Privacy Policy

Velchanos Partners LLP is a Limited Liability Partnership registered in England and Wales under registration number OC458968. Its registered office is at 27 Old Gloucester Street, London WC1N 3AX, United Kingdom. The firm operates globally and remotely.

The firm is the data controller for the processing described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where a visitor is located in the European Economic Area, the EU GDPR is also relevant to the processing of their personal data.

Data protection enquiries, including requests to exercise the rights set out below, should be sent to avedillo@velchanos.com. The firm has not appointed a Data Protection Officer, as it is not required to do so.

The website at https://velchanos.com is a static single-page application. It has no contact form, no newsletter sign-up, no login, no user accounts and no payment functions. There is no server-side application and no database holding visitor information.

The site uses no analytics of any kind, no tag manager, no tracking pixels, no session recording, no advertising technology and no social media trackers. It sets no cookies. It does not profile visitors and carries out no automated decision-making.

The site is served from third-party hosting infrastructure. As with any internet connection, that infrastructure necessarily processes technical connection data such as IP addresses in order to deliver the pages and keep the service secure. The firm does not use such data to identify visitors and does not combine it with other information.

The site writes two entries to your browser local storage: velchanos_cookie_consent, which records whether you accepted or rejected the storage notice, and velchanos_locale, which records the interface language you selected.

Both entries stay on your device, are read only by the site running in your browser, and are never transmitted to the firm or to anyone else. They contain no identifiers, and the firm cannot read them. Because nothing is transmitted, the firm holds no personal data as a result of them. You can delete them at any time through your browser settings. The Cookie and Local Storage Policy describes both entries in full.

The site loads its typefaces from Google Fonts. When a page loads, your browser requests font files from fonts.googleapis.com and fonts.gstatic.com. Those requests disclose your IP address and standard technical request data, such as your browser and operating system, to Google LLC. This is the only third-party data flow on the site.

The legal basis is the firm's legitimate interests under Article 6(1)(f) UK GDPR in presenting the site consistently and serving it reliably. These requests set no cookies and store nothing on your device.

Google LLC is established in the United States, so this involves a transfer of personal data outside the United Kingdom. The transfer relies on the safeguards Google makes available for international transfers, including standard contractual clauses read with the UK International Data Transfer Addendum, and the UK extension to the EU-US Data Privacy Framework where it applies. You can prevent the disclosure by blocking remote fonts or third-party requests in your browser; the site remains fully readable with your system fonts.

Contact on the site is by mailto: link, which opens your own email client. The firm sees nothing you type until you choose to send it.

When you email the firm we process your email address, your name as it appears in the message, and the content of the correspondence. The purpose is to read, consider and answer your message and to keep a record of the exchange. The legal basis is the firm's legitimate interests under Article 6(1)(f) UK GDPR in responding to enquiries addressed to it or, where the exchange concerns a possible engagement, the taking of steps at your request before entering into a contract under Article 6(1)(b).

Email is handled by the firm's third-party email provider, which processes messages and their contents on the firm's behalf as a processor and under written terms.

In the course of advisory and venture-building work the firm processes business contact details and related information about the individuals it deals with: names, job titles, employers, business email addresses and telephone numbers, correspondence, meeting notes and the information exchanged in the normal course of an engagement. This information is usually provided by the individual, or by the client organisation that employs or engages them.

The legal bases are: performance of a contract under Article 6(1)(b) UK GDPR where the individual is the firm's counterparty; the firm's legitimate interests under Article 6(1)(f) in delivering the engagement it has been retained to perform, managing the relationship and keeping a record of its work, where the individual is employed or engaged by a client or counterparty; consent under Article 6(1)(a) where the firm relies on it, which may be withdrawn at any time; and compliance with legal obligations under Article 6(1)(c) for accounting, tax and record-keeping purposes.

The firm does not seek special category data and asks that none be sent to it unnecessarily. It carries out no profiling and no automated decision-making.

The firm keeps its supplier arrangements deliberately narrow. Personal data is disclosed to its email provider and to its website hosting provider, each acting as a processor under written terms that restrict processing to the firm's instructions, and, where relevant, to the firm's professional advisers, such as its accountants and lawyers, and to its insurers.

Personal data is disclosed to public authorities, courts or regulators only where the firm is legally required to do so. The firm does not sell personal data, does not share it with advertising networks or data brokers, and does not use it for any purpose incompatible with the purpose for which it was collected.

The firm is based in the United Kingdom and operates globally and remotely. Personal data may therefore be accessed from, or stored in, countries outside the United Kingdom, including by its service providers.

Where personal data leaves the United Kingdom, the firm relies on UK adequacy regulations where they apply and otherwise on the International Data Transfer Agreement, or the International Data Transfer Addendum to the EU standard contractual clauses, together with a transfer risk assessment. A description of the safeguards applied to a specific transfer is available on request by email.

Personal data is kept only as long as it serves the purpose for which it was collected, or as long as the law requires. Where data is no longer needed it is deleted or, where deletion from a backup is impractical, put beyond ordinary use.

• Enquiry correspondence that does not lead to an engagement: up to 24 months from the last message, then deleted.
• Client and engagement records, including correspondence: for the duration of the engagement and for six years afterwards, to meet legal, tax and professional record-keeping requirements.
• Accounting and tax records: for the periods required by UK law.
• The two local storage entries: on your own device until you clear your browser data. The firm holds no copy.

Under the UK GDPR you have the following rights in relation to your personal data, each subject to the conditions and exceptions the legislation provides.

To exercise any of them, write to avedillo@velchanos.com. The firm will respond within one month of receiving the request and will extend that period only where the request is complex, in which case it will tell you. The firm may ask for information reasonably necessary to confirm your identity before acting. No fee is charged unless a request is manifestly unfounded or excessive.

• Access: to be told whether the firm holds personal data about you and to receive a copy of it.
• Rectification: to have inaccurate personal data corrected and incomplete data completed.
• Erasure: to have personal data deleted where there is no lawful basis for keeping it.
• Restriction: to have processing limited while a dispute about accuracy or lawfulness is resolved.
• Objection: to object to processing based on legitimate interests, and to object to direct marketing at any time.
• Portability: to receive personal data you provided in a structured, commonly used, machine-readable format, where processing is based on consent or on a contract and is carried out by automated means.
• Withdrawal of consent: to withdraw consent at any time where processing is based on it, without affecting processing already carried out.
• Complaint: to lodge a complaint with a supervisory authority.

If you consider that the firm has handled your personal data unlawfully, you can complain to the Information Commissioner's Office, the United Kingdom supervisory authority, at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or through ico.org.uk.

If you are located in the European Economic Area, you may instead complain to the supervisory authority of the country where you live or work, or where the alleged infringement took place.

The firm would prefer the chance to resolve the matter first, but raising it with the firm is not a precondition to complaining.

This policy is updated when the firm's processing changes, when the website changes technically, or when the law requires. The version published on the site is the version in force, and the date shown at the top of this page governs.

The site has no mailing list and the firm holds no visitor contact details, so changes are not notified individually. Material changes are published here before the practice they describe begins.