How we handle your personal information
Last updated 18 October 2026
This privacy notice tells you what to expect us to do with your personal information: when you visit this website, when you contact us, when your organisation works with us, and when you use the Vela customer portal.
The short version
- This website sets no cookies, runs no analytics or tracking, and loads nothing from other companies’ servers.
- We use the personal information we need to work with our clients, run the Vela customer portal and reply to you, and nothing else. We don’t sell it, and we don’t use it for marketing.
- The Vela software that our customers run on their own servers keeps its findings and directory data on those servers. We have no access to it, and it isn’t covered by this notice.
Who we are and how to contact us
IJH Labs Ltd is the controller of the personal information described in this notice.
- Company
- IJH Labs Ltd, registered in England and Wales
- hello@ijhlabs.com
Visiting this website
This website is hosted by a cloud hosting provider. Like any web server, it processes your IP address and the details of each request in order to deliver pages and protect the service from abuse. We don’t receive or keep logs of individual visitors ourselves, and we don’t build profiles of visitors. Our lawful basis is our legitimate interest in running a secure website.
Our LinkedIn links take you to LinkedIn, which handles your information under its own privacy policy.
What information we collect, use, and why
To provide and improve our products and services for clients: names and contact details, job titles, details of the products and services your organisation buys from us and payments for them, records of meetings and decisions, and account access information.
To run customer accounts on the Vela customer portal: names and contact details, your organisation’s purchase and licence history, account and registration details (such as your email address and when your account was created and last used), and information used for security (your password, stored only as a one-way hash, and your second sign-in factor).
To keep our services and our customers’ accounts secure: sign-in records: the account, the date and time, the type of sign-in activity, and the IP address used.
To deal with queries, complaints or claims: names and contact details, correspondence, and the records of your organisation’s account with us.
To comply with legal requirements: names, contact information, client account information, and any other personal information the law requires us to keep, such as financial records.
We don’t collect any special category information, such as health information, and we don’t knowingly collect information about children.
Lawful bases
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information.
- Providing our products and services, and running customer accounts: contract, where you are our client; and legitimate interests, where you are a contact or user named by the organisation you work for. Our legitimate interests are working with the people our client organisations name as their contacts and users so we can deliver the assessments and software those organisations have asked for, and running portal accounts for the staff our customers invite so they can access their organisation’s licences, software downloads and support.
- Keeping our services secure: legitimate interests, namely protecting our services and our customers’ accounts from unauthorised access and misuse.
- Queries, complaints or claims: contract, where they relate to work we do for you; otherwise legitimate interests, namely replying to people who contact us and handling queries, complaints and claims properly.
- Legal requirements: legal obligation.
For more information on our use of legitimate interests, contact us using the details above.
Your data protection rights
Depending on the lawful basis we rely on, you have the right to:
- access your information: ask us for copies of your personal information, and where we got it and who we share it with;
- rectification: ask us to correct information you think is inaccurate or incomplete;
- erasure: ask us to delete your personal information;
- restriction: ask us to limit how we use your personal information;
- object to our use of your personal information;
- data portability: ask us to transfer the information you gave us to another organisation, or to you.
Where we rely on contract, every right may apply except the right to object. Where we rely on legitimate interests, every right may apply except portability. Where we rely on legal obligation, the rights to erasure, to object and to portability don’t apply. Some exemptions may also apply. You can read more about your rights on the ICO’s website.
To make a request, email hello@ijhlabs.com. We must respond without undue delay, and in any event within one month.
Where we get personal information from
- Directly from you.
- From the organisation you work for, when it names you as its contact with us or asks us to invite you to our customer portal.
How long we keep information
- Vela customer portal accounts: while your organisation is our customer. Your organisation’s account, including every portal user, is permanently deleted 30 days after it stops being a customer.
- Sign-in sessions: they expire after at most eight hours, and their records are deleted about a day later.
- Security log, including IP addresses: two years, then deleted. When your organisation’s account is deleted, the IP addresses and details in its log entries are removed straight away.
- Backups: our backups are encrypted, and deleted information can remain in them for up to about 50 days.
- Client and engagement records: for as long as we work with your organisation, and then for six years, the period in which legal claims can be made.
- Financial records: six years, as UK tax law requires.
- Enquiries and correspondence: for as long as the conversation and any resulting work need them, and deleted within two years of our last contact unless they become part of a client record.
Who we share information with
We use trusted service providers (data processors), which handle personal information on our behalf, only on our instructions and under written contracts:
- Hosting providers, which host this website, our customer portal and cloud service, our encrypted backups and our software downloads.
- Email providers, which handle the messages you send us and our replies, and deliver the invitation emails for our customer portal.
We may also share personal information with our insurers and insurance brokers, our professional and legal advisers, and organisations we’re legally obliged to share it with.
Sharing information outside the UK
Some of our hosting and email providers process personal information in the European Economic Area and the United States. Where personal information is transferred outside the UK, an appropriate safeguard under UK data protection law is always in place:
- for the European Economic Area, the UK’s adequacy regulations;
- for the United States, the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge), or standard contractual clauses with the UK Addendum.
For more information, or for a copy of a safeguard, contact us using the details above.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us by emailing hello@ijhlabs.com.
If you remain unhappy with how we’ve used your information after raising a complaint with us, you can also complain to the Information Commissioner’s Office:
- Address
- ICO, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL
- Helpline
- 0303 123 1113
- Website
- ico.org.uk/make-a-complaint
Changes to this notice
We review this notice at least once a year. If we change how we handle personal information, we will update this page and the date at the top.