VCDesk Privacy Policy
Last updated: 15 October 2026
1. Who we are
VCDesk is a helpdesk and ticketing service operated by Voltex Computers Limited ("VCDesk", "we", "us", "our"). We are a company registered in England and Wales under company number 04038413. Our registered office and trading address is The Vicarage, Vicarage Road, Crawley Down, RH10 4JJ.
We are registered with the Information Commissioner's Office (ICO) as a data controller. Our registration number is Z1874861.
This policy explains how we handle personal data when you:
- visit our websites, including vcdesk.app and any subdomains (the "Website");
- sign up for, use or manage a VCDesk account as a customer, agent, administrator or reseller partner;
- contact us for sales, support or any other reason.
VCDesk is often supplied by independent reseller partners under their own brand. If you use a helpdesk provided by one of our partners, that partner's privacy notice also applies. Section 2 explains who is responsible for what.
This policy is written for the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
2. Our role: controller or processor
We have two roles. They depend on whose data it is and why we hold it.
| Data | Who decides how it is used (controller) | Our role |
|---|---|---|
| Website visitors, enquiries, sign-ups | VCDesk | Controller |
| Account, billing and login details of customers, agents and reseller partners | VCDesk | Controller |
| Content inside a helpdesk: tickets, messages, attachments, end-customer contact details, knowledge base articles | The organisation running that helpdesk (our customer) | Processor (or sub-processor where a reseller sits in between) |
Where we are a processor, we handle helpdesk content only on our customer's documented instructions, under our Data Processing Agreement. If you raised a ticket with a business that uses VCDesk, that business is responsible for your data. Please contact them first about your rights. We will help them respond.
Where a reseller partner supplies VCDesk under its own brand, the partner is normally the processor to its customer, and we act as its sub-processor. The partner is also a separate controller for its own customer relationship and billing, unless it uses our managed billing (see section 6).
3. Personal data we collect
As a controller, we collect the following:
- Identity and contact data: name, job title, business name, business email address, telephone number.
- Account data: username, hashed password, passkey public credentials, two-factor settings, role and permissions, helpdesk subdomain and custom domain.
- Billing data: billing contact, billing address, VAT number, subscription plan and payment history. Card details are collected and held by Stripe, not by us. We see only the card type, last four digits and expiry date.
- Technical and usage data: IP address, browser and device type, operating system, log-in times, pages and features used, error logs and security events.
- Communications: emails, support tickets and other messages you send us, and your marketing preferences.
- Reseller partner data: company details, partner contacts, branding assets you upload, and records of the customer desks you manage.
As a processor, we hold whatever helpdesk content our customers choose to put into VCDesk. This usually includes end-customer names, email addresses, phone numbers and ticket content. Customers must not put special category data (such as health information) into VCDesk unless they have a lawful basis and appropriate safeguards.
We collect most of this directly from you. Some comes from your employer or reseller when they set up your agent account, from Stripe (payment status), and automatically from your device when you use the service.
4. How we use your data and our lawful bases
We only use personal data where UK GDPR gives us a lawful basis.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create and run your account, provide the service | Identity, account, technical | Contract |
| Take payments, issue invoices, keep tax records | Identity, billing | Contract; legal obligation |
| Provide customer and partner support | Identity, account, communications | Contract; legitimate interests (resolving issues efficiently) |
| Keep the service secure, prevent fraud and abuse | Technical, account | Legitimate interests (protecting our customers and platform) |
| Improve and fix the service using aggregated usage data | Technical, usage | Legitimate interests (product improvement) |
| Send service notices (security alerts, billing, changes to terms) | Identity, account | Contract; legal obligation |
| Send marketing to business contacts | Identity, marketing preferences | Legitimate interests, with an opt-out in every message (PECR corporate-subscriber rules); consent for sole traders and individuals |
| Comply with law, respond to lawful requests, defend legal claims | Any relevant data | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details of that assessment. You can object at any time (see section 10).
We do not sell personal data. We do not make decisions that have legal or similarly significant effects about you using solely automated means.
5. AI features
VCDesk offers optional AI features, such as suggested replies, summaries and ticket categorisation. They are switched off unless a customer turns them on.
- Shared-key AI add-on: when enabled, the relevant ticket content is sent to Anthropic (the provider of the Claude models) to generate the result. Under Anthropic's commercial API terms, this content is not used to train its models without permission. Anthropic deletes it within a limited period, currently up to 30 days, unless it is flagged for a trust and safety review.
- Bring your own key (BYOK): if a customer connects its own AI provider account, ticket content goes to that provider under the customer's own agreement with it. That provider is the customer's choice and responsibility.
AI output is a suggestion. An agent reviews it before it is sent to anyone. We do not use helpdesk content to train any AI model of our own.
6. Who we share data with
We share personal data only with the service providers we need to run VCDesk, and only as far as they need it. The sub-processors for helpdesk content are listed in Annex 2 of our Data Processing Agreement.
| Provider | What they do | Location |
|---|---|---|
| 20i Ltd (company 09775671) | Hosts the VCDesk application and database on a virtual private server; sends service emails | United Kingdom |
| Stripe Payments UK Ltd and its affiliates | Payment processing, subscriptions, invoices, and Stripe Connect for resellers who use managed billing | UK / EEA, with some processing in the USA |
| Anthropic, PBC | AI processing, only when a customer enables the shared-key AI add-on | USA |
Stripe also acts as an independent controller for some payment data, such as fraud checks, under Stripe's privacy policy.
We may also share data with:
- the reseller partner that supplies your helpdesk, where it needs the data to manage your service and billing;
- professional advisers such as accountants, lawyers and insurers, under confidentiality duties;
- authorities such as HMRC, the police or the ICO, where the law requires it;
- a buyer or investor, if we sell or restructure our business. They would be bound by this policy.
We will update this list before we add or replace a sub-processor. Customers covered by our Data Processing Agreement get advance notice and can object.
7. International transfers
The VCDesk application and database are hosted in the United Kingdom. Some sub-processors (Stripe, and Anthropic when AI is enabled) process data in the USA.
When personal data leaves the UK, we make sure one of these protections applies:
- the UK government has made adequacy regulations for the country, or for the recipient (for example, US organisations certified under the UK Extension to the EU-US Data Privacy Framework); or
- we have the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, in place with the recipient, backed by a transfer risk assessment.
You can ask us for a copy of the relevant safeguards.
8. How long we keep data
We keep personal data only as long as we need it.
| Data | How long |
|---|---|
| Account data | While the account is active, then deleted within 90 days of the subscription ending |
| Helpdesk content (as processor) | While the subscription is active. Available for export for 30 days after it ends, then deleted. Backups are overwritten within 90 days |
| Billing and tax records | 6 years from the end of the financial year they relate to (HMRC and Companies Act requirements) |
| Security and access logs | Up to 12 months |
| Sales enquiries that do not lead to an account | 2 years from last contact |
| Marketing preferences and opt-outs | Opt-outs kept indefinitely, so we do not contact you again |
We may keep data for longer if the law requires it or if we need it for a legal claim. Anonymised data, which no longer identifies anyone, may be kept for statistics.
9. Security
We use technical and organisational measures that suit the risk. They include:
- encryption of data in transit (TLS/HTTPS on every helpdesk domain);
- encryption at rest for the database and backups;
- logical separation of each customer's data within our multi-tenant platform;
- hashed passwords, optional passkeys and two-factor authentication;
- role-based access, so staff and agents see only what they need;
- regular backups and tested restore procedures;
- security patching of our servers and software.
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will tell the ICO within 72 hours where required, and we will tell you without undue delay where the law requires it. Where we are a processor, we will tell the affected customer so it can meet its own duties.
10. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased in some circumstances;
- restrict how we use your data in some circumstances;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability: receive data you gave us in a machine-readable format, where processing is based on consent or contract;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email privacy@vcdesk.app. We may need to verify your identity. We will respond within one month. We can extend this by two more months for complex requests, and will tell you if we do. We do not usually charge a fee.
If your request is about helpdesk content held for a business you dealt with, we will pass it to that business, because it is the controller.
11. Cookies
We use only the cookies we need to run the service:
| Cookie type | Purpose | Consent needed? |
|---|---|---|
| Strictly necessary | Keeping you signed in, security (CSRF protection), load balancing, remembering cookie choices | No (PECR exemption) |
| Payment | Stripe cookies on checkout and billing pages, to process payments and prevent fraud | No (strictly necessary for a service you asked for) |
| Analytics | [None at launch. If added, they will be off until you accept them] | Yes |
We do not use advertising or cross-site tracking cookies. If we add any non-essential cookies, we will ask for your consent first through a cookie banner. You can withdraw it at any time.
The VCDesk mobile app stores sign-in tokens on your device so you stay logged in. It does not use advertising identifiers.
Forms on VCDesk that use Cloudflare Turnstile are covered by the Turnstile Privacy Addendum.
12. Children, changes, contact and complaints
Children. VCDesk is a business service. It is not aimed at anyone under 18, and we do not knowingly collect their data as a controller.
Changes. We may update this policy. We will post the new version here with a new "last updated" date. We will email account holders about significant changes before they take effect.
Contact us. Voltex Computers Limited, The Vicarage, Vicarage Road, Crawley Down, RH10 4JJ. Email: privacy@vcdesk.app.
Complaints. Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.