Privacy Policy

1. Who I am

The Hybrid VA is a sole trader business operated by Rory Manning, based in Peterborough, United Kingdom. I provide virtual assistant services (admin support and tech help) to small business owners across the UK. The business previously traded as Virtually Rory until May 2026.

For the purposes of UK GDPR and the Data Protection Act 2018, I am the data controller for personal data collected through this website and through my services.

Registered with the Information Commissioner’s Office (ICO). Registration number: ZB747045.

2. What data I collect

Data you give me directly

When you get in touch, book a call, sign up to my newsletter, or become a client, you provide information such as:

• Name and business name
• Email address and phone number
• Website URL and any relevant business details
• The content of your message or enquiry
• Billing details if you become a paying client
• Login credentials and access details needed to do the work (shared via LastPass, never by email)

Data collected automatically

When you visit this website, my own visitor tracking system records basic technical information:

• Page URLs visited and timestamps
• Referring website (if any)
• Browser type and device information
• A truncated or hashed version of your IP address for analytics purposes

This is a first-party system running on my own hosting. I do not use Google Analytics, Meta Pixel, or any other third party tracking on this site.

Cookies

This website uses a small number of essential and functional cookies. Full details are in my Cookie Policy.

3. How I use your data

I use your personal data to:

• Respond to enquiries and provide quotes
• Deliver the services you’ve asked me for
• Manage bookings and calendar scheduling
• Send invoices and process payments
• Send my newsletter and guides, if you’ve opted in
• Keep records for tax, accounting, and regulatory purposes
• Improve this website and understand how it’s being used
• Comply with legal obligations

I don’t sell your data. Ever. I don’t share it with advertisers, data brokers, or anyone else for marketing purposes.

4. Lawful basis for processing

Under UK GDPR, I need a lawful basis to process your data. Depending on the situation, I rely on one of the following:

• Contract. When you’re a client or prospective client, I process your data to provide the service you’ve asked for.
• Legitimate interests. For responding to enquiries, running basic website analytics, and keeping client records.
• Consent. For newsletter signups and any optional marketing. You can withdraw consent at any time. Where consent was previously given to Virtually Rory (the former trading name), that consent remains valid under The Hybrid VA, as the data controller is unchanged.
• Legal obligation. For keeping financial records required by HMRC and for complying with other UK laws.

5. Who I share data with

I only share data with third parties where it’s necessary to run the business. These are my current processors and service providers:

• Hostinger. Website hosting and email infrastructure.
• MailerLite. Newsletter and email marketing platform.
• Google Workspace. Email, calendar, and document storage.
• LastPass. Secure password and credential sharing.
• FreeAgent. Accounting and invoicing.
• My accountant. For tax and bookkeeping, where relevant.
• Payment processing. Payments are made by BACS bank transfer. FreeAgent is used to issue invoices and record payments.

Each of these has their own privacy policies and GDPR obligations. Some may process data outside the UK and EU, in which case appropriate safeguards (such as Standard Contractual Clauses) are in place.

I may also share data where legally required, for example in response to a court order or to meet regulatory obligations.

6. How long I keep your data

I keep your data only as long as I need it:

• Enquiry data. Up to 2 years from last contact, then deleted.
• Client records. For the duration of our working relationship, plus 7 years after the final invoice to meet HMRC requirements.
• Newsletter subscribers. Until you unsubscribe, or if you’ve been inactive for an extended period.
• Website analytics. Aggregated data kept for up to 24 months.
• Client credentials. Removed from LastPass access immediately on request, or at the end of our engagement.

7. Your rights

Under UK GDPR, you have the following rights regarding your personal data:

• Access. Ask for a copy of what I hold about you.
• Rectification. Ask me to correct anything that’s wrong.
• Erasure. Ask me to delete your data, where there’s no legal reason to keep it.
• Restriction. Ask me to limit how I use your data.
• Portability. Ask for your data in a machine readable format.
• Objection. Object to certain types of processing, including direct marketing.
• Withdraw consent. Where I rely on consent, you can withdraw it at any time.

To exercise any of these rights, email me at rory@thehybridva.co.uk. I’ll respond within one month.

If you’re not happy with how I’ve handled your data, you have the right to complain to the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113. I’d appreciate the chance to sort it out first, though.

8. Security

I take data security seriously. Measures in place include:

• All website traffic protected by SSL encryption
• Passwords and credentials shared only via LastPass, never by email or messaging
• Two-factor authentication on all business-critical accounts
• Full device encryption on all work devices
• Professional indemnity and cyber liability insurance
• NDAs signed on request for sensitive engagements

No system is completely secure, but I take reasonable steps to protect your data from unauthorised access, loss, or misuse.

9. Children

My services are aimed at business owners, not children. I don’t knowingly collect data from anyone under 18. If you believe a child has provided me with personal data, please get in touch and I’ll delete it.

10. Changes to this policy

I may update this policy from time to time. The “last updated” date at the top shows when it was last changed. Significant changes will be notified by email if you’re a client or newsletter subscriber.

The most recent update (May 2026) reflects the rebrand from Virtually Rory to The Hybrid VA. The data controller, ICO registration, and substance of the policy are unchanged.

11. How to contact me