VCODE PRIVACY POLICY
Last Updated: 12 August 2026
1. Introduction
VPASSPORT LIMITED (“VCode”, “we”, “our” or “us”) is committed to protecting your privacy and handling your personal information fairly, lawfully and transparently.
This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you use the VCode website at vcode.co.uk (the “Site”).
It covers the Site only. Products and services supplied under a separate agreement, and any application operated by another company that uses VCode technology, are covered by their own privacy notices and not by this one.
2. Data Controller
For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, the data controller is:
VPASSPORT LIMITED
Company Number: 12397121
England and Wales
Registered office: Suite 5, 5 Raleigh Walk, Brigantine Place, Cardiff CF10 4LN
Website: https://vcode.co.uk/
3. Information We Collect
This is an informational website. There is no account to create, nothing to buy, and no user profile. The information we process is limited to the following.
Enquiry Information
If you use the enquiry form, we receive:
- Your name
- Your email address
- Your organisation, if you provide one
- The enquiry type you select
- The message you write
These details are sent to us by email so that we can reply. They are not stored in this website’s database.
Please do not send confidential or specially protected information through the form. If your enquiry needs confidentiality, tell us and we will agree a route for it first.
Technical Information
Like any web server, our hosting provider records requests to the Site. Those records typically include:
- IP address
- Browser type and operating system
- Pages requested and the time of the request
- The referring page, where your browser sends one
- Security and diagnostic logs
Abuse Prevention Information
The enquiry form applies a short rate limit to stop automated submissions. To do this it stores a one-way hash of your IP address for 40 seconds and then discards it. The address itself is not kept.
Our host also provides security tooling that records events such as failed login attempts to the Site’s administration area, which may include IP addresses.
What We Do Not Collect
To be explicit, because VCode technology is used in identity products and the distinction matters:
- This Site does not collect identity documents, facial images, biometric information, liveness signals or feature prints.
- It does not verify identity, hold a document wallet, or process any transaction.
- It has no user accounts, so it holds no authentication or login history for visitors.
4. How We Collect Information
We collect information directly from you when you complete the enquiry form, and automatically from your device when it requests a page, in the ordinary operation of a web server. We do not obtain personal information about visitors from data brokers, advertising partners or other third-party sources.
5. Why We Process Your Information
We process personal information to:
- Read and reply to your enquiry
- Keep the Site available, correct and secure
- Detect, investigate and prevent misuse and automated abuse
- Comply with legal obligations
- Establish or defend legal claims
6. Lawful Bases for Processing
| What | Why | Lawful basis |
|---|---|---|
| Enquiry details | To read your enquiry and reply to it | Legitimate interests: responding to someone who has asked us to |
| Server logs | To keep the Site available, correct and secure | Legitimate interests: running and defending our own website |
| Rate limit hash | To block automated abuse of the form | Legitimate interests: preventing misuse |
| Security event records | To detect and investigate unauthorised access | Legitimate interests: protecting the Site |
Where we rely on legitimate interests, we have considered your rights and freedoms and concluded that this limited processing does not override them.
7. Cookies and Similar Technologies
This Site sets no advertising, analytics or tracking cookies. We do not use analytics products, advertising networks, social media trackers or tag managers.
Two points are worth stating plainly:
- Fonts and scripts are served from this Site. Nothing is loaded from a third-party font service, content delivery network or script host, so viewing a page does not disclose your IP address to any of those companies.
- Your light or dark theme choice stays on your device. It is kept in your browser’s local storage under the key
vcode-theme. It is never sent to us and it identifies nothing.
WordPress, which this Site runs on, sets cookies only for signed-in administrators. Ordinary visitors are not signed in and receive none.
8. Sharing Your Information
We do not sell personal information, and we do not share it for anyone else’s marketing.
Two categories of supplier necessarily handle it on our behalf, under contract and on our instructions:
- our hosting provider, which stores the Site and generates the server logs described above; and
- our email provider, which delivers and holds the enquiry messages sent to us.
We may also disclose information to professional advisers, regulators or law-enforcement agencies where disclosure is legally required, or to establish or defend legal claims.
9. International Transfers
This Site is hosted in the United Kingdom. Where information is transferred outside the United Kingdom, we implement appropriate safeguards, which may include:
- The UK International Data Transfer Agreement or UK Addendum
- Transfers to countries covered by UK adequacy regulations
- Approved contractual and organisational safeguards
10. Data Security
We use technical and organisational measures designed to protect personal information, including encryption in transit, access controls, restricted administrative access and security monitoring provided by our host.
Although we take reasonable measures to protect personal information, no online system can guarantee absolute security.
11. Data Retention
- Enquiries: kept while we are in contact with you and for up to 24 months after our last exchange, so that we can pick up the conversation and keep a record of what was discussed. Longer only where a contract or a legal obligation requires it.
- Server and security logs: kept for the limited period operated by our host, normally a matter of weeks, then overwritten.
- Rate limit hash: 40 seconds.
When information is no longer required, it is securely deleted.
12. Your Rights
Subject to applicable law, you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate information, or complete information that is partial
- Request deletion, where we have no continuing reason to keep it
- Restrict processing while a concern is resolved
- Object to processing carried out on the basis of legitimate interests
- Request portability of your information
- Complain to the Information Commissioner’s Office
Requests may be submitted through the contact form or in writing to the registered office above. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
13. Automated Decision Making
We do not carry out profiling or automated decision making on this Site. The rate limit described in Section 3 is an automated abuse control applied to submissions, not a decision about you, and it expires after 40 seconds.
14. Children’s Privacy
This Site is aimed at businesses and is not directed at children. We do not knowingly collect personal information about them. If you believe a child has sent us personal information, tell us and we will delete it.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to the Site, our processing activities or applicable law. The revised version appears on this page and the “Last Updated” date at the top identifies when it was most recently revised.
16. Contact Us
If you have questions about this Privacy Policy or how we process personal information, please contact us through the contact form, or in writing to:
VPASSPORT LIMITED
Suite 5, 5 Raleigh Walk, Brigantine Place, Cardiff CF10 4LN
17. Complaints
If you believe we have not handled your personal information correctly, please contact us using the details above so that we can investigate your concern.
You also have the right to complain to the Information Commissioner’s Office if you believe your personal information has been processed unlawfully. Information about the Information Commissioner’s Office is available at https://ico.org.uk/, or by telephone on 0303 123 1113.