Privacy & cookie policy
What we hold, why we hold it, how long we keep it and what you can ask us to do about it. Written to be read, with a plain-English note beside every clause.
Clause 1: Who we are
VIP-System Limited is the data controller for the information described in this policy. We are registered in Scotland under company number SC132864, at 2 Rutherford Court, 15 North Avenue, Clydebank Business Park, West Dunbartonshire G81 2QP.
We are not required to appoint a Data Protection Officer and have not appointed one. Responsibility for data protection sits with the Managing Director. For anything in this policy, write to privacy@vip-system.com or to the address above marked for the attention of the Managing Director.
In plain English
We are the ones responsible for your data, and this is who to email about it.
Clause 2: What we collect
Almost everything we hold is business contact information: the name, job title, work email address, work telephone number and work address of the people who order from us and the people who take delivery.
| The enquiry form on this website | Name, job title, work email address, work telephone number, and whatever you choose to tell us in the message. |
|---|---|
| Our shop site | Name, delivery and billing address, email address, telephone number and what you bought. Card details go straight to the payment provider and never reach us. |
| Pre-listed order forms (PLOFs) and emailed orders | Name, job title, work contact details, delivery address, order detail, purchase order references and authority account codes. |
| Telephone calls and site visits | Notes of requirements, specifications and agreed changes. |
| Artwork and specification files you send us | Crests, wordmarks, layouts, and the covert specifications covered by clause 4. |
| This website | The cookies listed in clause 11, and standard server logs including IP address. |
We do not collect special category data - nothing about health, ethnicity, beliefs, trade union membership, sex life or biometrics. We do not hold card details anywhere. Nothing is sold, ordered or paid for on this website – there is no shop, no basket and no checkout here. Plates, badges, discs and signs are ordered by pre-listed order form, by email, by telephone or in person, and we invoice for them. Fitting kits and accessories are sold through a separate shop site, covered by clause 10. If you send us anything we have not asked for, we will delete it.
In plain English
Work contact details, what you ordered and what we said to each other. Nothing about your private life, and no card details at all.
Clause 3: Why we use it and our lawful basis
We must have a lawful basis for every use. Ours are set out below, under the UK GDPR and the Data Protection Act 2018.
| Purpose | Lawful basis |
|---|---|
| Taking, making and delivering your order, and dealing with anything that goes wrong with it | Performance of a contract with you, or steps taken at your request before entering one |
| Holding artwork and specifications so we can reprint or reissue without you having to send them again | Legitimate interests - continuity of supply to the authority |
| Keeping accounting, tax and export records | Legal obligation |
| Telling existing and prospective customers about products relevant to licensing authorities | Legitimate interests, and in line with the direct marketing rules for business contacts |
| Preventing fraud, counterfeiting and misuse of licensing material | Legitimate interests - public safety and protection of the licensing regime |
| Improving our products and understanding what authorities need | Legitimate interests - we use order history in aggregate, not individual records |
You can tell us to stop sending you marketing at any time, by replying to any message or writing to the address in clause 1. We will stop, and we will not ask you to confirm it twice.
Clause 4: Covert and security specifications
Covert pattern artwork, placement, wavelength and specification are treated as confidential to the authority that commissioned them. They are held separately from ordinary order records, under restricted access, and are released only to named staff who need them to manufacture or reissue.
We do not reproduce live covert artwork in marketing material, on this website, at exhibitions or in samples. Anything shown publicly carries a demonstration pattern that is not in use on any real plate. We do not tell one authority what another has specified.
In plain English
Your covert artwork is kept apart from ordinary order paperwork, and we never publish it.
Clause 5: Who we share it with
We share what is necessary, with organisations that are bound to use it only on our instructions:
- Carriers, to deliver your order and obtain a signature.
- Our payment provider, to take card payments made through the shop site.
- The platform the shop site runs on, which holds shop orders on our behalf.
- Our bank, where an invoice is settled.
- Our accountants and auditors, for statutory records.
- Our IT and hosting suppliers, who maintain the systems the data sits on.
- Law enforcement, a licensing authority or a court, where we are required to or where it is necessary to investigate suspected counterfeiting of licensing material.
We do not sell personal data, we do not share it for anyone else's marketing, and we do not pass your details to another manufacturer. We do not use personal data to train automated systems, and no decision affecting you is made by automated means.
In plain English
Carriers, our payment provider, our accountants and our IT support. We do not sell anything to anybody.
Clause 6: How long we keep it
We do not keep personal data indefinitely. Where a period below has passed, records are deleted or anonymised.
| Record | Kept for |
|---|---|
| Orders, invoices and delivery records | 7 years from the end of the financial year, for tax purposes |
| Artwork, specifications and covert pattern records | The life of the supply relationship, then 3 years, unless the authority asks us to destroy them sooner |
| Enquiries that did not become orders | 24 months from the last contact |
| Marketing contact records | Until you ask us to stop, then a minimal record so we do not contact you again |
| Correspondence about a complaint or a claim | 6 years from resolution |
| Website server logs | 12 months |
In plain English
Roughly: seven years for anything financial, and artwork for as long as you are still using the plate.
Clause 7: Where it is held
Personal data is held on systems located in the United Kingdom. Where a supplier processes data outside the UK, we put in place the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with a transfer risk assessment, before any data moves.
In plain English
In the UK. If that ever changes we will say so here first.
Clause 8: Your rights
You have the following rights over personal data we hold about you:
- Access - a copy of what we hold, and an explanation of what we do with it.
- Rectification - correction of anything inaccurate or incomplete.
- Erasure - deletion, where we no longer need it and no legal duty requires us to keep it.
- Restriction - we keep it but stop using it, while a dispute about it is resolved.
- Portability - the data you gave us, in a machine-readable file.
- Objection - to any use we base on legitimate interests, and to direct marketing at any time, which we will always honour.
- Withdrawal of consent - where we relied on consent, without affecting what we did before you withdrew it.
Write to privacy@vip-system.com. We respond within one month and there is no charge. We may ask you to confirm who you are before we release anything, and if a request is excessive or repetitive we will explain why before charging or refusing.
In plain English
You can see it, correct it, get a copy, or tell us to stop. It is free and it takes us a month at most.
Clause 9: Security and breaches
Access to personal data is limited to staff who need it. Systems are patched, backed up and access controlled, and covert specifications sit behind a further restriction as set out in clause 4.
We have procedures to detect, report and investigate a personal data breach. Where a breach is likely to result in a risk to people, we report it to the Information Commissioner’s Office within 72 hours of becoming aware of it. Where it is likely to result in a high risk, we tell the people affected directly and without undue delay.
In plain English
If something goes wrong with your data, we tell the regulator within 72 hours and we tell you if it affects you.
Clause 10: The shop site
We run a separate shop site at https://vip-system-limited.myshopify.com/, linked from this one. It sells fitting kits and accessories only. Plates, badges, windscreen discs, door signs and anything carrying an authority's identity are never sold there, and never sold to the public.
VIP-System Limited is the data controller for the shop site as well as this one, so this policy applies to both. What differs is that the shop takes payment and delivers to an address you give it.
Card details are entered directly with our payment provider and never reach our systems or our staff. The shop platform holds your order on our behalf under a written processing agreement. Your delivery address is passed to the carrier, and nothing else about you is.
The shop sets its own cookies, which are different from the ones listed in clause 11 and are listed in the cookie notice on the shop site itself. Buying there is governed by the shop's own terms and conditions, not by our terms of use.
In plain English
Our shop is a different site selling only fitting kits and accessories. It takes payment; this site does not.
Clause 11: Cookies
A cookie is a small text file a website stores on your device. Because there is no shop, basket or checkout on this site, it needs very few. The two that are strictly necessary are set automatically. Everything else is set only if you agree, and you can change your mind at any time through cookie settings. This table covers this site only - the shop site sets its own, which are listed there.
| Cookie | Type | What it does | Expires |
|---|---|---|---|
| vip_consent | Strictly necessary | Remembers which cookies you agreed to, so we do not ask again on every page. | 12 months |
| vip_csrf | Strictly necessary | Protects the enquiry form against being submitted from another site. | End of browser session |
| _ga / _ga_<id> | Analytics - optional | Counts visits and shows us which pages are used, in aggregate. IP addresses are truncated. | 13 months |
You can also block or delete cookies in your browser settings. Blocking the strictly necessary ones will stop the enquiry form working.
Clause 12: Complaints
If you are unhappy with how we have handled your data, tell us first - most things are quicker to fix directly. If you are still unhappy you can complain to the Information Commissioner's Office, which regulates data protection in the UK.
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk. You do not need our permission to complain, and complaining does not affect anything else we do for you.
In plain English
Come to us first. If we get it wrong, the ICO is the place to go.
Clause 13: Changes to this policy
We review this policy at least once a year and whenever we change how we handle data. The version number and date at the top of this page tell you which version you are reading.
Where a change materially affects you, we will say so on this page and, for customers with an open account, by email. Previous versions are kept and are available on request.
In plain English
We date and number every version, and we keep the old ones.
Questions about any of this?
The plain-English notes are a summary and are not part of the policy. Where the two differ, the clause text applies.
Talk to us