How Vindox collects, uses, shares and retains personal data for clients, debtor-side contacts and website enquiries. It also sets out the rights that apply. We are not a law firm and do not provide legal advice.
Vindox is a commercial debt recovery service operating in England and Wales. We are engaged by businesses (creditors) to build evidence files and run recovery in relation to serious overdue commercial invoices.
Vindox is the trading name of VFVM LTD, a company registered in England and Wales under company number 14014509. For the purposes of data protection law, VFVM LTD trading as VINDOX is the data controller for the personal data described in this policy.
VFVM LTD trading as VINDOX is registered with the Information Commissioner's Office as a data controller under registration number ZC161805.
We collect and process personal data in connection with four distinct contexts.
When a business engages Vindox, we collect:
Performance of a contract (our engagement letter). We cannot provide the service without this data.
In the course of running a recovery, we process personal data relating to individuals at the debtor company. This may include:
Legitimate interests. Vindox has a legitimate interest in processing debtor contact data to carry out the recovery service on behalf of the creditor. The processing is necessary, proportionate and limited to commercial invoice matters. We do not contact individuals about consumer debts.
Where a matter is in active recovery, Vindox may make a brief telephone call to a debtor-side contact to confirm that written correspondence has been received and to restate the written deadline. The calls carry no substantive content. Any payment proposal, dispute or other response must be in writing. Written correspondence remains the primary channel and the standard record. Each call is confirmed to the debtor in writing on the same working day.
These calls are not recorded. No audio of these calls is captured, retained or stored. The personal data we process in connection with these calls is limited to the matter reference, the fact and date of the call, the name of the debtor-side contact spoken with (where known), the outcome of the call and the same-day written confirmation.
Legitimate interests. Vindox has a legitimate interest in confirming receipt of correspondence in commercial invoice matters and in maintaining an accurate written record of contact. The processing is limited to what is necessary for that purpose and is restricted to commercial debtors only. We do not contact individuals about consumer debts.
Future introduction of recording. Vindox may at a future date introduce the recording of these calls. If recording is introduced, this privacy notice will be updated before the first recorded call to set out the purpose, the legal basis, the retention period and the rights that apply. Recording will not begin until that update is published.
If you submit the suitability form or otherwise contact us via the website, we collect the information you provide (name, company, contact details, matter summary and any other details included in the form). This data is used solely to respond to your enquiry and assess whether your matter is suitable for Vindox.
Legitimate interests. We have a legitimate interest in processing enquiry data to assess and respond to potential client matters.
Vindox contacts businesses and professional advisers about commercial debt recovery for overdue business invoices. Outreach is directed only to people in their professional commercial role. We do not contact individuals as private persons and we do not handle consumer matters.
We select firms by sector and business profile where the type of business ordinarily invoices other businesses on commercial terms. We select contacts by role where the role is plausibly connected to invoicing, finance, payment control, ownership or professional referral. Every record carries a short written reason for why the contact was thought relevant.
For this purpose we may process:
We may collect those details from a firm's own website, public business directories, professional directories, trade listings, business events, LinkedIn profiles used in a business context, Companies House for corporate identity support, referrals, inbound enquiries or selected data providers reviewed for business-to-business use before any campaign.
Where it is available and relevant, we may also look at payment-practices data published under the Reporting on Payment Practices and Performance Regulations 2017 on GOV.UK. This is one input among several. It is not how contacts are selected.
We use this information to contact relevant businesses about commercial debt recovery, to contact professional advisers about referral conversations, to explain when commercial debt recovery may be suitable, to invite suitable businesses to submit an overdue business invoice for screening, to respond to enquiries, to manage replies, to record objections, to maintain suppression lists so that people are not contacted again and to measure campaign performance at a practical level.
We do not use special-category data for acquisition targeting. We do not use data from live recovery matters for acquisition. We do not sell prospect personal data.
Legitimate interests (UK GDPR Article 6(1)(f)). Vindox has a legitimate interest in contacting relevant businesses and professional advisers about commercial debt recovery. We balance that interest against the rights and expectations of the person contacted by using business-role targeting, limited data, a written relevance reason on every record, clear first-contact wording, a simple opt-out route and suppression records. A legitimate-interests assessment has been conducted specifically for this outreach activity and is available on request.
Where PECR applies, PECR governs the channel. Legitimate interests under UK GDPR does not override it. Where we make live marketing calls, numbers are screened against the Telephone Preference Service and the Corporate Telephone Preference Service, and against our own do-not-call records, before the call.
A note on payment-practices data. Payment-practices data is a behaviour signal only and does not prove any individual supplier is unpaid. Vindox does not assert or imply that any particular invoice is overdue with any particular debtor. Outreach is framed conditionally. Suitability is assessed only on the prospect's own description of their position in any reply.
Your right to object. You can object to direct marketing at any time. If you object, we will stop using your personal data for direct marketing. You do not have to give a reason.
Recipients may opt out of further contact at any time by reply to the email, by telling us on a call or by writing to [email protected]. The opt-out is processed promptly. Where you opt out we may keep limited details such as your name, company, email address, telephone number and the date of your objection on a suppression list. We keep those details only so that we do not contact you again by mistake.
Where your details came from. You can ask us where we obtained your business contact details. Where we hold that information, we will give you the source or the source category.
We use Cloudflare Web Analytics to understand aggregate website usage, such as page views, referral sources and basic performance information. We use this to improve the website.
We do not use analytics cookies for advertising or cross-site tracking.
This website may also load fonts and static assets from third-party content delivery services. Those services may receive limited technical information, such as IP address, browser details and the page requested, when your browser requests those files.
We do not sell, rent or trade personal data.
In the course of a matter, we may share data in the following limited circumstances:
These providers process personal data only to provide services to us and are not permitted to use it for their own marketing.
Where a provider processes personal data outside the UK or EEA, we rely on appropriate safeguards such as contractual protections and approved transfer mechanisms where required.
Where we receive debtor-side contact data from a client, we provide privacy information when we first contact the relevant debtor contact, unless an exemption applies.
Debtor contacts may also access this policy at any time through the Vindox website.
If you are an individual whose personal data we process, you have the following rights under UK data protection law:
To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month.
If you are a debtor contact and wish to object to Vindox holding your data, please note that our retention of correspondence and contact records is integral to the legitimate recovery process we are engaged to carry out. We will consider any objection on its merits and respond in writing.
If you are concerned about how we handle your personal data, you can complain to us directly. You do not have to go to the regulator first.
You can complain by email to [email protected], or by post to VFVM LTD trading as VINDOX, A1 Marquis Court, Team Valley Trading Estate, Tyne and Wear, NE11 0RU, United Kingdom. You can also use the contact form on this website. We accept a complaint however it reaches us.
We will acknowledge your complaint within 30 days of receiving it. We will then look into it without undue delay, keep you informed of progress and tell you the outcome with an explanation of what we have done.
You also have the right to complain to the Information Commissioner's Office at any time. You can reach the ICO at ico.org.uk or on 0303 123 1113. Complaining to us first does not remove that right.
We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Significant changes will be communicated to active clients directly.