Privacy Policy

1. Who we are

Vibly Happy Bundle Publishing Ltd. (“we”, “us”, the “publisher”) is a company registered in England and Wales under company number 14827365, with its registered office at 27 Ludgate Broadway, Third Floor, London EC4V 6DU, United Kingdom. We are the data controller for personal data processed through viblyhappybundle.homes. Our data protection officer can be reached at [email protected] or by post at the registered office, marked for the attention of the DPO.

2. What we collect

We deliberately collect as little as we can. In practice this means three categories of data.

Information you give us. If you submit the contact form, we process the name, email address, organisation (if provided), enquiry category and message body you supply. If you subscribe to the Field Notes dispatch, we process your email address and, optionally, your job role and organisation size.

Information collected automatically. Our hosting provider records standard server logs containing a truncated IP address, user agent string, requested URL, referrer and timestamp. These logs exist for security and abuse prevention. Where you have consented to analytics, we record aggregate page views, referral source, device class and read depth.

Consent records. Your cookie choice is stored in your browser’s localStorage under the key vhb_cookie_consent, together with the timestamp and version of the notice you responded to. This record is not transmitted to our servers.

We do not collect special category data, we do not build behavioural advertising profiles, we do not sell or share personal data with data brokers, and we do not operate third-party advertising tags of any kind.

3. Legal bases for processing

Under the UK GDPR and EU GDPR we rely on: consent (Article 6(1)(a)) for analytics and functional cookies and for marketing email; contract (Article 6(1)(b)) to deliver a paid subscription you have purchased; and legitimate interests (Article 6(1)(f)) for security logging, fraud prevention and responding to enquiries you initiate. Where we rely on legitimate interests we have completed and documented a balancing assessment, available on request.

4. Third-party processors

We use a small number of sub-processors, each bound by a written data processing agreement and, where transfers leave the UK or EEA, by Standard Contractual Clauses together with a transfer risk assessment. At the date of this version they are: a European static site host (log retention 14 days); a transactional and newsletter email provider (subscriber email addresses and delivery events); a privacy-focused, cookieless analytics provider used only with consent; and a European cloud backup provider holding encrypted archives of editorial systems. A current, named list is provided on written request to the DPO. We publish material changes to this list at least 30 days before they take effect.

5. Cookies and similar technologies

Full detail, including a table of every cookie and storage key we set, is in our Cookie Policy. In summary: strictly necessary storage is always active and requires no consent; analytics and functional cookies are set only after you accept them, and can be withdrawn at any time by clearing site data or using the preferences control in the cookie notice.

6. Retention

Contact form submissions are retained for 24 months from the date of last correspondence, then deleted. Newsletter subscriber records are retained until you unsubscribe, plus a 12-month suppression record so we do not re-add you in error. Server logs are retained for 14 days. Aggregate analytics contain no personal data and are retained for 26 months. Billing and accounting records for paid subscriptions are retained for six years as required by UK tax law.

7. Your rights

If you are in the UK or EEA you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. If you are a California resident, the CCPA and CPRA give you the right to know what personal information is collected and how it is used, to request deletion, to correct inaccurate information, and to opt out of sale or sharing — we do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising any right.

To exercise any right, email [email protected]. We respond within 30 days and may ask for enough information to verify your identity. If you are unhappy with our response you may complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority in the EEA.

8. Security and changes

We enforce TLS on all connections, encrypt data at rest, restrict administrative access to named individuals with multi-factor authentication, and review access quarterly. No system is perfectly secure; if a breach affects your rights and freedoms we will notify the relevant supervisory authority within 72 hours and inform you without undue delay where required.

We may update this policy. Material changes will be announced on this page with a revised version number and effective date at least 14 days before they take effect. Continued use of the site after that date constitutes acceptance of the revised policy.