Legal

Privacy Policy

Effective date: 1 May 2026 | Last updated: 18 May 2026

Version 1.1 — supersedes all prior versions

Summary: We collect only what you give us (contact form data) plus standard web analytics. We never sell your data. Our software products operate read-only on your D365 environment by default. Write actions are logged in your own D365 audit trail, not ours. You can request deletion of your data at any time.

1. Data controller

The data controller for personal data processed through this website and our products is:

Vertex Dynamics Ltd
Registered in England and Wales
Email: privacy@vertexdynamicslabs.com
General contact: hello@vertexdynamicslabs.com

2. What personal data we collect and why

Data	Source	Purpose	Legal basis
Name, company, email	Contact form	Respond to your enquiry; provide early access	Legitimate interest / contract
D365 environment type (optional)	Contact form	Tailor product demo to your environment	Legitimate interest
IP address, page views, referrer	Analytics (privacy-respecting)	Understand site usage; improve product	Legitimate interest
D365 environment data (read-only)	OAuth connection (product use)	Deliver agent/ISV functionality; not stored server-side	Contract (product subscription)

We do not collect: financial account details, government identifiers, health information, or any special category data.

3. Cookies and tracking

This website uses the following cookies:

Cookie	Type	Purpose	Duration
Session cookie	Strictly necessary	Basic site functionality	Session
Cloudflare Web Analytics	Analytics — no cookie set	Aggregated page-view counting; no cookies, no fingerprinting	None — cookieless

We do not use advertising cookies, third-party tracking pixels, or cross-site tracking. Our analytics provider (Cloudflare Web Analytics) sets no cookies and does not fingerprint visitors, so no cookie-consent banner is required for it.

4. How we share your data

We do not sell, rent, or trade your personal data. We may share data with:

Microsoft Azure — cloud infrastructure provider. Data processed under Microsoft's Data Processing Agreement and EU Standard Contractual Clauses.
Law enforcement — only if required by law or court order, and only to the extent required.

5. Data retention

Contact form submissions are retained for 24 months after last contact. If you become a customer, your data is retained for the duration of the contract plus 6 years (UK statutory minimum for financial records). D365 environment data is not stored server-side — it is queried at runtime only.

6. Your rights (UK GDPR / GDPR)

You have the right to:

✓ Access — request a copy of your personal data
✓ Rectification — correct inaccurate data
✓ Erasure — request deletion of your data
✓ Portability — receive your data in a machine-readable format
✓ Objection — object to processing based on legitimate interest
✓ Lodge a complaint — with the ICO (ico.org.uk) in the UK, or your local supervisory authority in the EU

To exercise any right: privacy@vertexdynamicslabs.com. We respond within 30 days.

7. Security

All data is transmitted over TLS 1.2+. Our products run on Microsoft Azure with SOC 2-certified infrastructure. D365 OAuth tokens are short-lived and scoped to minimum required permissions. We follow a principle of least privilege throughout.

8. International transfers

Data may be processed in the UK and EEA (Microsoft Azure UK South / West Europe regions). Any transfer outside the EEA is covered by Standard Contractual Clauses (SCCs) under GDPR Article 46.

9. Changes to this policy

We will post material changes to this page and, where we hold your email, notify you by email at least 14 days before the change takes effect. The "last updated" date above is always current.

Contact our privacy team

For any privacy query or rights request: privacy@vertexdynamicslabs.com

ICO registration number: [pending — registration in progress]