1. Who we are
Ovirtis (“Ovirtis”, “we”, “us” or “our”) operates this website and provides technology consultancy services. For the purposes of UK data protection law, Ovirtis is the controller of personal information described in this policy.
Privacy requests: privacy@ovirtis.com. General business contact and opt-out of introductions:hello@ovirtis.com.
Registered company details will be added here when the legal entity is confirmed. Until then, contact us using the addresses above.
2. What this policy covers
This policy explains how we handle personal information when you:
- use this website (including analytics, if you allow it);
- send an enquiry through the contact form or email;
- receive a business introduction email from Ovirtis about our services.
It does not cover third-party websites linked from our site. Their own privacy notices apply.
3. Information we collect
Website enquiries
When you send an enquiry, we collect the information you choose to provide, such as your name, work email address, organisation and message. We also process limited technical signals needed to protect the form, such as IP address, browser metadata used by the security check, and submission timing. We do not ask for special category (sensitive) personal data through this form.
Website analytics
If you allow analytics, we receive limited technical and usage information through Vercel Web Analytics. Vercel describes Web Analytics as anonymised, cookie-free measurement designed to report visits, page views, referrers and broad device or location information.
Business introductions
Where we contact a UK business about Ovirtis services, we may process limited business contact information from public sources. That can include organisation name, website, public contact email or phone (where published for business use), Companies House information such as company number and status, location, and sector. We may also keep a short internal note of why the business appeared relevant, a copy of what we sent, send and reply dates, and any opt-out.
We prefer publicly listed role or company addresses (for example enquiries@ or office@). We do not buy consumer mailing lists. Appearing in our research tools does not mean you have opted in or subscribed to anything.
4. How we use information and our lawful bases
We use personal information only where UK GDPR gives us a lawful basis. Depending on the activity, that may be:
- Legitimate interests for running a secure website, responding to business enquiries, and sending limited, relevant B2B introductions (see section 5);
- Consent before loading Vercel Web Analytics;
- Steps prior to a contract where an enquiry asks us to take steps before working together;
- Legal obligation where we must keep or disclose information by law.
In practice we use information to:
- read and respond to enquiries;
- send a short automated confirmation that an enquiry was received;
- operate, secure and protect this website against automated abuse;
- understand aggregate website usage and performance (only if you allow analytics);
- send carefully limited business introductions and, where appropriate, one follow-up;
- honour opt-outs and maintain a suppression list so we do not contact you again;
- comply with applicable legal obligations.
The website confirmation email is transactional only. Submitting the contact form does not add you to a marketing list or newsletter.
5. Business introductions (B2B email)
Ovirtis may send a short, tailored introduction email to a UK business where public information suggests our technology consultancy may be relevant. These messages are one-to-one business introductions. They are not a newsletter, not a subscribed mailing list, and not “soft opt-in” marketing based on a prior purchase.
Safeguards we apply include:
- human review and approval before send (no unattended bulk sending);
- low daily volume caps to keep contact proportionate;
- messages that identify Ovirtis and link to this privacy policy;
- a clear way to object in every message (reply STOP, or email hello@ovirtis.com);
- immediate suppression when you object, unsubscribe, or ask not to be contacted;
- at most one follow-up if there is no reply, and no chase after you object.
Lawful basis: legitimate interests under UK GDPR Article 6(1)(f), balanced against your rights and expectations as a business contact. Electronic mail marketing rules under PECR also apply. We design outreach for corporate and role inboxes used for business contact. If you believe we have contacted a personal email wrongly, tell us and we will suppress it.
You can object at any time. Objecting does not affect any separate enquiry you choose to send us later.
6. Service providers and international transfers
We use Vercel to host this website and provide Web Analytics. We useResend to transmit contact enquiries to the Ovirtis inbox and to send the automated confirmation email to the address you provide. We use Cloudflare Turnstile to help prevent automated abuse of the enquiry form. Enquiry content and confirmation delivery may therefore be processed by Resend, and limited technical signals may be processed by Cloudflare as part of the security check. API keys remain server-side and are never sent to the browser.
Business introduction emails are sent from Ovirtis mail addresses such as hello@ovirtis.com. Delivery may involve our email hosting or transactional email providers under their terms. Internal tools used to research and prepare introductions may store the business contact information described in section 3 on infrastructure we control or on vetted processors (for example hosted database or file storage). Those systems are not public.
Providers may process information outside the United Kingdom or European Economic Area. Where international data-transfer rules apply, we expect the relevant provider arrangements to use an applicable adequacy mechanism or contractual safeguards. Provider terms and processing locations can change, so they should be reviewed as part of production account configuration.
7. Cookies and analytics
We set one essential first-party cookie named ovirtis_privacy to remember whether you selected analytics or essential-only use. It contains only that choice, expires after 180 days and is not used to identify you.
Vercel Web Analytics is designed to operate without analytics cookies, but its script loads only after you choose “Allow analytics”. Choosing “Essential only” prevents it from loading. You can review or change your choice at any time through “Cookie settings” in the footer. We do not use advertising cookies or sell personal information.
If we add a different analytics, advertising or cookie-based service, this policy and the consent controls will be updated before it is enabled.
8. Retention
We keep enquiry information only for as long as reasonably necessary to respond, manage the relationship and meet legal or accounting requirements. Retention depends on the nature of the enquiry, whether a working relationship develops and any applicable record-keeping duties. Automated confirmation emails are not used for ongoing marketing retention. Analytics retention is governed by the selected Vercel plan and account settings.
For business introduction records, we typically keep prospect and send history for up to 24 months, unless a longer period is needed for a live discussion, legal claim or accounting duty. Suppression and opt-out records are kept for longer (including indefinitely) so we can honour your request not to be contacted again.
9. Your rights
Under UK GDPR you may have rights to request access to, correction of, deletion of or restriction of your personal information, to object to certain processing (including processing based on legitimate interests and direct marketing), and to receive information you provided in a portable format where that right applies.
To make a privacy request, email privacy@ovirtis.com. To stop business introduction emails, reply STOP to the message or emailhello@ovirtis.com.
You also have the right to complain to theInformation Commissioner’s Office.
10. Security
Contact submissions are sent to a server-side endpoint over HTTPS. Before any enquiry email is sent we apply input validation and sanitisation, origin checks, a honeypot field, timing checks, per-IP and per-email rate limiting, and a Cloudflare Turnstile challenge verified on the server. No API key is exposed in page code. Business introduction tools are private operator systems with access controls. No online system is risk-free, so do not send passwords, payment card details or other sensitive information through the website form.
11. Children
Our website and services are aimed at businesses and professionals. We do not knowingly seek personal information from children.
12. Changes
We may update this policy when the website, services or legal requirements change. The date at the top shows when this version was last updated. Material changes to how we contact businesses will be reflected here before those changes go live at scale.
13. Important note
This notice describes our intended practices for the Ovirtis website and limited B2B introductions. It is not a substitute for formal legal advice. Practices and entity details should be kept aligned with this page as the business grows.