Legal

Privacy Notice

How we collect, use, and protect your information — plain terms, not padded legalese, and complete enough to meet our legal duty to tell you.

1. Who we are

Salt & Standard is a trading name of VBG Solution Ltd, a company registered in England and Wales, company number 16412865. Our registered office is at 4 Montpelier Rise, London, NW11 9SS. For any question about this notice or your data, write to hello@salt-and-standard.com.

2. What we collect & why

We only collect what each purpose below actually needs.

Categories of personal data we hold, where each comes from, why we use it, and the lawful basis
Category	Source	Purpose	Lawful basis
Booking and scheduling data	From you, via Calendly	Arranging consultations	Contract, or steps taken at your request before a contract, where you are the prospective client; otherwise our legitimate interest in arranging the consultation your organisation requested
Email correspondence	From you	Responding to you and delivering the service	Our legitimate interest in responding to enquiries and running our business
Business contact details of prospective clients — name, role, business email or phone	Public sources: Companies House, venue websites and Google, and business social profiles	Relevant, one-to-one outreach about our services	Our legitimate interest in promoting our services to hospitality businesses likely to benefit from them (one-to-one, business-to-business); PECR corporate-subscriber rules
Technical request data — IP address, request logs	Your browser, via our hosting provider	Serving the site securely and preventing abuse	Our legitimate interest in running a secure service (processed by Cloudflare)
Calendly cookie data	Calendly's embedded scheduler	Salt & Standard and Calendly are separate, independent controllers of the cookie data Calendly's embedded scheduler sets: we are responsible for choosing to include the embed on our pages, but Calendly's own notice and consent controls govern what it stores and why	Your consent, given directly to Calendly

When we hold your business contact details because we found them from a public source rather than because you gave them to us, our first message to you links to this notice — our duty under UK GDPR Article 14 to tell you where the data came from.

3. Who processes it & where

Cloudflare — hosting and DNS, on Cloudflare's global network, including the US. Transfers happen under Cloudflare's Data Processing Addendum, relying on the EU Standard Contractual Clauses as modified by the UK Addendum.
Google Workspace — our business mailbox and email delivery. Processed under Google's Cloud Data Processing Addendum; international transfers via the EU-US Data Privacy Framework including its UK Extension.
Calendly — scheduling. For the scheduling data you give it, Calendly is our processor. For the cookies its own embedded scheduler sets on your device, Salt & Standard and Calendly are separate, independent controllers: we are responsible for choosing to include the embed on our pages, and Calendly's own notice and consent controls govern those cookies. Transfers to the US happen under its Data Processing Addendum, via the UK Extension to the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses with the UK Addendum.
HubSpot — customer relationship management, where we keep prospect and client contact records. Processing happens in the US, under HubSpot's Data Processing Agreement, via the UK Extension to the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses with the UK Addendum.

We check each provider's current Data Processing Addendum for the transfer mechanism actually in force, rather than assuming it stays fixed.

4. Cookies

Salt & Standard's own code sets no analytics cookies; the Calendly embed may use cookies under its retained consent controls.

5. Retention

Enquiry and client correspondence — 24 months after our last contact, then deleted, unless an engagement's legal or accounting duties require longer (6 years for contract or tax records).
Prospect contact data — 12 months from when we collected it if you don't respond, then deleted.
Scheduling data — kept per Calendly's account retention settings, reviewed annually.

6. Your rights

Under UK GDPR you have the right to access, correct, erase, or restrict the personal data we hold about you, to receive it in a portable format, and to object to how we use it. Objection is always honoured where the data is used for direct marketing — no exceptions asked for. To exercise any of these rights, write to hello@salt-and-standard.com.

7. Complaints

If you're unhappy with how we've handled your data, tell us first — we'd rather put it right. You can also complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

8. Last updated

This notice was last updated on 22 July 2026.