Privacy Policy for VJM Writing Services

1. Who we are

VJM Writing Services provides regulatory compliance and claims strategy, marketing and product-page copywriting, and label compliance for supplement and nutraceutical brands across the UK, EU and US markets. We act as the compliance layer between scientific evidence and brand marketing. We are not a legal advisory service.

We are a UK-based sole trader, operating remotely and delivering all services online. VJM Writing Services is the data controller responsible for your personal data.
You can reach us at:

Email: info@vjmwritingservices.com
Post: Office 20606, 182-184 High Street North, East Ham, London E6 2JA, United Kingdom
Website: https://vjmwritingservices.com

2. The information we collect

From website visitors and enquirers. If you use a contact or enquiry form on our website (powered by Forminator) or by email, we collect the information you provide, typically your name, email address, business or company name, and details of your enquiry or project. Our website may also collect limited technical information (such as IP address and browsing activity) through cookies and analytics (see Section 9).

From clients. When you engage our services, we collect your business contact details and the information you provide during onboarding and delivery. This includes project materials such as marketing copy, product descriptions, campaign assets, testimonials and customer reviews, scientific references and product claims. Payment details are handled securely by our payment providers (Stripe and Wise). We do not store or have access to your card or bank account details.

Special-category information within client materials. Some client materials, particularly customer testimonials and product reviews for supplement brands, may contain health-related information about identifiable individuals (for example, references to symptoms or health experiences). Where this occurs, we process that information only on our client’s behalf and instructions, solely for marketing analysis and compliance review, acting as a data processor (see Section 5). We do not seek out or use this information for any other purpose. We do not deliberately collect special-category personal data about our website visitors or enquirers.

3. How we use your information

We use personal data to:

  • respond to enquiries and contact requests;
  • onboard clients and deliver our services, including compliance reviews, claims strategy, copywriting and label work;
  • manage payments and transactions through our payment providers;
  • operate, secure and improve our website; and
  • comply with our legal and regulatory obligations.

We only process personal data where we have a lawful basis to do so (see Section 4). We do not currently send marketing emails or operate a mailing list (see Section 8).

4. Legal basis for processing (UK/EU)

If you are in the UK or EU, we process your personal data under the UK GDPR and EU GDPR, relying on one or more of the following lawful bases:

  • Contractual necessity: to respond to your enquiry and to deliver the services you engage us for.
  • Legitimate interest: to operate, secure and improve our website and communications, where this is not overridden by your rights.
  • Legal obligation: where we must process data to meet legal, tax or regulatory requirements.
  • Consent: where you give it (for example, if you accept non-essential cookies, or opt in to any future updates). You may withdraw consent at any time by contacting info@vjmwritingservices.com.

5. Our role: controller and processor

We act in two capacities, and it matters which applies:

  • For personal data about our website visitors, enquirers and our own client contacts, we are a data controller, and this policy governs that data.
  • For the client materials we handle in delivering our services, including any personal data contained in testimonials, reviews and campaign assets, we act as a data processor on behalf of our business clients, who remain the controller of that data.

When we act as a processor, our handling of that data is governed by the data-processing terms in our client service agreement, not by this policy. In that role we process such data only on the client’s documented instructions and only to deliver the agreed work.

6. Sharing your data and our service providers

We do not sell, rent or trade your personal data.

We share information only where necessary to run our business, deliver our services, or comply with the law. The categories of service providers (processors) we rely on include:

  • Website hosting: Bluehost (our WordPress host).
  • Website forms: Forminator, which collects and stores enquiry-form submissions.
  • Email: Google (Gmail), for business email correspondence.
  • File storage and collaboration: Microsoft 365 and OneDrive.
  • Project and client management: Airtable and Notion.
  • AI-assisted processing: Anthropic (Claude); see Section 7.
  • Payments: Stripe and Wise (we do not access or store your payment details).
  • Analytics and cookie consent: Google Analytics (GA4) for website analytics, and Complianz for cookie-consent management (see Section 9).

We may also share data with trusted partners, subcontractors or collaborators who assist in delivering our services, all of whom are bound by confidentiality and data-protection obligations. Where we act as a subcontractor to another business, that business is the data controller and its own privacy terms apply.

Some of these providers are based outside the UK or EU. See Section 10 (International data transfers).

7. Automated and AI-assisted processing

We use AI tools, currently Anthropic’s Claude, to help us deliver our compliance and copywriting work efficiently. This may involve processing client-supplied materials (which can contain personal data, including the health-related information described in Section 2) through these tools. We choose providers that offer appropriate confidentiality and security safeguards and operate under data-processing terms consistent with this policy. Outputs are always reviewed by us; we do not use automated decision-making that produces legal or similarly significant effects on individuals.

8. Marketing communications

We do not currently send marketing emails or operate a mailing list. If we introduce newsletters or promotional communications in future, we will only send them to people who have opted in, will explain how your data is used at the point of sign-up, and will include an unsubscribe option in every message. We will update this policy before beginning any such activity.

9. Cookies and tracking

Our website uses cookies and similar technologies to help it function and to understand how visitors use it.

  • Essential cookies are necessary for the website to work and cannot be switched off.
  • Performance/analytics cookies are set through Google Analytics (GA4) to help us understand how visitors use the site so we can improve it. They collect aggregated usage data and are only set after you consent.
  • Preference cookies remember your settings, such as language or region.

We use Complianz to manage cookie consent and to display a cookie banner when you first visit the site. Through the banner you can accept all cookies, reject non-essential cookies, or set your own preferences, and you can change your choices at any time by reopening the banner. Non-essential cookies, including Google Analytics, are not set until you have given consent.

You can also manage or block cookies through your browser settings, though disabling essential cookies may affect how the site works.

10. International data transfers

Because we use global digital tools, some personal data may be transferred to or stored in countries outside the UK or EU, for example when we use Bluehost, Google, Microsoft, Anthropic, Stripe or Wise. Where data is transferred internationally, we rely on appropriate safeguards, which may include UK/EU-approved Standard Contractual Clauses, data-processing agreements with our providers, or providers certified under recognised frameworks (such as the UK Extension to the EU-US Data Privacy Framework, where applicable). For more detail on a specific transfer, contact us at info@vjmwritingservices.com.

11. Data security

We take appropriate technical and organisational measures to protect your personal data, including:

  • secure storage on reputable platforms (such as Microsoft 365 and OneDrive);
  • access limited to authorised personnel only;
  • account security and password protection on our internal tools; and
  • encrypted communications where available.

No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. If you send us materials, please do so from a secure device and network, and safeguard any passwords or access credentials associated with your accounts.

12. Data retention

We keep personal data only for as long as necessary for the purposes it was collected for:

  • Client and contract records: up to 6 years after the end of our working relationship, for legal, tax and accounting purposes.
  • Enquiry and contact-form data: up to 12 months, unless you go on to become a client. Enquiry-form submissions stored by our form tool are reviewed and cleared periodically.
  • Legal, tax or regulatory records: for as long as the law requires.

You can ask us to delete your data at any time, where we are legally able to do so, by contacting info@vjmwritingservices.com.

13. Your rights (UK/EU)

If you are in the UK or EU, you have the right to:

  • access the personal data we hold about you;
  • rectify inaccurate or incomplete data;
  • request erasure of your data (the “right to be forgotten”);
  • restrict or object to processing in certain circumstances;
  • withdraw consent at any time, where processing is based on consent;
  • data portability; and
  • lodge a complaint with your local data protection authority.

In the UK, that authority is the Information Commissioner’s Office (ICO): https://ico.org.uk.

To exercise any of these rights, contact info@vjmwritingservices.com. We will respond within one month, as required by law.

14. California privacy notice (CCPA/CPRA)

We do not currently meet the thresholds that trigger full compliance with the California Consumer Privacy Act (CCPA) or California Privacy Rights Act (CPRA). If you are a California resident and would like to make a data-related request (such as accessing or deleting your personal information), you can contact us at info@vjmwritingservices.com, and we will consider and respond to it in good faith.

15. Children’s privacy

Our website and services are not directed at children under the age of 16, and we do not knowingly collect personal data from anyone under this age. If you believe we may have inadvertently collected data from a minor, please contact us at info@vjmwritingservices.com and we will delete it promptly.

16. Updates to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services or legal obligations. The effective date at the top of this page will always show the latest version. If we make material changes, we will post a clear notice on our website.

17. Contact us

If you have any questions, concerns or requests about this Privacy Policy or how we handle your personal data, contact us at:

Email: info@vjmwritingservices.com
Post: Office 20606, 182-184 High Street North, East Ham, London E6 2JA, United Kingdom

We aim to respond within 5 business days.

Comments

Suggested text: When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

Suggested text: If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Cookies

Suggested text: If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Suggested text: Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

Suggested text: If you request a password reset, your IP address will be included in the reset email.

How long we retain your data

Suggested text: If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

Suggested text: If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where your data is sent

Suggested text: Visitor comments may be checked through an automated spam detection service.