1. Scope of This Policy
This policy covers all personal information that VTAS HOLDINGS, LLC processes in connection with our public website, our client intake process, our advisory engagements and our day to day business operations. It applies to visitors who browse our pages, to prospective clients who send us a written signal, to current and former clients, and to suppliers and partners who work with our range desk.
The policy does not apply to information that has been fully anonymised so that it can no longer be linked to an individual, nor to information that we hold about a company rather than a person. It also does not apply to third party websites that you may reach from our pages, each of which maintains separate privacy practices. We encourage you to read the privacy notices of any external site you visit.
Where we act as a processor for a client, the terms of the relevant services agreement govern our handling of the client data, and this policy applies only to our own role as a controller. In those engagements the client remains responsible for the personal information it places in our care.
2. Information We Collect
We collect information that you choose to provide, information that is generated automatically when you use our website, and information that we receive from business partners in the ordinary course of advisory work. The categories below describe what we may hold.
Information you provide directly
- Identity details such as your name, job title and the organisation you represent.
- Contact details such as your email address, telephone number and business mailing address.
- Message content such as the subject and body of any inquiry you send through our contact form or by email.
- Engagement details such as the scope of work, the systems involved and the personnel assigned to a program.
- Billing details such as purchase order references, invoicing contacts and payment correspondence.
Information generated automatically
- Technical data such as the internet protocol address, browser type, device type and operating system.
- Usage data such as the pages viewed, the time spent on each page and the links followed within our site.
- Coarse location data inferred from the internet protocol address, used for security and traffic analysis.
Information we do not seek
We do not ask for and do not wish to receive sensitive personal information such as health records, biometric data, precise geolocation, government identification numbers or financial account credentials through this website. If you send such information to us voluntarily, we will treat it with care, but we recommend that you share it only through a secure channel agreed with the range desk.
3. Sources of Information
Most of the personal information we hold comes directly from you. You provide it when you send a written signal through our contact form, when you reply to our acknowledgement, when you join a range interview, or when you sign an engagement letter with our desk. During advisory work, members of your team may also provide information about colleagues who are involved in a program.
A smaller portion arrives indirectly. Our website generates technical and usage records as you browse. Our email and hosting providers supply routine delivery and security logs. Business partners may introduce a prospective client by sharing a business contact, in which case we rely on the introducer to have a lawful reason to pass that detail onward.
When you provide information about another person, you confirm that you have the authority to do so and that the person has been made aware of this policy. We will use that information only for the purpose for which it was shared, such as coordinating a meeting or staffing a program.
4. How We Use Information
We use personal information to deliver our services, to communicate with you, to keep our website safe and to meet our legal and accounting obligations. The specific purposes below describe the core of our processing.
- Responding to inquiries, scheduling reading windows and preparing proposals.
- Delivering portfolio systems reviews, watchtower risk mapping and the other advisory lines offered by our desk.
- Managing client relationships, engagements, deliverables and handover records.
- Sending service messages such as acknowledgements, status notes and closure summaries.
- Issuing invoices, processing payments and maintaining accounting records.
- Protecting our website against abuse, fraud and unauthorised access.
- Analysing site usage so that content and navigation can be improved.
- Complying with applicable law, responding to lawful requests and enforcing our agreements.
We do not sell personal information, and we do not use personal information to train external advertising systems. Our analysis is limited to what is necessary to run our practice and improve our service.
5. Legal Bases for Processing
Where data protection law requires a legal basis, we rely on one or more of the following grounds. We rely on your consent when you ask us to send optional updates or when you agree to a specific use that is not otherwise covered. Consent can be withdrawn at any time by contacting the range desk.
- Performance of a contract, when processing is needed to deliver services you have engaged.
- Legitimate interests, when processing supports our business in a way that is balanced against your rights, such as securing our site or improving our service.
- Legal obligation, when we must retain or disclose information to comply with applicable law.
- Consent, when we ask for a specific permission and you grant it.
Where we rely on legitimate interests, we have considered the impact on you and have put safeguards in place. You may object to that processing at any time, and we will assess your request carefully.
8. Service Providers and Processors
Our range desk relies on a small set of trusted providers to deliver email, host the website, maintain accounting records and keep our own systems secure. Each provider is chosen for its reliability and its security posture, and each is bound by a written agreement that sets out the permitted use of data and the safeguards that must be applied.
Providers act only on our instructions. They may not use personal information for their own marketing, and they must return or delete information when an engagement ends. We review our provider list periodically and remove any provider whose practices fall below the standard we require.
Where a provider is located outside the United States, we rely on appropriate safeguards such as standard contractual clauses or an equivalent recognised mechanism, and we take reasonable steps to confirm that the safeguards remain in force.
9. Data Retention
We keep personal information only for as long as it is needed for the purpose for which it was collected, plus any period required by law or by our professional records obligations. Retention periods differ by category because the consequences of losing a record differ by category.
- Inquiry messages are kept for up to twenty four months so that we can follow up and maintain continuity.
- Client engagement records are kept for the duration of the relationship and for a further period required for tax, accounting and legal purposes.
- Website traffic logs are kept for a short period, typically no longer than twelve months, unless a security incident requires longer retention.
- Marketing consent records are kept until consent is withdrawn, plus a brief period to evidence the withdrawal.
When a retention period ends, we delete the information or render it permanently anonymous. Where deletion is not immediately possible because information is held in a backup archive, we isolate it and delete it when the archive cycle allows.
10. Security of Information
We apply administrative, technical and physical safeguards designed to protect personal information against loss, misuse and unauthorised access. These safeguards reflect the sensitivity of the information we hold and the scale of our practice.
- Access to client records is limited to personnel who need it for their work.
- Accounts are protected with strong authentication, and access is reviewed when roles change.
- Data in transit is protected with encryption, and systems are kept patched and monitored.
- Personnel receive regular guidance on handling personal information and on recognising security threats.
- Incidents are logged, investigated and, where required, reported to affected parties and authorities.
No method of transmission or storage is perfectly secure, and we cannot promise absolute protection. We do commit to acting quickly and transparently if an incident occurs, and to taking the steps needed to reduce the risk of a repeat.
11. International Transfers
VTAS HOLDINGS, LLC is based in the United States, and our primary operations and records are located there. If you contact us from another country, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your home jurisdiction.
When we transfer personal information from a jurisdiction that restricts international transfers, we rely on recognised safeguards such as standard contractual clauses, supplementary technical measures and, where appropriate, your explicit consent. We assess the legal environment of each destination and apply additional protections when the risk requires them.
You may contact the range desk to learn more about the safeguards applied to a specific transfer, and we will provide the relevant information to the extent we are permitted to do so.
12. Your Privacy Rights
Depending on where you live, you may have a range of rights over the personal information we hold about you. We honour these rights for everyone who contacts us, to the extent the law allows, and we do not discriminate against anyone who exercises them.
- The right to know whether we hold personal information about you and to receive a copy.
- The right to request correction of information that is inaccurate or incomplete.
- The right to request deletion of information that we no longer need to hold.
- The right to object to processing based on legitimate interests.
- The right to withdraw consent where processing relies on consent.
- The right to data portability where processing is automated and based on consent or contract.
- The right to lodge a complaint with a supervisory authority in your jurisdiction.
To exercise a right, contact the range desk using the details in the final section of this policy. We will verify your identity, respond within the period required by applicable law, and explain any lawful reason why a request cannot be fully granted. There is no charge for a reasonable request.
13. Privacy for Children
Our website and our advisory services are intended for businesses and for adults acting in a professional capacity. We do not knowingly collect personal information from children under the age of thirteen, and we do not direct any part of our service to them.
If you believe that a child has provided personal information to us, please contact the range desk so that we can investigate. If we learn that we have collected information from a child without the appropriate consent, we will delete it promptly and take steps to prevent a recurrence.
Parents and guardians who have questions about the handling of a child data are welcome to contact us, and we will respond with the same care we apply to every privacy inquiry.
14. Marketing Communications
We send service messages as part of our ordinary work, such as acknowledging an inquiry, confirming a reading window or delivering a program summary. These messages are necessary to the relationship and are not optional while an engagement is active.
We send optional updates such as watch reports and service announcements only when you have asked to receive them or when we have another lawful basis to do so. Every optional message includes a clear way to stop future updates, and we act on opt out requests promptly.
We do not sell or rent contact lists, and we do not pass your details to another organisation for its own marketing. If a partner ever wishes to reach our clients, the message is delivered by us, under our control, and only where we judge it relevant.
15. Third Party Websites
Our pages may link to external websites that we do not control, such as regulatory resources, standards bodies or the sites of business partners. When you follow such a link, you leave our site and become subject to the privacy practices of the destination.
We review links before publishing them, but we cannot guarantee the content or the practices of an external site, and a link does not imply that we endorse its privacy handling. We encourage you to read the privacy notice of any website you visit, particularly before providing personal information.
If you believe that a link on our site points to content that is misleading or harmful, please tell the range desk and we will review it promptly.
16. Changes to This Policy
We review this policy from time to time and update it when our practices, our services or the law change. When we make a material change, we will revise the effective date shown below and, where appropriate, provide a prominent note on our website or a direct message to clients.
The version published on this page is the current version and replaces all earlier versions. We encourage you to review this policy periodically so that you remain informed about how we protect personal information.
Effective date: 1 January 2026. Last reviewed: 1 January 2026.
17. How to Contact Us
Questions, requests and complaints about this policy or about our handling of personal information should be directed to the VTAS HOLDINGS, LLC range desk. We treat every privacy inquiry seriously and aim to respond within one working day.
VTAS HOLDINGS, LLC
18 Porter, Irvine - 92620-2542, United States (US)
Email: request@vtasholdings.buzz
Phone: +19155291639
If you are not satisfied with our response, you may have the right to complain to a supervisory authority in your jurisdiction. We will cooperate fully with any such authority and will work in good faith to resolve the matter directly with you first.