Privacy Policy

The Virtual Mall is operated by Datafly Ltd (registered in England and Wales, company number 14411653), which is the data controller responsible for your personal information. We are based at 128 City Road, London, United Kingdom, EC1V 2NX. For any privacy-related queries you can reach us at privacy@thevirtualmall.co.uk.

We use the information we collect to:

• Provide, operate, and maintain our website
• Improve, personalise, and expand our website
• Understand and analyse how you use our website
• Develop new products, services, features, and functionality
• Communicate with you, including for customer service and support
• Send you newsletters and marketing communications (with your consent)
• Process your transactions and manage your requests
• Find and prevent fraud and abuse
• Comply with legal obligations

Under UK GDPR we must have a lawful basis for processing your personal information. The basis we rely on depends on the purpose:

• Statistical purposes (first-party analytics): we use our own analytics (Datafly Signal) to compile internal statistics about how our site is used. Under the statistical-purposes exemption to the Privacy and Electronic Communications Regulations (PECR), introduced by the Data (Use and Access) Act, these first-party, pseudonymised cookies do not require your prior consent — but you can still switch them off at any time via "Cookie Settings" in the footer.
• Consent: for third-party analytics cookies, advertising cookies, and sending you our newsletter and marketing communications. You can withdraw your consent at any time.
• Performance of a contract: for creating and managing your account and providing the features you sign in to use.
• Legitimate interests: for operating, securing, and improving our website, and for detecting and preventing fraud and abuse — balanced against your rights and freedoms.
• Legal obligation: where we are required to process information to comply with the law.

We use cookies and similar tracking technologies to track activity on our website and store certain information. You can manage your cookie preferences at any time using our Cookie Settings link in the footer.

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using SSL/TLS
• Secure server infrastructure
• Regular security assessments and updates
• Access controls and authentication procedures
• Employee training on data protection

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

We keep your personal information only for as long as is necessary for the purposes for which it was collected:

• Newsletter subscribers: until you unsubscribe, after which we retain a minimal record of your unsubscribe request to honour it.
• Account holders: for as long as your account remains active. If you delete your account, we delete or anonymise your personal data within 30 days, except where we must retain it to meet a legal obligation.
• Analytics data: our analytics platform (Datafly Signal) processes events in real time and does not itself retain a store of your data. The pseudonymised statistics it produces are not used to identify you personally.

When information is no longer needed, we securely delete or anonymise it.

Our analytics platform (Datafly Signal) is hosted on our own infrastructure in the United Kingdom. However, some of the third-party services we use — in particular Google AdSense — may process data on servers outside the UK, including in the United States.

Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK GDPR, such as the UK's adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, so that your information remains protected.

Under the UK General Data Protection Regulation (GDPR), you have the following rights:

• Right to Access: You can request copies of your personal data
• Right to Rectification: You can request correction of inaccurate or incomplete data
• Right to Erasure: You can request deletion of your personal data
• Right to Restrict Processing: You can request limitation of how we use your data
• Right to Data Portability: You can request transfer of your data to another service
• Right to Object: You can object to processing of your personal data
• Right to Withdraw Consent: You can withdraw consent for data processing at any time

To exercise any of these rights, please contact us using the details provided below. We will respond within one month.