Legal
Privacy Notice
How we collect, use, and protect your information — plain terms, not padded legalese, and complete enough to meet our legal duty to tell you.
1. Who we are
Salt & Standard is a trading name of VBG Solution Ltd, a company registered in England and Wales, company number 16412865. Our registered office is at 4 Montpelier Rise, London, NW11 9SS. For any question about this notice or your data, write to [email protected].
2. What we collect & why
We only collect what each purpose below actually needs.
| Category | Source | Purpose | Lawful basis |
|---|---|---|---|
| Booking and scheduling data | From you, via Calendly | Arranging consultations | Contract, or steps taken at your request before a contract, where you are the prospective client; otherwise our legitimate interest in arranging the consultation your organisation requested |
| Email correspondence | From you | Responding to you and delivering the service | Our legitimate interest in responding to enquiries and running our business |
| Business contact details of prospective clients — name, role, business email or phone | Public sources: Companies House, venue websites and Google, and business social profiles | Relevant, one-to-one outreach about our services | Our legitimate interest in promoting our services to hospitality businesses likely to benefit from them (one-to-one, business-to-business); PECR corporate-subscriber rules |
| Technical request data — IP address, request logs | Your browser, via our hosting provider | Serving the site securely and preventing abuse | Our legitimate interest in running a secure service (processed by Cloudflare) |
| Calendly cookie data | Calendly's embedded scheduler | Salt & Standard and Calendly are separate, independent controllers of the cookie data Calendly's embedded scheduler sets: we are responsible for choosing to include the embed on our pages, but Calendly's own notice and consent controls govern what it stores and why | Your consent, given directly to Calendly |
When we hold your business contact details because we found them from a public source rather than because you gave them to us, our first message to you links to this notice — our duty under UK GDPR Article 14 to tell you where the data came from.
3. Who processes it & where
- Cloudflare — hosting and DNS, on Cloudflare's global network, including the US. Transfers happen under Cloudflare's Data Processing Addendum, relying on the EU Standard Contractual Clauses as modified by the UK Addendum.
- Google Workspace — our business mailbox and email delivery. Processed under Google's Cloud Data Processing Addendum; international transfers via the EU-US Data Privacy Framework including its UK Extension.
- Calendly — scheduling. For the scheduling data you give it, Calendly is our processor. For the cookies its own embedded scheduler sets on your device, Salt & Standard and Calendly are separate, independent controllers: we are responsible for choosing to include the embed on our pages, and Calendly's own notice and consent controls govern those cookies. Transfers to the US happen under its Data Processing Addendum, via the UK Extension to the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses with the UK Addendum.
- HubSpot — customer relationship management, where we keep prospect and client contact records. Processing happens in the US, under HubSpot's Data Processing Agreement, via the UK Extension to the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses with the UK Addendum.
We check each provider's current Data Processing Addendum for the transfer mechanism actually in force, rather than assuming it stays fixed.
4. Cookies
Salt & Standard's own code sets no analytics cookies; the Calendly embed may use cookies under its retained consent controls.
5. Retention
- Enquiry and client correspondence — 24 months after our last contact, then deleted, unless an engagement's legal or accounting duties require longer (6 years for contract or tax records).
- Prospect contact data — 12 months from when we collected it if you don't respond, then deleted.
- Scheduling data — kept per Calendly's account retention settings, reviewed annually.
6. Your rights
Under UK GDPR you have the right to access, correct, erase, or restrict the personal data we hold about you, to receive it in a portable format, and to object to how we use it. Objection is always honoured where the data is used for direct marketing — no exceptions asked for. To exercise any of these rights, write to [email protected].
7. Complaints
If you're unhappy with how we've handled your data, tell us first — we'd rather put it right. You can also complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.
8. Last updated
This notice was last updated on 22 July 2026.