Privacy Policy

Controller and contact

DIGITAL TECHNOLOGIA LIMITED, trading as Vohhu, is the controller for the processing described here. Company number 14186892; registered office: 27 Watling Court, High Street, Borehamwood, Hertfordshire, WD6 3ET, United Kingdom.

Contact privacy@vohhu.com for privacy rights and data-protection or security enquiries.

Information we use

• Account, identity, authentication, email, security and session information.
• Orders, payment and refund status, Jobs, requirements, delivery, support and complaint information.
• Messages, responses, notifications, files, deliverables and secure credentials you choose to provide.
• Live-chat messages, contact details you submit in the offline form, and technical session information needed to keep each visitor conversation separate.
• For business prospecting: your name, business role and employer; professional contact details; the organisation's website, legal form and public business information; the material source of the contact data; relevance or opportunity evidence; lawful-basis and eligibility assessments; campaign messages, replies, bounces, objections and suppression status.
• Purchase-access, consent evidence, audit, device, request, fraud-prevention and operational records.

Stripe handles card details. Vohhu keeps the bounded payment and refund records needed to reconcile and support an order, but does not ask you to put card information into messages.

Business prospecting and data sources

For a limited UK business-to-business campaign, Vohhu may obtain professional contact and organisation information directly from you or your organisation; from an organisation's website, Companies House or other public records; from reputable business directories; or from a business-discovery provider. Vohhu records the material source used. Public availability does not remove our data-protection obligations or make a contact automatically eligible.

Where we obtain personal information from another source, we will provide the information required by UK GDPR Article 14 within one month and, where we contact you sooner, no later than the first communication. This includes our identity, the categories and source of the data, why the person was selected, the lawful basis, a link to this policy and a simple way to object.

Automated campaign eligibility is intended to admit only evidenced UK corporate subscribers, such as limited companies and LLPs, where the recipient's business relevance is also recorded. Sole traders, ordinary partnerships and uncertain legal forms remain blocked unless the required PECR permission is evidenced. Discovery alone is never treated as approval to contact a person.

Purposes and lawful bases

• Contract: to take payment, create and fulfil orders, collect requirements, provide Jobs and deliver work.
• Legal obligation: to meet applicable tax, accounting, consumer, data-protection and law-enforcement duties.
• Legitimate interests: to secure the service, prevent fraud and misuse, provide support, keep proportionate audit evidence, operate and improve reliable workflows, and send relevant, personalised offers to evidenced UK corporate subscribers after a documented purpose, necessity and balancing assessment.
• Legal obligation and legitimate interests: to record and enforce objections, unsubscribes and global suppression across campaigns.
• Consent: only where we specifically ask for it, such as separate permission for a public case study. You may withdraw consent for future use.

We do not rely on legitimate interests where the person's rights and interests override ours, and we use consent where PECR requires it. Missing or inconsistent compliance evidence fails closed for manual review. The tools used to prepare campaigns do not make decisions producing legal or similarly significant effects about individuals, and the first controlled send remains subject to human approval.

Where information is needed to create or perform an order, failing to provide it may prevent us from accepting, starting or completing the service.

Providers and recipients

Supabase provides authentication, database and private file-storage services; Stripe provides payment processing; Resend provides transactional email; and Vercel hosts and delivers the application. Each receives only the information needed for its role.

For business prospecting and campaign operations, Apify Cloud provides business discovery and Baserow Cloud stores CRM, campaign and suppression records. Vohhu's n8n automation and Stalwart mail services are self-hosted on infrastructure supplied by Contabo. OpenAI may be used only for schema-constrained interpretation where public business observations remain genuinely ambiguous. Prospecting remains disabled where a required processor, location, subprocessor or UK transfer safeguard has not been recorded.

Customer file bytes are intended to be streamed through an authenticated Vohhu scanner gateway to a dedicated self-hosted ClamAV service before acceptance. The scanner is designed not to retain file bytes or filenames. Production uploads remain blocked until the scanner, signature updates, operating controls and actual hosting location have completed controlled acceptance.

Website support chat is provided from Vohhu's dedicated self-hosted Live Helper Chat service. It is used for conversations with authorised human operators; Vohhu does not use it as an AI chatbot or ask visitors to submit payment-card details through chat.

We may also disclose information where required by law, to professional advisers under appropriate duties, or as needed to protect legal rights.

International transfers

Some providers may process information outside the United Kingdom. Vohhu verifies relevant processing locations and uses an applicable UK transfer mechanism and contractual safeguards where required. The self-hosted scanner VPS address is registered to a German provider allocation, but that does not by itself verify the server's physical processing location; processing that depends on an unverified location or safeguard remains disabled. The same control applies to providers used for business prospecting.

Security, files and credentials

Secure credentials are encrypted and separated from ordinary messages. Authorised Vohhu administrators may access them only where needed to fulfil the Job. Customer files are private, scanned before acceptance, and subject to malware quarantine and controlled download paths. No system is completely secure, so do not send credentials through ordinary messages.

Retention

• Secure credentials: 30 days.
• Credential-access audit evidence: 24 months after the latest terminal, scrub or access event.
• Infected or failed customer files: 7 days.
• Clean non-deliverable files: 90 days after the Job reaches a terminal state.
• Clean deliverable files: up to 12 calendar months after authoritative Job completion.
• Selected terminal messages, free-text requirement responses and internal notes: 12 months.
• Processed webhook records: 90 days.
• Website live-chat and offline-message records: up to 90 days; encrypted chat backups: up to 30 days.
• Discovered but uncontacted prospect records: 90 days, unless the data is refreshed and eligibility is reassessed.
• Contacted prospect and campaign evidence: 24 months after the last interaction, unless an earlier deletion request applies or a longer period is needed for a dispute or legal duty.
• Suppression records: the minimum identifying data for as long as needed to honour the objection and prevent re-enrolment, normally without automatic expiry.

The customer-service retention rules are implemented, hold-aware and retryable. Orders, Order Items, Payment Records, Refunds and necessary financial or audit evidence are preserved for periods required by applicable tax, accounting and legal obligations. The detailed operational schedule for financial records is maintained separately.

Your rights and complaints

Subject to applicable law, you may ask to access, correct, erase, restrict or receive certain personal information, and may object to processing based on legitimate interests. You have an absolute right to object to direct marketing at any time. A direct-marketing objection or unsubscribe is applied immediately across campaigns, pending follow-ups are cancelled, and the minimum identifying data is retained on a global suppression list so the person is not re-added through another campaign or source. Where processing relies on consent, you may withdraw it for future processing. Contact privacy@vohhu.com.

Account erasure and privacy requests use controlled operator workflows. We may preserve records needed for an active service, legal claim, security investigation, fraud prevention, retention hold, or tax, accounting and other legal duties.

You may complain to the Information Commissioner's Office. DIGITAL TECHNOLOGIA LIMITED is completing the official data-protection fee self-assessment and will register and pay if required.

Cookies and updates

We currently use essential authentication, security and service-operation technologies. See our Cookie & Essential Technologies Policy. Material changes require a new policy version and, where appropriate, notice or consent.