06Legal

Privacy policy.

What personal data this website collects, why, how long we keep it, and what you can require us to do with it. Written to be read, not to be survived. The training platform and its apps have their own policy.

Last updated 2026-08-28

This policy covers the veliard.com website and nothing else. The site has no accounts, no tracking pixels and no advertising. The only personal data we hold from it is what you type into the contact form, plus the server logs any web server produces.

The Veliard training platform and its iOS and Android apps are a different service with a different data profile, a different set of legal bases, and a role split between us and the coach who holds your roster. They are covered by the platform privacy policy, not by this one. Use of the platform itself is governed by the terms of service.

06.1Who is responsible

Controller: Veliard Ltd, reg. HE493832, Anastasiou Sioukri 1, Themis Court, 4th Floor, Office 402, 3105 Limassol, Cyprus
Contact: contact@veliard.com — reaches the person who handles data requests
DPO: Not appointed. Our processing does not meet the Article 37 criteria; requests go to the address above.

06.2What we collect

01Contact form. Name, work email, company, topic, and whatever context you write. Nothing on the form is required beyond an email we can reply to.
02Email correspondence. If a conversation starts, the thread and any documents you choose to send.
03Server logs. IP address, timestamp, requested URL, referrer and user agent, written by the web server for security and fault diagnosis. Not linked to form submissions and not used to profile anyone.

Please do not send confidential client material, safety artefacts or anything ITAR- or export-controlled through the contact form. Ask us for a channel first.

06.3Purpose, legal basis, retention

PurposeLegal basisRetention

Answering your enquiryArt. 6(1)(b) — steps prior to a contract, or 6(1)(f) legitimate interest in responding12 months

Running an engagementArt. 6(1)(b) — performance of the contractTerm + 6 years

Accounting and tax recordsArt. 6(1)(c) — legal obligation under Cyprus law6 years

Server logs, securityArt. 6(1)(f) — legitimate interest in keeping the site available and secure30 days

Where we rely on legitimate interest, you can object at any time under Article 21 and we will stop unless we can show compelling grounds that override yours.

06.4Cookies

This site sets no analytics, advertising or profiling cookies, and embeds no third-party scripts that would set them. Only strictly necessary cookies are used, which under Article 5(3) of Directive 2002/58/EC do not require consent — which is why you are not asked to dismiss a banner to read a page.

If we later add analytics, a consent banner will appear before any non-essential cookie or script loads, refusal will be as easy as acceptance, and this section will list each cookie, its purpose and its lifetime.

06.5Who else processes it

We do not sell personal data and we do not share it for anyone else’s marketing. It is handled by the service providers we need to run the business, each under a written Article 28 processing agreement:

Vercel Inc. (servers: eu-central-1 (Frankfurt, Germany))Website hosting and server logs

We may also disclose data where a court or a competent authority lawfully requires it.

06.6Transfers outside the EEA

We keep processing inside the EEA where we can. Where a provider processes data outside it, the transfer relies on an adequacy decision or on the European Commission’s Standard Contractual Clauses with a transfer impact assessment on file. Write to us if you want to know which mechanism covers a specific provider.

06.7Security

Transport is encrypted (TLS), access to mailboxes and repositories is limited to the people who need it and protected by multi-factor authentication, and client material is kept separated per engagement. Where a personal data breach is likely to result in a risk to your rights, we notify the Commissioner within 72 hours and you without undue delay.

06.8Your rights

Under the GDPR you can ask for access to your data, correction, erasure, restriction of processing, portability, and you can object to processing based on legitimate interest. There is no automated decision-making or profiling here. Send the request to contact@veliard.com; we answer within one month, and say so if a complex request needs the two-month extension Article 12(3) allows. Exercising a right is free and does not affect anything else we are doing for you.

06.9Complaints

If you think we have handled your data badly, tell us first — it is usually faster. You also have the right to complain to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or to the supervisory authority where you live or work.

06.10Changes to this policy

When this policy changes materially we update the date at the top and, where the change affects data we already hold, we tell the people concerned directly. Earlier versions are available on request.

Want to know exactly what we hold on you?

Make a request