VALETLY CONTROL PRIVACY NOTICE

Valetly Control is operated by De Jongh Digital Consulting Ltd, trading as Valetly.

• Company: De Jongh Digital Consulting Ltd, trading as Valetly
• Registered in England & Wales | Company No. 17119496
• Registered office: The Stable Yard, 25-33 Vicarage Road, Stony Stratford, Milton Keynes, Buckinghamshire, MK11 1BN
• ICO registration: ZC134815
• Email: privacy@valetly.org or info@valetly.org
• Website: www.valetly.org

This notice covers how we, as Valetly, handle personal data of operator business contacts when they sign up to and use Valetly Control. De Jongh Digital Consulting Ltd is the controller for this data.

We are also a processor on behalf of each operator for the personal data the operator stores in their tenant — their employees' login records, their walk-in customer records, and the copy of marketplace bookings transferred to them at the moment of booking. For that processor-side processing, the operator is the controller and is responsible for publishing their own privacy notice (we provide a template). Valetly's role in handling that data is set out in theData Processing Agreement that forms part of the operator's terms with us, not in this notice.

• Account and contact data, including name, work email, phone, authentication and login records, to create, administer and secure the account.
• Business and location data, including legal or trading name, addresses, tenant identifiers, configuration and account roles, to provide the service and enforce access and plan limits.
• Free or Pro plan state, quantity, invoices and Stripe references, to administer billing. Stripe handles full payment credentials; Valetly does not store them.
• Support correspondence and technical data such as IP address, device/browser information, audit records, and redacted error data, to support, secure and improve the service.

We rely on contract performance where you contract with us personally (for example as a sole trader), and otherwise on our legitimate interests in providing and securing a business service. We rely on legal obligation for tax, accounting and regulatory records. Required sign-up information is needed to create and secure the account; without it we cannot provide the service. We do not use this data for solely automated decisions that produce legal or similarly significant effects.

Render (API hosting), Supabase (database infrastructure), Vercel (web hosting), Sentry (monitoring where enabled), Resend (transactional email), Mapbox (address geocoding), Microsoft 365 (support and business communications), and Stripe (Pro billing). Provider roles vary; Stripe and some recipients may be independent controllers for their own legal, regulatory or payment purposes. Our current product processor register includes role and transfer notes. We may also share with professional advisers, courts, regulators and authorities where necessary and lawful.

Some providers may process data outside the UK. Where UK adequacy regulations do not apply, we use an appropriate transfer mechanism such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any required risk assessment.

• Service messages (subscription receipts, payment-failure alerts, password resets, security alerts, change-of-terms notices, invoice notifications): always sent.
• Valetly does not currently run operator marketing campaigns or provide an in-product operator marketing-preferences page. Before introducing direct marketing we will establish the required lawful basis and opt-out process. We will not send SMS marketing without the consent required by law. You can object to direct marketing at any time by emailing privacy@valetly.org.

• Account, contract and billing records: while the account is open and afterwards only as needed for tax, accounting, fraud prevention, disputes and legal claims. Core contract and accounting records may be kept for up to six years.
• Support and security records: for shorter periods where possible, based on their sensitivity and operational need.

Moving from Pro to Free does not close the account. Extra locations may be plan-suspended and retained so they can be restored after a later Pro upgrade; the product explains this before cancellation.

Depending on the circumstances, you may request access, correction, deletion, restriction, objection or portability, and withdraw consent where consent is our basis. You may object to direct marketing at any time. Contact privacy@valetly.org. We normally respond within one month, subject to lawful extensions and exemptions. Rights in respect of data inside the operator's tenant (employees, walk-ins, marketplace booking copies) are exercisable against the operator as controller — Valetly will route any such request to the operator.

You can complain electronically at privacy@valetly.org. We will acknowledge a qualifying data-protection complaint within 30 days, investigate it without undue delay, and tell you the outcome or keep you informed of progress. You may also complain to the ICO: www.ico.org.uk, 0303 123 1113.

Valetly Control is not intended for use by under-18s.