Effective Date: March 17, 2026

Last Updated: March 17, 2026

Domain: https://www.enolavirtus.com

Corporate Entity: EnolaVirtus Ltd. 

(England & Wales)

1. INTRODUCTION AND SCOPE

EnolaVirtus Ltd. ("EnolaVirtus," "we," "us," or "our") is committed to respecting your privacy and protecting personal data collected through our corporate website (https://www.enolavirtus.com) and associated communication channels.

This Privacy & Data Retention Policy explains what personal information we collect from visitors, how we process and store it, the statutory lawful bases under which we operate, your individual legal rights, and our formal schedule for data retention and disposal.

Our data processing practices adhere strictly to:

• The UK General Data Protection Regulation (UK GDPR);
• The UK Data Protection Act 2018;
• The EU General Data Protection Regulation (EU GDPR 2016/679); and
• The Privacy and Electronic Communications Regulations (PECR).

2. THE DATA CONTROLLER

The legal entity responsible as the Data Controller for personal data processed through this website is:

• Company Name: EnolaVirtus Ltd.
• Jurisdiction of Incorporation: England & Wales (Company No. 15086620)
• Registered Location: City of London, London, United Kingdom
• Executive & Data Protection Lead: Gerard Howard, Founder & CEO
• Privacy & Governance Enquiries: gerry@enolavirtus.com / privacy@enolavirtus.com
• Website: https://www.enolavirtus.com

3. PERSONAL DATA WE COLLECT

Depending on how you engage with our website and services, we collect and process the following categories of personal information:

A. Information You Provide Voluntarily

• Contact & Identification Data: Your name, business or personal email address, telephone number, job title, and organization name when you submit a web inquiry, book a meeting, register for updates, or request corporate documentation.
• Correspondence & Communications: Records and contents of communications sent to our team via web forms, email, or direct contact, including specific questions, partnership inquiries, or customer support requests.

B. Technical Data Collected Automatically

• Device & Connection Telemetry: Internet Protocol (IP) address, browser type and version, operating system, device identifiers, time zone setting, and language preferences.
• Usage & Navigation Metrics: Uniform Resource Locators (URLs) accessed, referral sources, page interaction information, navigation paths, download activities, and session durations.
• Server Access Logs: Automated security logs recording HTTP/HTTPS connection requests, timestamps, error logs, and protocol handshakes to protect against network intrusion and denial-of-service attempts.

C. Special Category Personal Data

We do not collect or process any Special Category Personal Data (such as biometric, genetic, health, philosophical, religious, or political information) through this website.

4. LAWFUL BASES FOR PROCESSING

Under Article 6 of the UK GDPR and EU GDPR, we process your personal data only where an established legal basis exists:

Purpose of ProcessingCategories of DataLawful Basis (UK / EU GDPR)

Responding to Inquiries & Communications

Name, Email, Phone, Message contents

Legitimate Interests (Art. 6(1)(f)) – to answer prospective client questions and provide requested corporate information.

Pre-Contractual Discussions & Commercial Requests

Identification, Business affiliation, Contact details

Contractual Necessity (Art. 6(1)(b)) – taking steps at your request prior to entering into a formal agreement.

Website Security & Fraud Prevention

IP address, Device metadata, Server access logs

Legitimate Interests & Legal Obligation (Art. 6(1)(c)) – maintaining network integrity and defending corporate IT infrastructure.

Website Performance & Analytics

Aggregated usage data, Cookies

Consent (Art. 6(1)(a)) – where non-essential performance or analytics cookies are accepted by the user.

Statutory Compliance & Legal Defense

Corporate communications, Identification data

Legal Obligation (Art. 6(1)(c)) and Legitimate Interests – defense or enforcement of legal rights under England & Wales law.

5. HOW WE USE YOUR PERSONAL DATA

We use collected information exclusively for legitimate business purposes:

1. To provide, operate, maintain, and optimize our website and user experience;
2. To respond directly to questions, feedback, and commercial inquiries submitted through our web forms;
3. To provide scheduled technical or corporate updates requested by you;
4. To monitor, diagnose, and maintain website stability, security, and uptime;
5. To fulfill statutory filing, accounting, tax, and governance requirements under UK law.

We do not sell, rent, lease, or monetize your personal information to third parties.

6. COOKIES AND TRACKING TECHNOLOGIES

Our website uses cookies and related technologies to ensure security, system functionality, and performance insights:

• Strictly Necessary Cookies: Essential for page routing, session security, and basic platform operation. Under PECR and UK GDPR, strictly necessary cookies do not require prior consent.
• Performance & Analytics Cookies: Collect aggregated, anonymous metrics regarding visitor interactions, page performance, and download events. These are disabled by default and activated only upon affirmative consent via our cookie banner.
• Managing Cookie Preferences: You can configure your browser to block or alert you to cookies. Disabling strictly necessary cookies may impact website responsiveness and feature accessibility.

7. DATA SHARING AND DISCLOSURES

We only share personal data with vetted third parties under strict contractual terms that mandate data confidentiality and security:

1. Cloud Hosting & Infrastructure Providers: Tier-1 cloud, hosting, and DNS service providers located in the UK and European Union (e.g., AWS, Microsoft Azure, Cloudflare) operating under verified Data Processing Agreements.
2. Professional Advisors: Chartered accountants, auditors, legal counsel, and compliance advisors operating under professional statutory obligations of confidentiality or legal privilege.
3. Regulatory & Law Enforcement Authorities: Public agencies, law enforcement, or statutory bodies (such as HM Revenue & Customs, the UK Information Commissioner's Office, or Companies House) strictly where compelled by binding statutory process or court order.
4. Corporate Transactions: In connection with any bona fide corporate reorganization, financing, or sale of company assets, subject to customary non-disclosure agreements.

8. INTERNATIONAL DATA TRANSFERS

EnolaVirtus Ltd. operates primarily from the United Kingdom. When personal data is transferred outside the UK or the European Economic Area (EEA), we ensure appropriate safeguards are implemented in compliance with Chapter V of the UK GDPR / EU GDPR:

• Transfers to jurisdictions confirmed as providing an adequate level of protection by the UK Secretary of State or European Commission;
• Implementation of the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses (SCCs); and
• Confirmation of supplementary technical security measures, including end-to-end transport encryption.

9. COMPREHENSIVE DATA RETENTION POLICY & SCHEDULE

EnolaVirtus Ltd. enforces a strict data retention and disposal schedule to ensure personal information is kept no longer than necessary for the purposes for which it was gathered.

Data Retention Schedule

Data CategoryPurposeMaximum Retention PeriodDisposal Protocol

General Inquiries & Contact Requests

Responding to inquiries and following up on commercial discussions.

24 months from date of last substantive interaction.

Permanent cryptographic erasure from active messaging systems.

Commercial Contracts & Financial Records

Statutory accounting, VAT/tax compliance, and corporate governance.

6 years following the end of the relevant financial year (Companies Act 2006 & HMRC).

Secure archival followed by permanent certified digital destruction.

Pre-Contractual & Partner Diligence Records

Evaluating commercial proposals and corporate arrangements.

3 years following completion of discussions or termination of engagement.

Secure deletion from internal file repositories.

Technical Server Logs & Security Records

Network security, intrusion prevention, and system auditing.

90 days from log creation date.

Automated log cycling, truncation, and permanent overwriting.

Marketing Consents & Subscriptions

Delivering requested corporate newsletters and alerts.

Until opt-out / withdrawal, with periodic re-confirmation every 24 months.

Immediate suppression and purge from active distribution lists.

Secure Disposal Protocols

Once data exceeds the applicable retention period and no active statutory claim or dispute exists, files are securely deleted using permanent electronic overwriting or destroyed in accordance with industry best practices.

10. TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

We maintain technical and organizational safeguards designed to protect personal data against unauthorized access, loss, destruction, or alteration:

• In-Transit Encryption: Enforced Transport Layer Security (TLS 1.3) across all public website connections and communication endpoints.
• Access Governance: Restricted administrative access based on the principle of least privilege, managed through multi-factor authentication (MFA).
• System Hardening: Routine security reviews, endpoint protection, and automated boundary threat monitoring.

11. YOUR STATUTORY RIGHTS

Under the UK GDPR and EU GDPR, you hold specific legal rights concerning your personal information:

• Right of Access: You can request confirmation of whether we process your personal data and obtain a copy of that data (Subject Access Request).
• Right to Rectification: You can request correction of inaccurate, out-of-date, or incomplete information.
• Right to Erasure ("Right to be Forgotten"): You can request the deletion of your personal data where continuing retention is no longer justified.
• Right to Restrict Processing: You can ask us to suspend or restrict data processing under specific contested conditions.
• Right to Data Portability: You can request that personal data you provided directly be transferred to you or a third party in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing based on our legitimate interests or direct marketing at any time.
• Right to Withdraw Consent: Where processing relies on your consent, you may withdraw it at any time without impacting prior lawful processing.

To exercise any of these statutory rights, please submit a written request to our Data Governance Lead at privacy@enolavirtus.com or gerry@enolavirtus.com. We respond to all verified requests within one (1) calendar month, free of charge, as required by law.

12. SUPERVISORY AUTHORITY & COMPLAINTS

If you have questions or concerns regarding our data handling, we ask that you contact us first so we can address your issue promptly.

You also have the right to lodge a formal complaint with the competent supervisory authority:

• United Kingdom:
  Information Commissioner’s Office (ICO)
  Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  Telephone: 0303 123 1113
  Website: https://ico.org.uk
• European Economic Area (EEA):
  If you are located in the EEA, you may contact your local national Data Protection Authority (DPA) under the European Data Protection Board (EDPB) structure.

13. THIRD-PARTY WEBSITES & EXTERNAL LINKS

Our website may provide hyperlinks to third-party websites, news articles, or industry resources. We do not control and are not responsible for the privacy practices, content, or policies of external sites. We encourage you to review the privacy notices of any external site you visit.

14. UPDATES TO THIS POLICY

EnolaVirtus Ltd. may update this Privacy & Data Retention Policy periodically to reflect operational changes, corporate updates, or amendments to statutory data protection regulations. The "Last Updated" date at the top of this document will always reflect the most recent revision.

15. CONTACT US

For any inquiries, requests, or notices regarding this Privacy & Data Retention Policy, please contact:

EnolaVirtus Ltd.

Email: info@enolavirtus.com

Data Governance Inquiries: privacy@enolavirtus.com

Registered Jurisdiction: England & Wales (Company No. 15086620)

Registered Location: City of London, London, United Kingdom

Web: https://www.enolavirtus.com