Last updated: 8 September 2026

Who we are

This website is operated by Virtual Lottie Limited (“Virtual Lottie”, “we”, “us”, “our”), a company registered in England and Wales, company number 13818170, VAT number 469831249. Our registered office is C/O Taxevo, 1 Cedar Office Park, Cobham Road, Wimborne, England, BH21 7SB.

Virtual Lottie is the data controller for the personal data described in this policy.

Data protection contact: Lottie Doherty, Co-Director
Email: info@virtuallottie.com
Phone: 07305 727 096

We do not collect any special category data about you (this includes details about race or ethnicity, religious or philosophical beliefs, health, sex life or sexual orientation, political opinions, trade union membership, or genetic/biometric data), nor do we collect information about criminal convictions or offences.

This website is not intended for children, and we do not knowingly collect data from children.

Third-party links

This website may include links to third-party websites (e.g. social media, embedded videos). Clicking these may allow third parties to collect data about you. We don’t control these websites and aren’t responsible for their privacy practices — we’d encourage you to read their privacy notices too.

What personal data we collect

We collect and process the following categories of personal data:

– Enquiry and lead data — when you contact us or apply for a discovery call via our forms (Dubsado), we collect your name, email, phone number, business name, and any details you provide about your business needs.
– Client data — if you become a client, we collect contact details, business information, billing details, and the content/materials needed to deliver our services (e.g. social media assets, brand guidelines, login credentials for platforms you ask us to manage).
– Payment data — payments are processed by Stripe. We do not store your full card details ourselves; Stripe processes and holds this data under its own privacy policy.
– Mailing list data — if you subscribe to our mailing list, we collect your name and email address via our mailing list provider (Mailchimp or equivalent).
– Website usage data — we use analytics tools (e.g. Google Analytics) and the Meta (Facebook) Pixel to understand site traffic and measure ad performance. This may include your IP address, device/browser information, and browsing behaviour on our site.
– Associate/subcontractor data — for individuals we work with to deliver client services, we hold contact details, timesheets, and payment information.

Why we process your data (lawful basis)

| Purpose | Lawful basis |

| Responding to enquiries, running discovery calls | Legitimate interests / steps prior to a contract |
| Delivering services to clients | Performance of a contract |
| Processing payments | Performance of a contract / legal obligation |
| Sending marketing/mailing list emails | Consent |
| Website analytics and advertising pixels | Consent (via cookie banner) |
| Keeping financial records | Legal obligation (UK tax law) |

Use of Artificial Intelligence (AI)

We may use approved AI tools to help us deliver our services, manage our business, analyse information, and prepare communications and content. Where personal data is processed using AI tools, we do so in accordance with UK data protection law and with appropriate security measures. AI is used to support our work, not to replace human decision-making — a person always reviews and takes responsibility for the work we deliver to clients.

Cookies

Our website uses cookies. Essential cookies are required for the site to function. We also use non-essential cookies for analytics (Google Analytics) and advertising (Meta Pixel), which are only set with your consent via our cookie banner. You can change or withdraw your consent at any time through the cookie settings on our site.

Who we share your data with

We share data with trusted third-party processors who help us run our business, including:

– Dubsado (client/lead management and forms)
– Stripe (payment processing)
– Mailchimp (or equivalent — mailing list)
– Google (Google Drive/Workspace for file storage, Google Analytics)
– Microsoft (OneDrive/SharePoint, where used for client file delivery)
– Meta (Facebook Pixel for advertising)
– Our associates/subcontractors, where necessary to deliver your service, under confidentiality obligations

We do not sell your personal data.

Change of purpose

We’ll only use your personal data for the purposes we collected it for, unless we reasonably need to use it for another, compatible reason. If we need to use it for something unrelated, we’ll tell you and explain the legal basis first — unless we’re required or permitted by law to process it without notifying you.

International data transfers

Some of the providers above (e.g. Google, Meta, Stripe, Mailchimp) may store or process data outside the UK, including in the United States. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses or the provider’s participation in a recognised data protection framework, to ensure your data remains protected to UK standards.

Data security

We have appropriate security measures in place to prevent your personal data from being accidentally lost, misused, accessed without authorisation, altered, or disclosed. We limit access to personal data to those in our team and associate network who genuinely need it to do their work, and they’re bound by confidentiality obligations.

If a personal data breach ever occurs, we have a procedure to investigate it and will notify you and the relevant regulator where we’re legally required to.

How long we keep your data

– Financial and invoicing records: 6 years, in line with UK tax record-keeping requirements.
– Client project data: retained for the duration of our working relationship plus [suggest: 12 months] afterwards, then securely deleted, unless a longer period is needed for legal or contractual reasons.
– Enquiry/lead data that doesn’t convert to a client: retained for [suggest: 12 months] then deleted.
– Mailing list data: retained until you unsubscribe or request deletion.

Your rights

Under UK GDPR, you have the right to:

– Access the personal data we hold about you
– Request correction of inaccurate data
– Request erasure of your data (subject to legal/contractual exceptions)
– Object to or restrict certain processing
– Request a copy of your data in a portable format
– Withdraw consent at any time (e.g. unsubscribe from our mailing list)

To exercise any of these rights, contact Lottie Doherty at info@virtuallottie.com.

No fee required, with some exceptions. You won’t normally have to pay to exercise these rights. We may charge a reasonable fee, or refuse the request, if it’s clearly unfounded, repetitive, or excessive.

Verifying your identity. We may need to ask you for information to confirm your identity before acting on a request — this protects your data from being disclosed to the wrong person.

Response time. We aim to respond to all legitimate requests within one month. If your request is particularly complex, this may take longer, in which case we’ll let you know and keep you updated.

How to complain

We take data protection complaints seriously and have a dedicated [Data Protection Complaints Policy](#) that sets out how we handle them. In short:

We aim to handle any concerns about how we use your data fairly and promptly. If you’re unhappy with how we’ve handled your personal data, you can complain to us directly:

– Online: via our contact form at virtuallottie.com/contact
– By email: info@virtuallottie.com
– By post: Virtual Lottie Limited, C/O Taxevo, 1 Cedar Office Park, Cobham Road, Wimborne, England, BH21 7SB

We will acknowledge your complaint within 30 days, investigate it under the responsibility of Lottie Doherty, Co-Director, and keep you informed of progress. We’ll let you know the outcome without undue delay.

If you’re not satisfied with our response, you also have the right to complain to the UK regulator (the Information Commission, formerly the ICO):

Website: ico.org.uk
Helpline: 0303 123 1113

Children’s data

Our services are aimed at businesses, not children. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The “last updated” date at the top of this page shows when it was last revised.