Privacy Policy

Last updated: September 2026

Steph Virtual Assistant Limited ("we," "our," or "us") is committed to protecting your personal data and privacy. This policy outlines how we collect, use, and safeguard your information in compliance with the UK General Data Protection Regulation (UK GDPR) and other applicable laws. Steph Virtual Assistant Limited is the controller of personal information covered by this Privacy Policy, except where we process personal information solely on behalf of a client as their processor.

1. How We Collect Your Information

We may collect personal information when you complete a form on our Website; book a meeting or service; purchase services; enter into a contract with us; contact us by email, telephone, text, WhatsApp or social media; subscribe to marketing communications; interact with us through networking, referrals or other business activities; or use our Website, including through cookies, analytics and log data.

2. Legal Basis for Processing Your Data

Under UK GDPR, we process your personal data based on:

Consent: When you provide clear consent (e.g., subscribing to emails).
Contractual necessity: Where processing is necessary to take steps at your request before entering into a contract or to perform our contractual obligations.
Legal obligation: When required by law (e.g., tax records).
Legitimate interests: Where processing is necessary for our legitimate business interests, including managing client and prospective-client relationships, operating and improving our business, maintaining security, preventing fraud and undertaking appropriate business-to-business marketing, provided those interests are not overridden by your rights and interests.
Marketing: Where we send electronic marketing, we rely on consent or legitimate interests as appropriate and comply with applicable Privacy and Electronic Communications Regulations (PECR) requirements. You can opt out of marketing at any time.

3. Types of Data We Collect

We may collect the following personal information:

Name, email address, and phone number.
Business information (if applicable).
Payment and transaction details (processed securely via third-party payment processors).
Website usage data, IP addresses, and browsing behaviour.
Enquiry and correspondence records; booking information; contractual and service information; marketing preferences; and information you voluntarily provide to us during the course of our business relationship.
Payment and transaction information. Where payments are made through a third-party payment provider, payment details are processed securely by that provider. We may receive transaction information and limited payment information but do not ordinarily receive or store your full payment card number.

4. How We Use Your Personal Data

We use your data to:

Provide and manage our services.
Process transactions and send invoices.
Respond to enquiries and customer support requests.
Send newsletters, promotions, and business updates (you can opt out anytime).
Improve our website and services using analytics.
Manage prospective and existing client relationships; administer contracts and bookings; maintain business and accounting records; protect the security of our systems and services.

5. Client Data

Information we process on behalf of clients: In providing virtual assistant and business support services, we may process personal information relating to our clients' employees, customers, suppliers or other contacts. Where the client determines the purposes and means of that processing, the client is generally the controller and Steph Virtual Assistant Limited acts as its processor. Such information is processed in accordance with the client's instructions and our contractual data-protection obligations. Queries about that information should normally be directed to the relevant client.

6. Sharing Your Personal Data

We may share personal information where necessary with trusted providers supporting our business, including website hosting, IT, cloud storage, communications, analytics, email marketing, payment, accounting and business administration providers.
All third-party processors are contractually required to comply with UK GDPR and take appropriate security measures.
We do not sell or rent personal data to third parties.
Where personal information is transferred outside the UK, we ensure that an appropriate safeguard, adequacy arrangement or other lawful transfer mechanism is in place where required under UK data protection law.
Authorised members of the Steph VA team, including associates and subcontractors, may access personal information where necessary to provide our services. They are required to maintain appropriate confidentiality and data-protection standards.

7. Retention of Your Data

We retain personal data only for as long as necessary:

Contact form data: 12 months.
Accounting and transaction records: normally six years or for such longer period as required by applicable law.
Client contracts and significant service correspondence: normally retained for up to six years after the end of the client relationship where necessary for legal, contractual or record-keeping purposes.
Marketing information is retained while you remain subscribed or while we have an appropriate lawful basis to contact you. We periodically review marketing records and may remove inactive contacts. Where you opt out, we may retain limited suppression information to ensure your preference continues to be respected.
Personal information processed solely on behalf of clients is retained in accordance with the relevant client agreement and their instructions. Where Steph VA holds downloaded working copies, these will ordinarily be securely deleted within 30 days after the relevant services end, unless retention is required by law or otherwise agreed.

8. Your Rights Under UK GDPR

You have the following rights:

Right to access – Request a copy of your data.
Right to rectification – Correct inaccuracies.
Right to erasure – Request data deletion.
Right to restrict processing – Limit how we use your data.
Right to data portability – Request data in a structured format.
Right to object – Object to data processing.
Right to withdraw consent – Revoke consent at any time.
Right to complain to the Information Commissioner's Office (ICO).

These rights do not apply in every circumstance and may be subject to exemptions or limitations under applicable law. To exercise your rights, contact us at support@steph-va.co.uk. We aim to respond to all requests within one month, as required by UK GDPR.

9. Security of Your Personal Data

We take appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. Access to personal information is restricted to those who require it for legitimate business purposes, and members of our team are required to comply with confidentiality and data-protection obligations.

10. Cookies and Tracking Technologies

We use cookies to enhance user experience and analyse site traffic. Please refer to our Cookie Policy for detailed information and to manage your preferences.

11. Contact Information for Privacy Concerns

For any questions regarding this policy or to exercise your rights, please contact us:

Steph Virtual Assistant Limited
12 Harvest Hill Road, Maidenhead, Berkshire, SL6 2QQ

Email: support@steph-va.co.uk

12. Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our business, technology or applicable law. The latest version will be published on this page with its last-updated date.