Trust Centre
Data Privacy
Last updated May 2026 · v2.0 · Changelog
This section summarises Vixio's privacy commitments. The full Privacy Policy (v2.0, May 2026) governs in the event of conflict and is incorporated by reference into the Terms and Conditions.
A3.1 Data Controller
Compliance Online Limited is the data controller of personal data collected from users in connection with the Services under UK GDPR and the Data Protection Act 2018. Data protection contact: dataprotection@vixio.com.
A3.2 Categories of Personal Data
| Category | Examples |
|---|---|
| Identity | First name, last name, job title |
| Contact | Work email, telephone, address |
| Financial | Payment details (processed via third-party payment provider) |
| Technical | IP address, browser, login data, session identifiers, cookies |
| Usage | Pages visited, searches, VIQ prompts, feature interactions |
| Document content | Content of documents uploaded to the Workspace Document Library |
| AI interaction data | Prompts submitted to VIQ and SCANS, and associated metadata |
| Communications | Support ticket content, email correspondence |
| Marketing | Communication preferences |
A3.3 Legal Bases for Processing
| Legal basis | Applies to |
|---|---|
| Consent (Art. 6(1)(a) UK GDPR) | Marketing communications |
| Contract performance (Art. 6(1)(b)) | Service delivery, account management, AI features, Workspace |
| Legal obligation (Art. 6(1)(c)) | Tax, regulatory compliance |
| Legitimate interests (Art. 6(1)(f)) | Security, analytics, fraud prevention, service improvement |
A3.4 Retention
Personal data is retained only as long as necessary for the purposes for which it was collected. Key retention periods:
| Account and identity data | Duration of subscription plus 7 years |
|---|---|
| Financial and transaction data | 7 years |
| Usage and technical data | Up to 24 months |
| VIQ and AI interaction data (prompts) | Up to 24 months (logged as usage data), then deleted |
| Workspace Document Library content | Duration of subscription, deleted within 30 days of termination |
| Aggregated and anonymised data | Retained indefinitely (does not identify individuals) |
Full retention schedule in the Privacy Policy.
A3.5 Data Subject Rights
Data subjects have the following rights. Requests to dataprotection@vixio.com. Complaints to the ICO at ico.org.uk/concerns.
Access
Obtain a copy of personal data held about you.
Erasure
Request deletion of personal data, subject to applicable exceptions.
Portability
Receive personal data in a structured, machine-readable format.
Rectification
Correct inaccurate or incomplete personal data.
Restriction
Restrict processing in defined circumstances.
Objection
Object to processing based on legitimate interests or for direct marketing.
Automated decision-making
Rights relating to solely automated decisions producing legal effects.
A3.6 International Transfers
Transfers outside the UK are made only subject to appropriate safeguards: Standard Contractual Clauses (EU SCCs) with UK Addendum, or UK International Data Transfer Agreements. The applicable mechanism for each sub-processor is set out in Part C.
See the full Privacy Policy for complete detail.