This notice explains how Veliora handles personal information when you visit veliora.works or send us an enquiry. The website is deliberately simple: it has one contact form, no user accounts and no advertising tools. It uses Google Analytics only if you accept analytics cookies.
Who we are
The website is operated by Veliora Pte. Ltd., a company incorporated in Singapore (UEN 202522063E). Veliora is the controller of the personal information described in this notice. In Singapore it is the organisation responsible under the Personal Data Protection Act 2012 (PDPA).
Data protection enquiries: contact@veliora.works. Please put “Privacy” in the subject line. This address is monitored and is the contact point for all questions and requests about this notice or your personal information.
What we collect
When you send an enquiry
The contact form asks for the following, and nothing else is required:
- Name (required).
- Work email address (required).
- Company (optional).
- What your enquiry is about (optional), chosen from a short list, for example a custom project or a product licence.
- Your message describing the problem or project (required). Please do not include passwords, special category data or other sensitive information.
The form also contains a hidden field that people do not normally see or complete. It is used only to filter out automated spam.
Technical information
To prevent abuse, the form handler records a one-way hashed value derived from your IP address and the time of your last submission. This limits each connection to one enquiry per minute. The hash is not linked to your name or message.
Like most websites, our hosting provider's servers automatically record standard technical information when pages are requested, such as IP address, date and time, the page requested, and browser type. This is used to operate and secure the website.
Cookies and analytics
We use Google Analytics 4 to understand how the website is used, for example which pages are read and how visitors find us. It runs only if you choose “Accept analytics” in the cookie banner. Until you choose, and if you choose “Reject analytics”, the analytics script is not loaded, nothing is sent to Google and no analytics cookies are set.
If you accept, Google Analytics collects:
- the pages you view, when you view them and how you move between them;
- the website or link that referred you;
- your approximate location (country and city), derived from your IP address;
- device and browser information, such as device type, operating system, browser, language and screen size.
Google Analytics 4 does not log or store IP addresses. It uses them briefly to estimate location and then discards them. We do not use analytics for advertising: the advertising consent signals on this site are always set to “denied”, and we do not combine analytics data with anything you send through the contact form.
Google Analytics sets these first-party cookies on veliora.works, only after you accept:
- _ga: a random identifier that distinguishes one browser from another. It lasts up to 2 years.
- _ga_YKGPHE1TPZ: keeps the state of your current visit (session) for our Analytics property. It lasts up to 2 years.
To remember your choice, whichever it is, we store one item in your browser’s local storage: veliora-consent. It records whether you accepted or rejected analytics, the version of the banner and the date. It stays in your browser and is never sent to us or to anyone else. It remains until you change your choice or clear your browser’s site data. Because it is needed only to remember your decision, it does not require consent.
Changing your mind. Select “Cookie settings” at the bottom of any page and choose “Reject analytics”. We then stop analytics and delete the Google Analytics cookies from your browser. You can also delete cookies and site data in your browser settings at any time.
How we use it and our legal basis
We use the information you send only to read and respond to your enquiry, to discuss possible work with you, including product licensing, and to keep a record of that correspondence. We do not use it for marketing mailing lists, we do not sell it, and we do not use it for automated decision-making or profiling.
UK GDPR and EU GDPR. We rely on our legitimate interests in responding to business enquiries and running our business. Where you are asking about a possible engagement, we also rely on taking steps at your request before entering into a contract. Technical and security information is processed under our legitimate interests in keeping the website secure and available. Google Analytics runs only with your consent, given through the cookie banner, as required for non-essential cookies under the UK Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy rules. You can withdraw that consent at any time through “Cookie settings”.
Singapore PDPA. By submitting the form, you consent to Veliora collecting, using and disclosing your information for the purposes described in this notice. You may withdraw that consent at any time by contacting us. We will then stop using the information, although we may not be able to continue the conversation.
Who can access it
Your enquiry is sent by email from our web server to Veliora’s mailbox, which is hosted with Namecheap and is not forwarded to any other provider. Access is limited to the people at Veliora who need it to respond. We use the following service provider, which processes information on our behalf:
- Namecheap, our website hosting and email provider. It hosts the website and form handler, delivers and stores enquiry emails, and keeps server logs.
If you accept analytics cookies, we also use:
- Google, which provides Google Analytics 4 as our processor under its data processing terms. For visitors in the UK and EEA this is Google Ireland Limited, and the data may also be processed by Google LLC in the United States. It receives only the analytics information described above, never your enquiries.
We do not share your information with anyone else unless we are required to by law, or it is necessary to establish, exercise or defend legal claims.
International transfers
Veliora is based in Singapore, so information you send us from the UK or the European Economic Area will be accessed and processed in Singapore. Our hosting provider's servers may also be located outside the UK and EEA, for example in the United States.
Where UK or EU law requires a safeguard for these transfers, we rely on an appropriate mechanism, such as our provider's standard contractual data protection terms. Where it applies, we also rely on the transfer being necessary to respond to a request you have made. For Google Analytics, Google relies on the EU–US Data Privacy Framework and its UK Extension, and on standard contractual clauses. You can contact us for more information about the safeguards used.
How long we keep it
- Enquiries that do not lead to work: 24 months after our last contact with you, then deleted.
- Enquiries that lead to an engagement: for the duration of the engagement and afterwards for as long as needed for legal, tax, accounting and contractual purposes.
- Rate-limiting data: a short period, normally no more than 24 hours.
- Server logs: in line with our hosting provider's standard retention.
- Google Analytics data: visit-level and user-level data is kept for 14 months, then deleted automatically. Aggregated reports that identify no one may be kept longer. The cookies themselves expire as listed under “Cookies and analytics”.
Your rights
Depending on where you are, you have rights over your personal information. Under UK GDPR and EU GDPR you can ask us to:
- give you access to, or a copy of, the information we hold about you;
- correct inaccurate or incomplete information;
- delete your information;
- restrict how we use it, or object to our use of it based on legitimate interests;
- provide information you gave us in a portable format, where this applies.
Under the Singapore PDPA you can ask to access and correct your personal data and withdraw your consent.
To make a request, email contact@veliora.works. We may need to confirm your identity before acting on a request. We will respond within the time required by the applicable law, normally within one month.
Complaints
If you have a concern, please contact us first so we can try to resolve it. You also have the right to complain to a data protection authority:
- United Kingdom: the Information Commissioner’s Office (ICO), ico.org.uk.
- European Union / EEA: the supervisory authority in the country where you live or work, or where you believe an issue occurred. A list is published by the European Data Protection Board.
- Singapore: the Personal Data Protection Commission (PDPC), pdpc.gov.sg.
Security and changes
The website is served only over encrypted HTTPS. The form handler does not use a database and does not store enquiries on the web server beyond delivering them by email. We will update this notice if the way the website handles personal information changes, and the date at the top will show when it was last revised.