Notice on Privacy and Personal Data

Virgin AI regards the careful use of personal information as an essential responsibility. We handle data transparently, for specific purposes and in line with applicable obligations, including the UK GDPR. This notice explains what we collect, why we use it, how long we retain it and the measures used to protect it.

1. Responsibility for your personal data

Under the UK GDPR, the website operator and the Virgin AI platform act as controllers of your personal data. Our legal notice provides the relevant contact information and additional details. You may also send privacy-related questions to our data protection officer.

2. Personal data we obtain

We collect and use information necessary to run the service, fulfil legal obligations and protect the platform. This may cover:

Identity details: your first name, surname and date of birth, used to verify who you are and confirm your age.
Contact details: your email address, any telephone number you provide, country of residence and, where applicable, your postal address.
Account and payment data: payment information, deposits, withdrawals and transaction-related records.
Technical and usage data: IP address, browser and device information, login times and connection logs.
Verification records: identity documents, address evidence and other material required for KYC/AML checks where legally applicable.

We generally avoid collecting special-category data, including health information or religious beliefs, unless required by law or expressly permitted by you.

3. Where your data comes from

We may receive your information through a number of protected sources:

Details you submit: for example, when registering, changing your profile, providing documents or getting in touch with us.
Data gathered automatically: including cookies, server logs, analytics information and technical data produced through platform use.
Data received from other parties: such as payment providers supporting deposits or withdrawals, KYC/AML screening services and social login providers when you approve access.

4. Uses of your information

We use personal data for defined lawful purposes, including the following when relevant:

To create, manage and maintain your account, including the platform features available to you.
To process and protect payment activity, including deposits and withdrawals.
To offer suitable assistance and deal with your questions, requests and reported problems.
To satisfy legal and regulatory responsibilities, including KYC, AML and tax obligations.
To secure our systems and detect or prevent fraud, misuse and attempted unauthorised access.
To refine the user experience and enhance platform capabilities over time.
To send operational updates or marketing communications where you have opted in.

5. Legal grounds for processing

To perform our agreement with you or take requested steps before an agreement is made (Article 6(1)(b) UK GDPR).
To comply with legal duties (Article 6(1)(c) UK GDPR), including anti-money-laundering requirements.
For legitimate interests (Article 6(1)(f) UK GDPR), such as platform protection, operational continuity and dependable service provision.
With your explicit consent (Article 6(1)(a) UK GDPR), for example for marketing or optional features.

6. Circumstances for sharing data

We share information only where necessary, with selected recipients and service providers including:

Banks and payment providers involved in accepting deposits or facilitating withdrawals.
Specialist providers engaged for KYC and AML verification.
Cloud infrastructure and technology suppliers working under appropriate data-processing agreements.
Analytics and security providers, using anonymised or pseudonymised data where reasonably possible.
Professional consultants, including solicitors and tax advisers, where legal or compliance support is required.
Courts and government bodies when disclosure is required by law or needed to bring, establish or defend legal proceedings.

We do not sell personal data or disclose it to third parties for their separate commercial purposes.

7. International transfers

Certain suppliers, such as hosting and analytics companies, may be based outside the UK or European Economic Area. If data is transferred internationally, we apply suitable safeguards, which may include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, binding corporate rules or an applicable adequacy decision, so that protection remains appropriate.

8. Measures used to protect data

We use a mixture of technical safeguards and internal controls to help protect your personal information:

Protected connections using current security protocols, including TLS 1.3 or newer.
Strong encryption for sensitive data held on our systems, including AES-256 where appropriate.
Regular security reviews, penetration testing and assessments by independent specialists.
Continuous monitoring to help spot abnormal activity and attempted attacks.
Access rights assigned according to each employee's responsibilities and role.
Client funds held in segregated accounts via regulated service providers.

Although no online service can eliminate every security threat, these measures are intended to reduce foreseeable risks.

9. Data retention periods

We retain personal data only as long as necessary for the purposes explained here or as required by applicable law:

For as long as your account is active and our contractual relationship remains in place.
After closure, for the period required under relevant rules, which may be 5–10 years for tax or regulatory records.
Where consent is the legal basis, such as for marketing, until you revoke that consent.

Once data is no longer needed, we securely delete it or convert it into an anonymous form.

10. Your privacy rights

Data protection legislation provides several rights concerning your personal data, including the right to:

Ask whether we hold or use personal data about you and request confirmation.
Request correction of inaccurate information or completion of incomplete records.
Request erasure when there is no valid legal reason to continue keeping the data.
Ask for processing to be restricted in situations recognised by law.
Receive your data in a structured, commonly used and machine-readable format so it can be transferred elsewhere.
Revoke consent at any point where continued processing depends on it.
Raise a concern with the relevant data protection supervisory authority.

11. Cookies and similar technologies

Cookies and similar technologies allow the website to function, help us understand visitor behaviour and support service improvements. Essential cookies operate by default, while analytics and advertising cookies require your permission. Further information appears in our separate cookie notice.

12. Changes to this notice

This notice may be revised periodically to reflect changes in law, regulation or the platform. We will publish the latest version on our website. If a change is significant, we will notify you by email or through the platform.

13. How to contact us about privacy

For questions about privacy, this notice or exercising your rights, email $site_gmail or submit the website contact form. Our data protection officer will review your request and seek to respond within a reasonable period.

By using Virgin AI, you acknowledge that you have read this notice and agree to its terms.