Privacy Policy

  1. Who I am
    This privacy policy explains how Laura Meehan trading as Virtual Assistant UK (“I”, “me” or “Virtual Assistant UK”) handles personal information in connection with my website and Virtual Assistant business.
  2. When I am a controller and when I am a processor
    For information I collect and use for my own business purposes, I am the data controller. This includes information about people who contact me, prospective and current clients, suppliers and other business contacts.
    The nature of Virtual Assistant work also means that I may process personal information on behalf of a client. For example, I may be given access to a client’s contacts, inbox, customer or supplier records, financial administration, employee or associate information, or other records needed to carry out an agreed task. In those circumstances, the client will usually be the controller and I will act as their processor, handling the information in accordance with their documented instructions and our contractual arrangements.
  3. Personal information I may collect
    Depending on how you interact with me, this may include:
    • your name, job title, organisation and contact details;
    • information you provide by email, telephone or other correspondence;
    • information needed to discuss, set up and provide my services;
    • billing, payment and transaction records;
    • records of our communications and working relationship; and
    • other information you choose to provide where it is relevant to an enquiry or my services.
  4. How and why I use personal information
    I may use personal information to:
    • respond to enquiries and discuss potential work;
    • enter into and manage client relationships and provide agreed services;
    • communicate with clients, suppliers and other business contacts;
    • prepare invoices, receive payments and maintain financial and business records;
    • meet legal, regulatory, tax and accounting obligations;
    • protect my business, systems and information and deal with disputes or legal claims; and
    • maintain appropriate records of my business activities.
  5. Lawful bases
    Under UK data protection law I need a lawful basis for using personal information. The bases most likely to apply to my own business activities are:
    • Contract – where processing is necessary to take steps at your request before entering into a contract, or to perform a contract with you.
    • Legitimate interests – where processing is reasonably necessary to run and protect my business, manage professional relationships, respond to enquiries or maintain appropriate records, provided those interests are not overridden by your rights and interests.
    • Legal obligation – where I need to process or retain information to comply with the law.
    • Consent – where I specifically ask for and rely on your consent. Where consent is the basis, you can withdraw it at any time.
  6. Website enquiries and cookies
    At the date of this policy, my website does not use cookies or a contact form. If this changes, I will update the information on the website and this policy as appropriate.
  7. Who I may share information with
    I do not sell personal information. I may share or make information available where reasonably necessary to run my business, provide services or comply with the law. This may include:
    • Microsoft, where I use Microsoft services for business email, documents, storage or related business functions;
    • IDrive, where business files or backups may contain personal information;
    • professional advisers such as my accountant or legal adviser, where necessary;
    • service providers that support the secure operation of my business; and
    • public authorities, regulators or other parties where disclosure is required or permitted by law.
    When I work as a processor for a client, the systems and software used can vary. I may work within systems supplied or specified by the client. Where a client does not provide suitable systems, information may, where appropriate and agreed, be handled using my own Microsoft environment and/or IDrive backup arrangements. The applicable client agreement deals with processor and sub-processor responsibilities.
  8. International clients and transfers
    I occasionally work with clients outside the UK. Having an overseas client does not necessarily mean that personal information is transferred internationally, but some services or working arrangements may involve access to or storage of information outside the UK.
    Where UK data protection law treats a disclosure or access arrangement as a restricted international transfer, I will take reasonable steps to ensure that an appropriate lawful transfer mechanism and relevant safeguards are in place. When I act as a processor, international transfers will be made only on the controller’s documented instructions or where otherwise required by applicable law.
  9. How long I keep personal information
    I keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide my services, maintain appropriate business and financial records, meet legal or tax requirements and establish or defend legal claims. Retention periods therefore vary according to the type of information and the reason I hold it.
    Where I process personal information solely on behalf of a client, return, deletion and retention are handled in accordance with the client’s instructions and our agreement, subject to any legal requirement to retain information and the practical operation of secure backup cycles.
  10. Security
    I take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration or disclosure. The measures used are proportionate to the nature of the information and the way it is being processed, and include appropriate access controls, account security, secure storage and backup arrangements.
  11. Your data protection rights
    Depending on the circumstances, UK data protection law may give you rights over your personal information, including rights to access it, have inaccurate information corrected, request erasure or restriction, object to certain processing, and receive certain information in a portable format. Not every right applies in every situation.
    If I hold your information as a controller, you can contact me using the privacy details below. If I am processing your information solely on behalf of one of my clients, I may need to refer your request to that client as the controller.
  12. Complaints
    If you are concerned about how I have handled your personal information, you can make a data protection complaint by contacting me using the privacy details below. I will acknowledge your complaint within 30 days and will investigate and respond without undue delay. I may ask you for further information where this is reasonably necessary to understand or investigate the complaint.
    If you remain dissatisfied, you also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection.
  13. Changes to this policy
    I may update this privacy policy from time to time to reflect changes to my services, systems or legal obligations. Last updated: 1st July 2026.
  14. Contact details
    Controller: Laura Meehan
    Privacy email: laura@virtualassistantuk.co.uk
    Privacy phone: 020 8690 6133
    ICO Registration Number: ZC235517