Privacy policy

Who we are

The public demo of VNE PMO Toolkit for Microsoft Dynamics 365 (“the demo”) is provided by VNE Technologies (“we”, “us”), a business established in England and Wales. To confirm: legal entity name, company number and registered office.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the controller of the personal data described in this policy. To confirm: ICO registration number.

You can contact us about privacy at privacy@vne.example.

This policy covers the public demo only. When an organisation runs VNE PMO Toolkit for its own programme, that organisation decides how its data is used and its own privacy notice applies.

What we collect and why

The demo sign-in cookie

When you select “Try Demo as Admin”, our server sets one cookie, vne_session, so the pages you open know you are signed in as the demo administrator. It holds a signed token with the demo administrator's account number, a demo marker, an identifier for this demo site and the times the session started and ends. It contains nothing about you. Details are in our Cookie policy.

Your IP address, for security

Every request to the demo carries your device's IP address, which our hosting provider passes to our server. Our server uses it only to apply rate limits that stop the demo being overloaded or abused, for example a limit on demo sign-ins from one address in 10 minutes and limits on how often changes can be saved or the demo reset. These counters are kept only in the server's memory, are only consulted for a rolling window of up to one hour and are discarded when the service restarts.

The demo never writes your IP address to its database, its activity log or its own application logs. Our application logs record operational events, such as a reset or an error, without IP addresses, names or the content you enter.

Our hosting provider may keep standard request logs for the platform (for example the IP address, time, requested address and response code) to operate and secure its service. To confirm: the hosting provider's log retention period.

What you type into the demo

Anything you add or change, such as tasks, risks, comments, test results or names, is saved to the shared demo database so that the demo works as the real product does. Because the demo is shared, other visitors can see it until the next reset. The demo also keeps a version history and an activity log of changes, recorded under the demo administrator's name rather than yours.

Demo data resets every day at 00:00 UK time. The reset restores the original fictional programme and deletes visitor changes, their version history, the activity log and any uploaded files. Any visitor can also reset the demo sooner.

We don't want personal data in the demo. Please don't enter real names, contact details or confidential information about you or anyone else. If personal data is entered anyway, it is deleted at the next reset.

Files you upload

File uploads are switched off in the demo unless we turn them on for a particular event. When they are on, only images and PDF files up to 2 MB are accepted, they are visible to other visitors and they are deleted at every reset.

Information stored in your browser

The demo stores some settings in your browser, such as the workspace you last opened or the layout of the sidebar, so that the pages work as you expect. This stays on your device; it is not sent to us. Our Cookie policy lists each item.

If you contact us

If you email us, we use your email address and what you tell us to reply and to keep a record of the conversation.

What we don't do

• No analytics or usage tracking, no advertising and no third-party trackers or social media pixels.
• No third-party fonts, scripts or content delivery networks: the demo loads its fonts, icons and charts from its own address.
• No profiling and no automated decision-making about you.
• We don't sell or rent personal data.
• The demo can't send email or messages to other systems: those features are switched off.

Our lawful bases

Under the UK GDPR we rely on these lawful bases:

• Legitimate interests (Article 6(1)(f)) to provide the demo you ask for, to keep it secure and available for everyone, and to prevent abuse (the sign-in cookie, rate limits and security logs). We have balanced these interests against your rights: the information involved is minimal, short-lived and not used to identify or profile you.
• Contract (Article 6(1)(b)) where processing is necessary to provide the demo under our Terms and conditions.
• Legal obligation (Article 6(1)(c)) where we must keep or disclose information by law.
• Legitimate interests to answer your messages when you contact us.

We don't rely on consent for any processing in the demo, and we don't use cookies that need consent.

Who we share it with

• Our hosting provider, Railway, which runs the demo's servers and database on our behalf as a processor under its data processing terms. To confirm: the processor terms in place with Railway.
• Other visitors can see what you type into the shared demo until the next reset.
• Professional advisers, law enforcement or regulators, where the law requires it or to protect our rights.
• A buyer or successor if our business is sold or reorganised, under the same protections.

International transfers

The demo's data is processed in the hosting region chosen for this deployment. To confirm: the Railway region used for the demo. Our hosting provider is based in the United States, so some information, such as platform logs or support access, may be processed outside the UK.

Where personal data is transferred outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Addendum to the EU standard contractual clauses or the UK Extension to the EU–US Data Privacy Framework. To confirm: the transfer mechanism used.

How long we keep it

Security

The demo is served over HTTPS. The sign-in cookie is signed, can't be read by page scripts and is only sent to this site. Pages run under a strict content security policy that allows no third-party scripts, and the demo limits sign-ins, saves and resets from each address. Features that could send messages, change accounts or reach other systems are switched off. No system is completely secure, which is one more reason not to enter real data into a public demo.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you (access);
• ask us to correct it (rectification) or delete it (erasure);
• ask us to restrict how we use it;
• object to our use of it where we rely on legitimate interests;
• ask for it in a portable format, where that right applies.

To use any of these rights, email privacy@vne.example. There is no charge, and we reply within one month. The demo has no personal accounts, so we usually can't tell which content is yours: tell us what you entered and roughly when, and we will look for it and delete it before the next reset. After a reset, visitor content no longer exists.

If you are unhappy with how we have handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Children

The demo is a business tool for evaluating programme management software. It is not directed at anyone under 18, and we don't knowingly collect information from children.

Changes to this policy

We may update this policy when the demo or the law changes. We will change the “Last updated” date at the top of this page, and we will highlight significant changes on the demo's landing page.

Contact us

Privacy questions and requests: privacy@vne.example. Other legal matters: legal@vne.example.