virtual-finder.com

Privacy Notice (UK GDPR)

This notice explains how Virtual Finder collects and uses your personal data, as required by Articles 13 and 14 of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. A Turkish translation is available: Gizlilik Bildirimi (UK GDPR); if the two differ, this English version prevails. If you are in Türkiye, please also see our KVKK Aydınlatma Metni (in Turkish).

The customer account system is not open yet. The parts of this notice about customer accounts (virtual-finder.com/hesap) apply once the account system opens. At present no account can be created, and no account data, account cookies or account emails are processed. We will update this notice when the account system opens.

1. Who we are

BOTONBOARD LTD, trading as “Virtual Finder”, is a company registered in England and Wales, company number 14955016, and is the controller of your personal data. For personal data collected through your own website or mailboxes (form submissions, email content and, on the E-Commerce plan, customer and order records), you as the site owner are the controller and we act only as your processor, on your instructions, to provide the service.
Registered office: 20 Wenlock Road, London N1 7GU, United Kingdom
Email: info@virtual-finder.com
WhatsApp: +90 541 410 14 53

2. The personal data we collect

  • Identity and contact data: your name, phone number and email address when you message us on WhatsApp or subscribe.
  • Customer data: the package you chose, subscription status, quotes, support messages and service requests.
  • Payment data: whether a payment was made, its amount and date. Card details are processed by our payment provider Stripe; we never receive or store your full card number.
  • Technical data: when you visit the site, your IP address, browser details, the pages you visit and the time of your visit are logged by our hosting server and by Cloudflare.
  • Customer account data: if you create an account on our account page, your verified email address; the account identifier your chosen sign-in provider (Google, Microsoft, GitHub, Apple) gives us and the name and email it shares; session times; the version of this notice shown to you; and your optional marketing consent. The account system does not store your IP address; security logs and anti-abuse counters use a pseudonym created with a random daily key. The key is deleted at the end of the day, after which the pseudonym can no longer be linked back to your IP address.
  • Order (work order) data: the package you choose, your description of the work, your domain name, any referral code, your acceptance of the contract and your choice of when the setup should start, and the order and payment status. You enter card details on Stripe's page; they never reach us.

When we host your website or mailboxes, we may process personal data contained in your content on your behalf. In that case you are the controller and we act as your processor.

3. Why we use your data and our lawful bases

  • To answer your enquiries and give quotes: steps taken at your request before entering into a contract (Article 6(1)(b)).
  • To set up and provide your subscription (website, hosting and email), take payments and send service notices: performance of a contract (Article 6(1)(b)).
  • To keep accounting and tax records: legal obligation (Article 6(1)(c)).
  • To keep the site and services secure and prevent misuse: our legitimate interests in running a secure service (Article 6(1)(f)).
  • To establish, exercise or defend legal claims: our legitimate interests (Article 6(1)(f)).
  • To create your customer account and verify your sign-in: performance of a contract and steps taken at your request (Article 6(1)(b)). Account security (rate limiting, pseudonymised event log): our legitimate interests (Article 6(1)(f)).
  • Offers and news by email: only with your consent (Article 6(1)(a) and PECR); you can withdraw it at any time on your account page.

If we ever want to use your data for a purpose that needs your consent, such as marketing messages, we will ask for it separately first, and you can withdraw it at any time.

Providing your contact and payment details is necessary to enter into and perform the contract; without them we cannot provide the service.

4. Who we share your data with

  • Stripe (payments): to take subscription payments.
  • Cloudflare (content delivery and security): to deliver the site, protect it from attacks and measure visits without cookies.
  • Hosting provider: Hetzner Online GmbH; the server is located in Finland (Helsinki data centre).
  • WhatsApp / Meta: to deliver your messages when you choose to contact us on WhatsApp.
  • Our professional advisers, such as accountants and lawyers, where necessary.
  • Public authorities, where the law requires it.
  • Google, Microsoft, GitHub, Apple: only if you choose to sign in with one of them, to verify your sign-in.
  • Resend (email delivery, USA): to deliver verification codes and account emails.
  • Cloudflare also runs the customer account system (Workers; data is stored in a PostgreSQL database reached through Cloudflare Hyperdrive).

We do not sell your personal data.

5. International transfers

Some of these providers process data outside the UK, for example in the United States, the European Economic Area or Türkiye. Where a country does not have UK adequacy regulations, we rely on appropriate safeguards such as the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on the UK Extension to the EU–US Data Privacy Framework where the recipient is certified. Our hosting provider’s server is in the European Economic Area, which is covered by UK adequacy regulations.

6. How long we keep your data

We keep personal data only as long as needed for the purposes above and to meet legal requirements, then delete or anonymise it.

  • Contract, invoice and accounting records: 6 years from the end of the financial year they relate to (UK tax law);
  • Support and WhatsApp messages: 2 years after the customer relationship ends;
  • Enquiries and quotes that did not lead to a contract: 1 year;
  • Hosted website and mailbox content: 30 days after the service ends;
  • Server and security logs: up to 90 days.
  • Customer account: until you delete it (immediately, with “Hesabımı sil” on your account page). Verification codes and sign-in links are deleted 1 day after they expire, sessions when they end, anti-abuse counters after 2 days, and pseudonymised security logs after 90 days.
  • Orders: kept as contract and invoice records for 6 years from the end of the financial year even if you delete your account, separated from the account (UK tax law).

7. Your rights

Under the UK GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased in certain circumstances;
  • restrict how we use your data in certain circumstances;
  • receive data you gave us in a portable format;
  • object to processing based on our legitimate interests;
  • withdraw consent at any time, where we rely on consent.

If you have a customer account you can download a copy of your data in a machine-readable format (JSON) with “Verilerimi indir” on your account page, and delete your account yourself with “Hesabımı sil”. Contract and invoice records we must keep by law are not affected by this deletion.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

To exercise your rights, contact us at info@virtual-finder.com. We will respond within one month, free of charge in most cases. We may need to confirm your identity first.

8. How to complain

If you are unhappy with how we use your data, please contact us first. You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.

9. Cookies

This site does not use advertising or tracking cookies. Cloudflare may set strictly necessary security cookies. Our full cookie information is in our Gizlilik ve Çerez Politikası (in Turkish).

The customer account pages (virtual-finder.com/hesap) use only strictly necessary sign-in cookies: __Secure-vf_oturum (session, up to 30 days), __Secure-vf_kod (email verification code, 10 minutes), __Secure-vf_baglanti (sign-in link emailed after too many failed attempts, 15 minutes),__Secure-vf_oauth (while signing in with Google, Microsoft, GitHub or Apple, 10 minutes) and __Secure-vf_donus (while completing an Apple sign-in, 2 minutes). They are set only when you start signing in and are never used for advertising, analytics or tracking you on other sites.

10. Changes to this notice

We may update this notice from time to time. The date below shows when it was last changed.

Last updated: 3 October 2026