This policy explains how Vendro Limited handles personal data across our website, checkout, portals and services.
This Privacy Policy explains how Vendro Limited collects, uses, stores, shares and protects personal data when you visit our website, contact us, create an account, subscribe to our services, use our customer portal, use our SaaS platform, receive support, use integrations or communicate with us.
This policy applies to Vendro Limited websites, portals, SaaS services, support services, customer relationship management, billing, marketing, partner services, self-hosted licence administration and related services.
This policy is intended to support our transparency obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It should be read together with our Terms & Conditions, Refund Policy, Cookie Policy and any Data Processing Agreement that applies to your organisation.
Vendro Limited is the controller for personal data we collect for our own business purposes, including website enquiries, billing, account administration, marketing, support, security, legal compliance and customer relationship management.
Where we process personal data inside the Vendro platform on behalf of a business customer, we may act as processor and the customer may act as controller. The customer is responsible for deciding what data is entered and for ensuring they have a lawful basis to process it. Where required, a Data Processing Agreement will set out our processor obligations.
Company: Vendro Limited
Company number: 17207190
Registered office: 2 Frederick Street, Kings Cross, London, WC1X 0ND
Privacy contact: privacy@vendro.uk
Support contact: support@vendro.uk
Security contact: security@vendro.uk
Billing contact: billing@vendro.uk
We may collect:
You must not upload health, biometric, criminal offence, highly sensitive, regulated or special category data unless your contract, configuration and lawful basis are suitable for that type of data and Vendro has agreed to support it in writing. Uploading such data without a written agreement may violate our Terms & Conditions and could result in account suspension or termination.
We may collect data when you: visit our website, submit a form, create an account, subscribe to a plan, complete checkout, use the customer portal, use the admin portal, create support tickets, communicate with us, use integrations, receive invoices, or use software and APIs.
We may also receive data from payment processors, hosting providers, email systems, integration providers, analytics tools, partners or authorised users in your organisation.
We use personal data only where we have a lawful basis. Where we rely on legitimate interests, we balance our interests against your rights and expectations. You can object to direct marketing at any time.
| Purpose | Examples | Lawful basis |
|---|---|---|
| Provide services | Account access, subscriptions, portal use, support, licensing | Contract / legitimate interests |
| Billing and payments | Invoices, receipts, payment status, renewals | Contract / legal obligation / legitimate interests |
| Customer support | Tickets, troubleshooting, account help | Contract / legitimate interests |
| Security and fraud prevention | Login logs, abuse prevention, audit logs | Legitimate interests / legal obligation |
| Legal and compliance | Tax records, company records, lawful requests | Legal obligation |
| Product improvement | Diagnostics, feature usage, error analysis | Legitimate interests - to improve our software, fix bugs and enhance user experience, using pseudonymised, aggregated or de-identified data where possible |
| Marketing to business contacts | Product updates, service information, offers | Consent or legitimate interests where legally permitted, including soft opt-in only where applicable |
| Cookies/analytics | Website analytics, preferences, non-essential tracking | Consent where required |
We may use personal data to: create and manage accounts, provide software and portal access, process subscriptions and renewals, issue licences, provision workspaces, provide support, respond to enquiries, send service messages, send invoices and receipts, manage refunds, maintain security, prevent fraud, monitor performance, improve products, and comply with legal obligations.
Vendro may provide both cloud/SaaS and self-hosted software models. For self-hosted deployments, operational business data may be stored on the customer's own server, VPS, database or hosting environment. The customer is responsible for securing, backing up and managing that environment unless a written agreement says otherwise.
For SaaS or Vendro-hosted services, Vendro may host and process customer data to provide the service, maintain security, generate reports, provide support and operate integrations. Customers remain responsible for the accuracy, legality and permission basis for data they enter into the platform.
We do not sell personal data. We may share personal data with:
We only share what is reasonably necessary for the relevant purpose.
Some of our service providers may process personal data outside the United Kingdom, including in the European Economic Area (EEA) and the United States.
Where this occurs, we use an applicable lawful transfer mechanism and assess the safeguards required for that provider, such as:
You may contact privacy@vendro.uk for a copy of the relevant safeguards.
We keep personal data only for as long as reasonably necessary for the purposes described in this policy.
| Data type | Typical retention |
|---|---|
| Enquiries and contact forms | 12 months |
| Customer account records | Account term + 6 years |
| Billing, tax and invoice records | 6 years (HMRC requirement) |
| Support tickets | 3 years after closure |
| Security and audit logs | 12 months |
| Marketing preferences | Until you unsubscribe + 6 months |
| Backup copies | Retention follows the applicable hosting configuration, plan and written agreement; contact privacy@vendro.uk for the current schedule |
| Contract records | 6 years after contract end |
We may retain data for longer if required by law, for litigation, or to enforce our rights.
Depending on the circumstances, you may have the following rights under UK GDPR:
Your right to object to processing based on legitimate interests is specifically brought to your attention. In particular, you have the right to object at any time to processing of your personal data for product improvement purposes. We will stop processing your data for that purpose unless we demonstrate compelling legitimate grounds.
Some rights may not apply in every situation, for example where we must keep data for legal, security, billing or contract reasons.
To make a privacy request, contact privacy@vendro.uk.
Our website may use cookies or similar technologies to make the website work, remember preferences, secure sessions, measure website usage, improve pages, and support marketing or analytics where enabled.
Strictly necessary cookies may be used without consent. Non-essential cookies (e.g., analytics, advertising, marketing) are only placed after you give consent via our cookie banner. You can withdraw consent at any time through your browser or our cookie settings.
We publish a separate Cookie Policy explaining what cookies are used, who sets them, what they do, how long they last and how users can manage consent.
We may send service messages about your account, subscription, security, invoices or support - these cannot be opted out of.
We may send marketing emails to business contacts where permitted by law, including soft opt-in for existing customers only where applicable, or where you have consented. You can opt out of marketing emails at any time by using the unsubscribe link or contacting us.
Opting out of marketing does not stop important service, billing or security messages.
We use reasonable technical and organisational measures, appropriate to the nature and risk of the processing, to protect personal data, including access controls, authentication, role permissions, audit logs, backups, secure configuration and operational monitoring where appropriate.
No system is completely secure. You are responsible for keeping your own passwords, admin users, API keys, devices and local environments secure. If you suspect unauthorised access or a security issue, contact security@vendro.uk promptly.
Vendro services are intended for business use and are not directed at children. We do not knowingly collect personal data from children for marketing or account registration.
Our websites and services may link to third-party websites, integrations or providers. Their privacy practices are controlled by their own policies. Vendro is not responsible for third-party privacy practices, service availability, data handling, charges or terms.
Vendro does not currently make decisions producing legal or similarly significant effects solely by automated processing. If this changes, we will update this policy.
We may update this Privacy Policy from time to time. The latest version will be posted on our website with the effective date.
If we make a material change, we will, where reasonably practicable, notify account holders in advance by email or through a prominent website or portal notice.
If you have a question, concern or complaint about how we handle personal data, please contact us first at privacy@vendro.uk so we can try to resolve it.
If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office (ICO) - the UK data protection regulator. You can find more information at https://ico.org.uk or contact the ICO helpline on 0303 123 1113.
Vendro Limited
Company number: 17207190
Registered office: 2 Frederick Street, Kings Cross, London, WC1X 0ND
Privacy email: privacy@vendro.uk
Support email: support@vendro.uk
Security email: security@vendro.uk
Billing email: billing@vendro.uk
