# Legal

> Ward’s Privacy Policy, Terms of Service, Cookie Notice, Data Processing Addendum, subprocessor list, Acceptable Use Policy and responsible disclosure policy.

Policies and agreements for this website and the Ward service.

- [Privacy Policy](https://valvayn.com/legal/privacy/) — How Ward handles personal data: this website (no cookies, no analytics), business enquiries, and our role as processor when customers use the Ward service.
- [Terms of Service](https://valvayn.com/legal/terms/) — The terms that govern use of this website and of the Ward service, unless a separate signed agreement applies.
- [Cookie Notice](https://valvayn.com/legal/cookies/) — This website sets no cookies and uses no analytics or third-party resources. The Ward admin console uses only strictly necessary session cookies.
- [Data Processing Addendum](https://valvayn.com/legal/dpa/) — Ward’s Data Processing Addendum (GDPR and UK GDPR): roles, the metadata Ward processes, security measures, subprocessors, transfers, breach notification and deletion.
- [Subprocessors](https://valvayn.com/legal/subprocessors/) — Third parties that process personal data on Ward’s behalf, and services Ward connects to on the customer’s instruction that are not subprocessors.
- [Acceptable Use Policy](https://valvayn.com/legal/acceptable-use/) — What customers and users must not do with the Ward service, including monitoring beyond legitimate security purposes and attacking the service.
- [Responsible Disclosure Policy](https://valvayn.com/security/disclosure/) — How to report a security vulnerability in Ward: scope, rules for good-faith research, safe harbour and what to expect from us.
- [security.txt](https://valvayn.com/.well-known/security.txt) — Machine-readable security contact (RFC 9116).

---

Canonical: https://valvayn.com/legal/ · Markdown: https://valvayn.com/legal.md · Built: 2026-10-10