Legal

Privacy notice

How Just DSARS (a trading name of VulaPri Limited) processes personal data collected through this website, in line with the UK GDPR and the Data Protection Act 2018.

Last updated: 14 September 2026 · Version 1.2

1. Who we are

VulaPri Limited, trading as Just DSARS, is the controller for the personal data we collect through this website.

  • Registered in England & Wales
  • Company number: 16827529
  • ICO registration number: ZC080376
  • VAT number: 515508209
  • Registered office: 86-90 Paul Street, London, EC2A 4NE
  • Contact: privacy@justdsars.com

References to "Just DSARS", "we", "us", and "our" in this notice mean VulaPri Limited trading as Just DSARS.

2. What personal data we collect

We collect personal data from you only when you choose to provide it, and the website collects limited technical data automatically. Specifically:

  • Information you provide through the contact form — your name, work email, organisation, role (optional), the nature of your enquiry, and any free-text detail you choose to share.
  • Information you provide by email — if you write to us directly, we receive whatever content and metadata your email contains.
  • Business contact details of people we approach — where we contact you proactively about our services in your professional role, we will have obtained your name, job title, organisation and work contact details from a public professional source: typically your organisation's website, a published privacy notice or DPO contact page, a professional networking site such as LinkedIn, or an introduction from a mutual contact. Our first message tells you which.
  • Technical data collected automatically — IP address (truncated for analytics where used), browser type, device type, referrer, and pages visited. See our cookies notice for detail on cookies and similar technologies.

3. Why we process your personal data and our lawful basis

We process your personal data for the following purposes:

  • To respond to enquiries and explore engagement — lawful basis: UK GDPR Art. 6(1)(b) (taking steps at your request prior to entering into a contract).
  • To send service-related communications during a live engagement — lawful basis: UK GDPR Art. 6(1)(b) (performance of a contract).
  • To contact business decision-makers about our services (business-to-business direct marketing) — lawful basis: UK GDPR Art. 6(1)(f) (our legitimate interest in telling organisations that receive subject access requests about a service designed for them; Recital 47 recognises direct marketing as a legitimate interest). We have recorded a legitimate-interests assessment. We contact people only at their organisation's work address, in their professional role; we do not send marketing to personal addresses, and we send marketing e-mail to sole traders or partnerships only with consent, as the Privacy and Electronic Communications Regulations 2003 (regulation 22) require. This notice is provided at or before our first message (Art. 14). You have an unconditional right to object to direct marketing (Art. 21(2)): reply to any message, or email hello@justdsars.com, and we will stop and add you to our suppression list.
  • To run the website securely and understand how it's used — lawful basis: UK GDPR Art. 6(1)(f) (legitimate interests in maintaining and improving our website). We balance this interest against your rights; you can object at any time.
  • To set optional cookies (analytics) — lawful basis: your consent under regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR). You can withdraw consent at any time via the cookie preferences link in the footer.
  • To comply with legal and regulatory obligations — for example, record-keeping requirements — lawful basis: UK GDPR Art. 6(1)(c) (legal obligation).

4. Who we share your personal data with

We share personal data only where necessary, and under appropriate contractual safeguards. Recipients may include:

  • Our cloud and hosting providers — for example, Netlify, Inc. (website hosting and form processing) and Microsoft Corporation (email and document storage via Microsoft 365), each acting as our processor.
  • Our CRM provider — HubSpot, Inc., acting as our processor, where we use it to manage business communications.
  • Group entities — JUST DSARS SA (Pty) Ltd (South Africa, Enterprise No. 2026/376670/07), our operations company, which supports case delivery and enquiry handling as our processor under a written intra-group data processing and transfer agreement. Enquiries about VulaPri's wider advisory services are handled within VulaPri Limited.
  • Professional advisers — legal, insurance, and accounting advisers, under duties of confidence.
  • Regulators, courts, and law enforcement — where required by law.

We do not sell your personal data and we do not share it for third-party marketing.

5. International transfers

Some of our processors are based outside the UK, including our group operations company JUST DSARS SA (Pty) Ltd in South Africa. Where personal data is transferred outside the UK, we rely on either an adequacy decision (for example, the UK's adequacy regulations for the EEA) or an appropriate safeguard such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, in line with UK GDPR Art. 46.

6. How long we keep your personal data

  • Enquiry data where no engagement results — up to 12 months, then deleted, unless we are required to retain it longer.
  • Business contact details of people we have approached — 12 months from our last contact, then deleted, unless you have engaged with us. If you object, we keep only the minimum needed (name and address) on a suppression list so that we do not contact you again.
  • Client engagement records — for the duration of the engagement and for 6 years after its end, to meet legal and limitation-period requirements.
  • Records required by HMRC and Companies House — for the periods set by statute (typically 6 years).
  • Website analytics — as detailed in our cookies notice.

7. Your rights

Under UK GDPR you have the following rights, exercisable free of charge in most cases:

  • Access (Art. 15) — to obtain a copy of your personal data.
  • Rectification (Art. 16) — to correct inaccurate data.
  • Erasure (Art. 17) — to ask us to delete your data, subject to legal limits.
  • Restriction (Art. 18) — to limit processing in specified circumstances.
  • Portability (Art. 20) — to receive your data in a structured, machine-readable format.
  • Object (Art. 21) — to stop processing carried out under legitimate interests.
  • Withdraw consent (Art. 7(3)) — where processing is based on consent, with no effect on prior lawful processing.
  • Not to be subject to solely automated decisions (Art. 22). We do not make any decisions about you using solely automated processing.

To exercise any of these rights, write to us at privacy@justdsars.com. We will respond within one month (UK GDPR Art. 12(3)), extendable in limited circumstances.

8. Complaints

If you are not satisfied with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO).

  • ICO website: ico.org.uk/make-a-complaint
  • Helpline: 0303 123 1113
  • Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We'd appreciate the chance to address your concern first — please contact us before complaining to the ICO if you can.

9. Cookies

See our separate cookies notice for the cookies and similar technologies this website uses, and how to control them.

10. Changes to this notice

We may update this notice from time to time. The version and date at the top of this page show when it was last revised. Material changes will be flagged on the site before they take effect.

11. Contact

Questions about this notice or our processing? Write to us at privacy@justdsars.com, or by post to VulaPri Limited (Just DSARS), 86-90 Paul Street, London, EC2A 4NE.

Back to home