, and a build system does not carry this material in the ordinary course. So no condition under Article 9(2), and no condition in the Data Protection Act 2018, is currently being relied on for anything.

17.2 If it arrives regardless

People occasionally volunteer more than they meant to: a medical reason for a delayed reply, say. Material like that is incidental and unwanted. It gets read as part of the message it sits in, copied into no other record, and it expires when that message does under part 9. Where it survives at all it survives because the message does, and the condition would be the legal claims limb of Article 9(2), read with the corresponding entry in the 2018 Act.

17.3 Better not to send it

Nothing this company does needs it. If a message would otherwise carry it, take it out before you press send.

[automation]
machine_only_decisions = false
profiling = false
scoring   = false

Nothing about you is settled by machine alone in a way carrying legal weight or anything close to it, which is the territory Article 22 governs. Nobody is scored, ranked, sorted into a segment, assessed for eligibility by algorithm, or shown different content on the strength of a model. The site is the same set of files for every reader who asks for it.

One piece of automation does run: the filter deciding which folder an incoming message lands in. That decides a folder rather than a person, and carries no legal or similar effect. When it swallows something legitimate, reaching the company by any other route is the fastest way to get the message back out.

[tooling]
telemetry        = "off unless switched on"
advertising_ids  = false
third_party_sdks = false
build_content    = "stays with the build"

This part governs what command line and service tooling distributed under the VAIR name may do with data. The commitments below bind a release rather than describe one, so that a version can be measured against them instead of the wording being tidied up afterwards to match whatever the version turned out to do.

• Nothing is measured unless it is switched on. If usage telemetry is ever added, it arrives switched off, and the exact fields it would carry get listed in this part before the version carrying it goes out.
• No advertising identifier is read. Not the platform ones, not any equivalent, on any operating system.
• No analytics or advertising component is linked in.
• Build content stays where it was produced. Source, logs and cache entries belong to whoever built them and are not transmitted to this company. A self-hosted cache tier exists precisely so the whole path can stay on infrastructure the user controls.
• Crash reporting, if it appears, is opt in, strips file paths and environment values before anything leaves the machine, and is named here together with whoever operates it.

A commitment that has to move moves in this document first, and part 22 records the move. A data practice does not ship ahead of its description.

[pecr]
written_by_this_site = 0
banner    = "none, since there is nothing to permit"
bulk_mail = "never sent"

Nothing is written onto your device by this site, so the permission duty that the Privacy and Electronic Communications (EC Directive) Regulations 2003 place on anyone keeping or reading data there is never triggered. That is also why no banner appears: a banner with nothing behind it harvests a click and answers no question. The cookie statement works through the detail, including what your own browser does on its own account.

On mail in the other direction: the company runs no bulk list, no newsletter and no campaign tooling, so there is nothing to unsubscribe from and nobody is added to anything by writing in. Replies to your own messages, and mail about work already agreed, are correspondence rather than marketing. If a subscription of any kind were ever offered, joining it would be a deliberate act on your part and leaving it would take one click, as those same regulations require.

[complaints]
first_stop = "[email protected]"
regulator  = "Information Commissioner's Office"
telephone  = "0303 123 1113"
web        = "ico.org.uk"

If something here has gone wrong, saying so directly is usually the quickest way to get it put right, and a complaint gets a considered answer rather than a holding line. Nothing obliges you to start here, though.

Article 77 gives you a direct route to the supervisory authority for the United Kingdom, which is the Information Commissioner's Office. It can be reached at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or through the complaint pages at ico.org.uk/make-a-complaint. Complaining costs nothing, and requires nobody to act for you.

Going to the regulator does not close off a court. Article 79 keeps a judicial route open alongside it, and Article 82 covers compensation where damage has actually been suffered.

[revision]
current = "A"
dated   = "2026-08-07"
rule    = "the letter moves when the position moves"

When the handling changes, the revision letter at the top of this document changes with it and the date beside it moves. A material change — a new recipient, a different footing, a period extended, a commitment in part 19 withdrawn — is described rather than absorbed silently into the text, in the same way the front page treats its own revisions.

Where a change would affect somebody whose data is already held, and there is an address to reach them at, they hear about it before it takes effect rather than after.

Questions about any part of this, including the parts you disagree with, go to [email protected].