Introduction

Vi-VA respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, enquire about or use our services, or apply to work with us. It also explains your privacy rights and how the law protects you.

Please see the Glossary at the end of this policy for explanations of certain terms.

1. Important information and who we are

Purpose of this Privacy Policy

This Privacy Policy explains how Vi-VA collects and processes personal data when you use our website, enquire about or receive our services, communicate with us, or apply to work with us.

It also covers personal information we collect and use when managing our relationships with clients, prospective clients and our virtual assistants.

Our website and services are not directed at children. However, we may occasionally process personal information about children when providing administrative support to our clients, where necessary and in accordance with applicable data protection law.

This Privacy Policy should be read alongside any other privacy information we give you when we collect or use your personal information. It supplements those notices without overriding them.

This Privacy Policy was last updated on 12 November 2026.

Controller

Viva Business & Lifestyle Ltd, trading as Vi-VA (company number 09005831), is the controller for personal information handled for its own business purposes.

When we provide services to clients, we may also process personal data on their behalf and in accordance with their instructions. In these circumstances, the client will generally be the data controller and Vi-VA will act as a data processor. Our responsibilities will depend on the nature of the services and the arrangements agreed with the client.

If you have a question about this Privacy Policy or how we handle personal information, please use the contact details below.

Contact details

Full legal name: Viva Business & Lifestyle Ltd, trading as Vi-VA

Company number: 09005831

Data protection enquiries: website@vi-va.co.uk

Email: website@vi-va.co.uk

Postal address: 207 Knutsford Road, Grappenhall, Cheshire, WA4 2QL

Telephone: 01244 350341

Data protection complaints

If you have a concern about how Vi-VA collects, uses, stores, shares or protects your personal data, please contact us at website@vi-va.co.uk.

We’ll acknowledge your complaint within 30 days of receiving it. We’ll then review what happened, make appropriate checks, keep you informed of our progress and respond without undue delay.

Our response will explain the outcome of your complaint and any action we’ve taken.

You also have the right to complain to the Information Commission’s Office (ICO), the UK data protection regulator. We would appreciate the opportunity to address your concern first, so please contact us using the details above.

Information Commission’s Office
4th Floor, No. 3 Circle Square
5 Hawkshaw Street
Manchester M1 7BL
Telephone: 0303 123 1113
Website: https://ico.org.uk/

Keeping your information accurate

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

2. The information we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and share the following types of personal information, where relevant to our relationship with you:

 • Identity Data may include your name, title, date of birth and identity verification details where relevant to our relationship with you.

• Contact Data includes postal and email addresses, billing details and telephone numbers where relevant.

• Associate Information includes information relating to our relationships with virtual assistants and applicants, such as relevant recruitment, contractual and administrative records.

• Financial Data includes bank account and payment details where needed for billing or payments.

• Transaction Data includes payments to and from us and information relating to services supplied or purchased.

• Technical Data may include IP addresses, browser and device information and other technical information generated when you use our website.

• Profile Data may include preferences, feedback and details you provide about the services you need.

• Usage Data includes information about how you use our website and services.

• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

• Support and Accessibility Information includes information you choose to share with us about your support needs, health conditions, neurodivergence (including ADHD), communication preferences and preferred ways of working, where relevant to the services we provide. This may also include information contained in Access to Work award confirmations where necessary for administering our services.

• Client Administration Information includes personal information we may handle when providing administrative services, such as correspondence, appointments, contact details, financial records, invoices, travel arrangements and information about a client’s employees, business contacts or family members.

• Recruitment and Team Information includes information collected when someone applies to work with Vi-VA or joins our team, such as CVs, application details, interview notes, references, identity verification information, contact details, agreements, insurance information and records relating to their work with us.

• Identity Verification and Compliance Information includes information collected to meet our legal and regulatory obligations, including identity documents, proof of address, dates of birth, company ownership information, identity verification results and anti-money laundering risk assessments, where applicable.

We may use anonymised or aggregated statistics to understand use of our website and improve our services. Where individuals can still be identified, we treat the information as personal data.

Special category information

Where relevant to the services we provide, we may use information you share with us about your ADHD, health, accessibility needs or preferred ways of working to understand your requirements and tailor our support.

We only record information that is necessary for this purpose and share relevant details with authorised members of our team who need the information to provide your services.

Where this information constitutes special category personal data, we identify an Article 6 lawful basis and an additional Article 9 condition before processing it. For information about a person’s ADHD, dyslexia, autism or other disclosed health-related condition that we record to tailor our support, our Article 9 condition is explicit consent.

We may also encounter other special category information while delivering administrative services on a client’s instructions, depending on the nature of the work. Our role, lawful basis and responsibilities will depend on the activity and whether we act as controller or processor. We do not routinely ask our virtual assistant applicants to provide health information.

During a discovery call, we explain why recording the disclosed information may help us understand a person’s support needs and, if they become a client, how it may be shared with their virtual assistant. We ask for express agreement before recording such special category information for that purpose. Consent may be withdrawn at any time by contacting us. Where consent is withdrawn, we stop the relevant processing and address the information already held, subject to any applicable legal requirements.

If you do not provide information

Where we need information to meet a legal obligation or perform an agreed service and you do not provide it, we may be unable to provide some or all of that service. We will explain this where relevant. You are not required to disclose ADHD or health information simply to enquire about our services.

3. How we collect personal information

Direct interactions

You may provide us with personal information when you enquire about our services, book or attend a discovery call, complete onboarding forms, enter into an agreement with us, use our services, subscribe to our communications or apply to work with us.

We may also collect relevant information during telephone calls, video meetings, email correspondence and other communications with you.

Website technologies

When you use our website, we may collect technical and usage information through server logs, cookies and similar technologies. The use of non-essential cookies is subject to any consent required by law. Please see our Cookie Policy.

Third parties and publicly available sources

We may also receive personal information from third parties where relevant to our business activities. This includes references provided by previous employers or clients during recruitment, identity verification and compliance information from our anti-money laundering service providers, and information provided by clients or their authorised representatives when arranging our services.

Depending on the activity, we may also receive relevant information from payment and accounting providers, company registers, publicly available sources, recruitment contacts and online platforms where you have engaged with us.

4. How and why we use your personal information

We process personal information only where we have a lawful basis under UK data protection law. Depending on the activity, this may include taking steps requested before a contract, performing a contract, complying with a legal obligation or pursuing legitimate interests after balancing those interests against individuals’ rights. We rely on consent where appropriate, including for certain marketing activities and disclosed special category information.

Some processing may involve more than one lawful basis. Where we process special category data, we also need a separate condition under Article 9 of the UK GDPR.

Purposes and lawful bases

Purpose	Information involved	Lawful basis
Responding to enquiries and arranging discovery calls	Contact details, enquiry details and ordinary working preferences	Legitimate interests in responding to enquiries or taking requested steps before a contract, depending on the nature of the enquiry.
Recording disclosed ADHD or health-related information to tailor support	The relevant information the individual chooses to disclose	Article 6: consent for recording the disclosed special category information for the described support purpose. Article 9(2)(a): explicit consent. We record an affirmative response and respect withdrawal. Other non-sensitive support preferences may be processed under a different appropriate basis.
Onboarding and delivering VA services	Identity, contact, administrative, support and transaction information	Contract where necessary for an agreement with an individual; legitimate interests or other relevant bases for other administration. When acting only as a processor, we follow the client’s documented instructions.
Billing, payments and accounting	Contact, transaction and financial information	Contract where necessary, legal obligation for required records and legitimate interests for appropriate payment administration.
AML identity verification and monitoring	Identity verification and compliance information	Legal obligation where AML rules apply. Where special category biometric data is processed to identify someone, an appropriate additional Article 9 condition must also apply.
Recruitment, references and associate onboarding	Applications, CVs, references, agreements and necessary checks	Legitimate interests in evaluating and selecting associates, contractual steps requested by an applicant or a legal obligation, as applicable.
Managing relationships with virtual assistants	Contractual, contact and administrative records	Contract, legal obligation and legitimate interests as applicable to the particular activity.
Keeping our website and systems secure	Technical and account information	Legitimate interests in preventing misuse and maintaining security, and legal obligations where applicable.
Marketing and follow-up communications	Contact details, preferences and communications	Consent or legitimate interests as appropriate, together with compliance with PECR and any consent requirements for electronic marketing.
Website analytics and advertising where used	Technical, usage and advertising information	Consent or another lawful basis appropriate to the activity, together with consent for non-essential cookies or similar technologies where required.
Responding to data rights requests, complaints and legal matters	Relevant identity, communications and case records	Legal obligation and legitimate interests in managing or defending claims where appropriate.

The table summarises the main purposes for which Vi-VA acts as a data controller and the lawful bases that may apply. Where we act as a processor for a client, the client is generally responsible for identifying the lawful basis for that processing.

Marketing

We may contact you with information about our services, updates and other relevant communications where permitted by law.

Depending on the circumstances, we may rely on your consent or our legitimate interests, including where the rules governing electronic marketing allow us to contact you.

You can opt out of marketing communications at any time by using the unsubscribe link in our emails.

We use GoHighLevel for enquiry follow-ups and currently use ActiveCampaign for some communications, with a move to GoHighLevel planned. We do not buy marketing lists. We provide unsubscribe options in our marketing emails and obtain consent or provide opt-out opportunities at collection where required by the applicable electronic marketing rules.

Cookies

We use cookies and similar technologies on our website to help it function properly, understand how visitors use it and, where applicable, support our marketing activities.

Where consent is required, we ask for permission before using non-essential cookies or similar technologies. Visitors can change or withdraw consent through the cookie preferences available on our website.

For further information, please see our Cookie Policy.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Automated decision-making

We do not use solely automated decision-making, including profiling, to make decisions about individuals that have legal or similarly significant effects.

5. Sharing your information

Virtual assistants

We share relevant personal information with the virtual assistants who provide services on our behalf. This may include client contact details, administrative information, support preferences and access to documents or systems needed to carry out the agreed work.

Our virtual assistants are required to maintain confidentiality, protect personal information and use it only for authorised purposes in accordance with their agreements with Vi-VA.

External providers

We may share personal information with trusted third-party service providers who help us operate our business and deliver our services. These may include accounting and payment providers, IT and website support providers, software and cloud storage providers, and identity verification and compliance services.

We seek to put appropriate data processing agreements and safeguards in place with service providers where required. We only share information where necessary for the relevant purpose.

Depending on the circumstances, recipients may include accountants, professional advisers, technical service providers, payment services and regulators where disclosure is required or permitted by law. Where we process information on behalf of a client, we share information in accordance with relevant arrangements and instructions.

6. International transfers

Some of our external service providers may process or store personal information outside the UK.

Where personal information is transferred internationally, we will ensure that appropriate safeguards are in place in accordance with UK data protection law. These may include transfers to countries recognised by the UK as providing adequate protection or the use of approved contractual safeguards where required.

7. Data security

We have appropriate technical and organisational security measures in place to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Access to personal information is restricted to authorised individuals who need it for legitimate business purposes. Our virtual assistants are bound by contractual confidentiality and data protection obligations, and we require relevant external service providers to meet appropriate data protection and security standards.

We regularly review our security arrangements and make improvements where necessary.

Personal data breaches

If we become aware of a personal data breach, we will investigate it promptly, take appropriate steps to contain the incident and assess any risks to the individuals affected. Where required by law, we will notify the Information Commission’s Office (ICO) and any affected individuals.

8. Retention

We only keep personal information for as long as reasonably necessary for the purposes for which it was collected, including meeting legal, regulatory, accounting and reporting requirements.

Different retention periods apply depending on the type of information and why we hold it. We regularly review the information we retain and securely delete or anonymise it when it is no longer needed, unless we are legally required or otherwise permitted to keep it for longer.

We decide how long to keep information by considering its purpose, whether our relationship is ongoing, applicable legal and regulatory requirements, potential complaints or claims and whether the information is still necessary. For example, AML records are generally retained for five years after the relevant business relationship ends, subject to legal exceptions. Unsolicited CVs retained with an applicant’s permission are normally held for up to six months. Accounting, contracts, client administration and other records may be held for different justified periods. We review records and securely delete or anonymise information when the relevant period ends, unless an applicable exception requires or permits longer retention.

9. Your data protection rights

Depending on the circumstances, you may have the right to request access to your personal information, ask us to correct it, request erasure, restrict processing, object to certain processing and request data portability. Where we rely on consent, you may withdraw it. These rights are subject to applicable conditions and legal exceptions.

We will respond to requests to exercise your data protection rights in accordance with applicable data protection law.

We may ask for additional information where reasonably necessary to confirm your identity or clarify your request. We will carry out reasonable and proportionate searches for relevant personal information and respond within the applicable legal timescales.

Some rights are subject to legal exceptions, including where we are required to retain information to comply with our legal or regulatory obligations.

Fees and identification

We normally deal with requests to exercise data protection rights free of charge. Where a request is manifestly unfounded or excessive, we may refuse it or charge a reasonable fee where the law permits.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limits

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

10. Glossary

Lawful bases

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

Your rights explained

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.