Vantage Point Limited ("Vantage Point", "we", "us") is a company registered in Jersey (registration 141915, registered office Spectrum, Unit 9, Gloucester Street, St. Helier, JE2 3DE, Jersey). This policy explains how we handle personal data on this website (vantagepointgrc.com, also reached via vantagepoint.je and vantagepoint.gg), in our sales, support and marketing contact with you, and in the Vantage Point application (the "service"). It is written under the Data Protection (Jersey) Law 2018 and, where they apply to the processing, the UK GDPR and the EU GDPR. Words like "personal data", "controller" and "processor" have the meaning those laws give them.
1. The service, and the two roles we play
The service is a compliance management platform for regulated firms. A customer and its users record their obligations, risks, controls, monitoring tests and results, registers (for example breaches, complaints and suspicious activity reports), actions and reports in it, across the entities the customer runs. Some of that content names people: staff who own a control, a complainant, the subject of a register entry.
For this website, our marketing, and our contact with you as a prospect, a customer contact or a supplier, Vantage Point is the controller: we decide what is collected and why, and this policy governs it.
For the data a customer and its users put into the service, the customer is the controller and Vantage Point is its processor. We process that data only on the customer's documented instructions, under a data processing agreement, and we have no direct relationship with the people it describes. If you are an individual whose data sits in a customer's records, that customer's privacy notice governs; send your question or request to the customer, and we will help them answer it. If you write to us instead, we will pass it on.
2. The information we collect
Contact and enquiry data. Name, work email address, organisation, role, telephone number where you give it, and what you tell us in a message, a demo request or a call. Collected through the forms on this site (which run on our own Azure hosting and email us the details), by email, by phone, or in a meeting.
Account data. For customer users of the service: name, work email address, role and permissions, the entity or entities you are scoped to, and sign-in events. Where your organisation uses single sign-on, authentication happens with your identity provider and we receive the assertion it sends (typically your name, email address and a user identifier).
Customer data in the service. The content described in section 1. It may include personal data about a customer's staff, clients and third parties. We hold it as processor; the customer decides what goes in and who sees it. The service also keeps an audit trail of every change made by a signed-in user (who, what, when); the trail is part of the customer's data.
Billing data. For customers: the billing contact's name and email address, the organisation's invoicing details, and payment records. Invoices are settled by bank transfer; we do not take card payments on this website and we do not hold card details.
Navigational and log data. Server and edge logs for the website and the service (IP address, browser and device type, pages or endpoints requested, timestamps, referring address), kept for security and reliability. On this website, and only if you allow analytical cookies, aggregate usage through Google Analytics with IP addresses anonymised.
Correspondence. Emails and support conversations, notes of calls and meetings, and the transactional email the service sends (invitations, notifications, password and sign-in messages) through Azure Communication Services.
Information from other sources. To decide whether an organisation might benefit from Vantage Point, and whom to approach, we research firms and their compliance and senior contacts from public sources: the firm's own website, regulators' public registers, company registries, professional profiles and the trade press. We may hold, for a business contact, name, organisation, role, work email address and public professional history. We do not buy contact lists and we do not use data brokers. You can ask us at any time to stop and to delete what we hold; see section 10.
Children. The website and the service are for businesses and are not directed at children; we do not knowingly collect data from anyone under 16. If you believe we have, write to privacy@vantagepointgrc.com and we will delete it.
3. How we use it, and on what basis
Where we are the controller, we use personal data for the purposes below and no others. We do not sell personal data, and we do not use it for advertising.
| Purpose | Data | Lawful basis |
|---|---|---|
| To answer an enquiry and run a demo you asked for | Contact and enquiry data | Steps taken at your request before a contract; our legitimate interest in responding |
| To set up and provide the service to a customer and its users: sign-in, notifications, support | Account data, correspondence | Performance of the contract with the customer |
| To invoice and collect fees | Billing data | Performance of the contract; legal obligation (accounting records) |
| To tell customers about changes to the service: new features, planned maintenance, incidents | Account data | Performance of the contract; our legitimate interest in keeping customers informed |
| To keep the website and the service secure, investigate incidents and prevent misuse | Navigational and log data, account data | Our legitimate interest in security; legal obligation |
| To understand how the website is used and improve it | Analytical cookies | Your consent, withdrawable at any time |
| To research organisations and approach business contacts about Vantage Point | Information from other sources; contact data | Our legitimate interest in marketing business software to organisations through their staff; you can object at any time |
| To send marketing to people who have asked for it or whom we may lawfully approach | Contact data | Consent where the law requires it (for example, individual subscribers); otherwise our legitimate interest, with an unsubscribe in every message |
| To use a customer's name, logo or a quote in our marketing | Contact data, the quote | Consent, given in writing |
| To meet legal and regulatory obligations we carry as a Jersey company, and to establish or defend legal claims | Whatever the obligation or claim requires | Legal obligation; legitimate interest |
Where we are the processor, we use customer data only to provide the service to that customer as the contract and its instructions set out, and to meet the law.
4. Who we share it with
Service providers. Companies that process data for us, under written terms, only for the purpose we engage them and only to the extent needed: Microsoft Azure (hosting of the service, in each customer's own region, and of this website, including the forms on it); Azure Communication Services (transactional email, including the messages the website forms send us); Google Analytics (website analytics, only with your consent); and Microsoft 365 (our own email, documents and calendars). Each is bound to protect the data at least as well as this policy requires.
Sub-processors for the service. For customers, the current list of sub-processors (the providers that touch customer data) is provided under NDA with the data processing agreement, and changes are notified in advance so a customer can object. See sub-processors and the DPA.
Professional advisers. Our accountants, auditors, lawyers and insurers, where they need it to advise us.
Corporate events. If Vantage Point, or a business or asset of it, is reorganised, financed, merged or sold, personal data may pass to the buyer or successor. This policy continues to apply to it, and customers will be told of any change of ownership that affects how their data is handled.
Compelled disclosure. Where the law, a court or a regulator with the authority to compel it requires disclosure, or where disclosure is necessary to establish, exercise or defend a legal claim, or to protect someone's safety. Where we are the processor and the demand concerns customer data, we tell the customer before we respond unless the law prevents it.
We never sell personal data.
5. Where it is kept, and international transfers
The service and its data are hosted in the customer's own region (UK data in the UK, EU data in the EU, US data in the US) and do not leave it. Jersey holds an adequacy decision from the European Union and is recognised as adequate by the United Kingdom, so data may move between Jersey, the UK and the EU under those decisions.
Where a service provider processes personal data outside Jersey, the UK or the EU, we rely on an adequacy decision or on the standard contractual clauses (with the UK addendum where relevant), complete a transfer risk assessment, and require protection equivalent to this policy. Third-country transfers of customer data require a documented basis and the customer's approval.
6. Cookies and similar technologies
This website sets one necessary item, your cookie choice, and, only with your consent, Google Analytics cookies. It sets no advertising cookies and carries no third-party trackers or social plug-ins. The cookie policy lists every cookie, and lets you change your choice at any time.
The service sets the cookies needed to keep you signed in and to protect signed-in requests (a session cookie and a cross-site request forgery token). They are strictly necessary and are not used for analytics or advertising. Signing in with your organisation's identity provider may set cookies on that provider's own domain, under its policy.
Single sign-on. Where a customer uses SAML single sign-on (Microsoft Entra ID or another SAML identity provider), your identity provider authenticates you and sends us an assertion with your name, email address and identifier. We use it to sign you in and to keep your account current; MFA, session policy and deprovisioning follow the customer's identity provider.
7. Security
Vantage Point is ISO/IEC 27001 certified for information security management. Traffic is encrypted in transit and data at rest, with backups encrypted equivalently; the application sits behind a web application firewall; secrets are held in a managed vault; access within the service is role-based and entity-scoped, with SAML single sign-on on every tier; access to production systems is limited to named engineers, reviewed and logged, and customer data is accessed only on the customer's explicit request or for incident response. Every change is reviewed and released through a gated pipeline. The security specification sets out the detail, and the security and privacy pages carry the rest of the documentation.
If a personal data breach affects data we control, we notify the Jersey Office of the Information Commissioner (and, where they apply, the UK or EU authority) within the period the law sets, and the people affected where the law requires it. If it affects customer data we process, we notify the customer without undue delay with what we know, so the customer can meet its own obligations. Concerns and vulnerability reports go to security@vantagepointgrc.com; see vulnerability disclosure.
8. How long we keep it
| Data | Kept for |
|---|---|
| Enquiries and demo requests | While the conversation is live and up to two years after the last contact, unless you ask us to delete sooner |
| Business contacts researched from public sources | Up to two years from the last review of the record, or until you object, whichever is sooner |
| Customer account data | The life of the contract, then exported to the customer on request and deleted on the schedule set in the contract |
| Customer data in the service | The life of the contract; on termination, exported to the customer on request and deleted, including from backups as they roll off, on the schedule set in the contract |
| Billing records | The period Jersey company and tax law requires for accounting records |
| Server and edge logs | A limited security retention period, then deleted or anonymised |
| Correspondence | While relevant to the relationship or a legal obligation, then deleted |
Where we have no continuing need and no legal obligation to keep personal data, we delete it or anonymise it. Anonymised, aggregate data (for example, how many firms use a module) is not personal data and may be kept.
9. Your rights and how to use them
Under the Data Protection (Jersey) Law 2018 and, where they apply, the UK and EU GDPR, you can ask us for a copy of the personal data we hold about you; ask us to correct it or delete it; object to our use of it or ask us to restrict it; ask for it in a portable form; and withdraw any consent you gave, without affecting what was done before you withdrew it. Where we are the processor, we will pass your request to the customer who controls the data and help them answer it within the time the law allows.
Write to privacy@vantagepointgrc.com, or by post to Vantage Point Limited, Spectrum, Unit 9, Gloucester Street, St. Helier, JE2 3DE, Jersey. We may ask you to confirm your identity. We respond within one month, and tell you if we need longer and why. There is no charge unless a request is manifestly unfounded or excessive.
You can also complain to the Jersey Office of the Information Commissioner (jerseyoic.org) or, if you are in the UK or the EU, to the supervisory authority where you live or work. We would rather hear from you first.
10. Marketing, and how to stop it
Every marketing email we send carries an unsubscribe link; using it stops marketing to that address at once. You can also write to privacy@vantagepointgrc.com to opt out of marketing, to object to our researching or holding your details as a business contact, or to ask what we hold. Customers cannot opt out of transactional and service messages (invitations, security notices, incident and maintenance notices, invoices) while they use the service, because the service depends on them.
11. Representatives
Vantage Point Limited is established in Jersey. Where Article 27 of the UK GDPR or the EU GDPR requires us to appoint a representative in the United Kingdom or the European Union, the representative's details are provided on request at privacy@vantagepointgrc.com and are published here once appointed.
12. Changes and contact
When this policy changes, the revision date at the top changes with it. Material changes to how we use personal data are notified to customers by email before they take effect. Questions about this policy or about data protection at Vantage Point go to privacy@vantagepointgrc.com, or by post to Vantage Point Limited, Spectrum, Unit 9, Gloucester Street, St. Helier, JE2 3DE, Jersey. Security concerns go to security@vantagepointgrc.com.