Privacy Policy

1. Introduction

Virtus Nemeton Ltd ("we", "us", "our") is a company registered in England and Wales (Company No. 17181232) and is registered with the Information Commissioner's Office under registration number ZC161313. We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our websites and services, including:

• virtusnemeton.co.uk — our main company website and platform
• virtusnemeton.store — our Sentinel equipment maintenance intelligence platform
• apexindex.co.uk — our business diagnostic and intelligence service

2. Data We Collect

Information you provide directly

• Name, email address, and contact details submitted via forms or enquiries
• Account credentials and profile information when you register
• Business information (company name, industry, site details) submitted for services
• Machine-event data, maintenance records, work orders, and operational notes uploaded to Sentinel

Information collected automatically

• Usage data: pages visited, session duration, referral source
• Device and browser information, IP address
• Cookies and similar tracking technologies (see our Cookie Policy)

Sentinel — operational data

If you use our Sentinel maintenance intelligence platform, we process operational data you supply including machine events, SAP work-order exports, contractor notes, and site observations. This data is processed to generate maintenance intelligence briefs and human-approved action recommendations. All Sentinel customer data is stored in the United Kingdom (AWS eu-west-2, London).

3. How We Use Your Data

• Providing and improving our services and platform functionality
• Processing enquiries, consultations, and support requests
• Generating maintenance intelligence reports and briefs (Sentinel)
• Sending transactional and service communications
• Complying with legal obligations and responding to regulatory requests
• Marketing our services where you have provided consent

Sentinel uses AI-assisted processing to analyse operational data and generate maintenance recommendations. All AI-generated outputs require human review and approval before any action is taken. We do not make automated decisions that have legal or similarly significant effects without human oversight.

4. Legal Basis for Processing

We process your personal data under the following UK GDPR legal bases:

• Contract: Processing necessary to perform services you have requested
• Legitimate interests: Operating our platform, website security, analytics
• Consent: Where you have given explicit consent (e.g. marketing emails)
• Legal obligation: Where required by applicable law

5. Data Storage and International Transfers

We store data in the following locations:

• Sentinel platform data: AWS eu-west-2 (London, UK) — UK jurisdiction
• ApexIndex data: AWS eu-west-3 (Paris, EU) — EU jurisdiction, adequacy decision applies
• VN Platform data: AWS eu-west-2 (London, UK) — UK jurisdiction

We do not transfer UK personal data to countries without adequate data protection. Where third-party service providers process data outside the UK/EU (for example, AI model inference), we ensure appropriate safeguards such as Standard Contractual Clauses (SCCs) are in place.

6. Data Sharing

We do not sell your personal data. We may share data with:

• Service providers: Cloud hosting (Supabase/AWS), email delivery (Resend), payment processing (Stripe), analytics
• SAP integration: Where you have connected Sentinel to SAP systems, data is exchanged according to your configuration and with your instruction
• Legal authorities: Where required by law, court order, or to protect our rights

A full list of sub-processors is available on request.

7. Data Retention

We retain personal data only for as long as necessary for the purpose it was collected or as required by law. Sentinel operational data is retained for the duration of your contract plus 12 months unless you request earlier deletion. On account termination, data is securely deleted within 30 days.

8. Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encrypted communications (TLS in transit, AES-256 at rest)
• Row-level security on all database tables
• Audit logging of all significant data access and actions
• Role-based access control
• Human approval gates on all AI-generated outputs before action

No transmission over the internet can be guaranteed absolutely secure. We cannot guarantee security of information you transmit to us, but we will notify you and the ICO if we become aware of a breach affecting your rights.

9. Your Rights Under UK GDPR

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data
• Restriction: Request we limit processing
• Portability: Receive your data in a portable format
• Object: Object to processing based on legitimate interests
• Withdraw consent: At any time where processing is consent-based

To exercise any right, contact us at team@virtusnemeton.co.uk. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk | 0303 123 1113. ICO registration reference: ZC161313.

10. Cookies

We use cookies to operate our websites and, where you consent, to analyse usage. See our Cookie Policy for full details.

11. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. We will update the "Last updated" date and notify you of material changes via email or prominent notice on our website.

12. Contact Us