Privacy policy

Who we are

Vindox is a commercial invoice escalation service operating in England and Wales. We are engaged by businesses (creditors) to build evidence files and manage escalation processes in relation to serious overdue B2B invoices.

Vindox operates as a sole trader. For the purposes of data protection law, Vindox is the data controller for the personal data described in this policy.

What data we collect and why

We collect and process personal data in connection with three distinct contexts.

1. Client data

When a business engages Vindox, we collect:

• Name, job title and contact details of the client representative
• Company name, registered address and company number
• Invoice details, payment history and correspondence relating to the overdue matter
• Documents provided to support the evidence file (agreements, SOWs, delivery records)

Legal basis: Performance of a contract (our engagement letter). We cannot provide the service without this data.

2. Debtor data

In the course of managing an escalation, we process personal data relating to individuals at the debtor company. This may include:

• Names, job titles and email addresses of debtor-side contacts
• Correspondence received from or sent to those individuals
• Records of commitments made, deadlines set and responses received

Legal basis: Legitimate interests. Vindox has a legitimate interest in processing debtor contact data to carry out the escalation service on behalf of the creditor. The processing is necessary, proportionate and limited to commercial invoice matters. We do not contact individuals about consumer debts.

3. Website enquiry data

If you submit the suitability form or otherwise contact us via the website, we collect the information you provide (name, company, contact details, matter summary and any other details included in the form). This data is used solely to respond to your enquiry and assess whether your matter is suitable for Vindox.

Legal basis: Legitimate interests. We have a legitimate interest in processing enquiry data to assess and respond to potential client matters.

Website analytics

We use Cloudflare Web Analytics to understand aggregate website usage, such as page views, referral sources and basic performance information. We use this to improve the website.

We do not use analytics cookies for advertising or cross-site tracking.

This website may also load fonts and static assets from third-party content delivery services. Those services may receive limited technical information, such as IP address, browser details and the page requested, when your browser requests those files.

What we do not collect

• We do not use tracking cookies or advertising pixels on this website
• We do not collect data from social media platforms
• We do not handle consumer debt and do not process personal data relating to consumer debtors
• We do not collect payment card data — fees are invoiced separately

How long we keep data

• Matter files (client and debtor data) — retained for six years from the date the matter closes. This reflects the standard limitation period for contract claims in England and Wales.
• Website enquiry data — retained for 12 months from the date of enquiry, or until the matter is formally opened (at which point it becomes part of the matter file).
• Rejected or referred matters — contact data retained for 90 days from the date of the suitability decision, then deleted.

Who we share data with

We do not sell, rent or trade personal data.

In the course of a matter, we may share data in the following limited circumstances:

• With the client — we share matter file contents, escalation logs and outcome documents with the creditor who engaged us. This is inherent to the service.
• With a solicitor — if a matter proceeds to legal review, we prepare and deliver a legal-review file to the client's solicitor. The client directs this transfer.
• With Companies House — we use publicly available Companies House data to verify debtor entity status. No personal data is shared with Companies House.
• With service providers — we use selected service providers to operate the website, intake form, email and business communications. These currently include Cloudflare for website hosting, security and analytics, Tally for suitability form submissions and Google Workspace for email and business communications.

These providers process personal data only to provide services to us and are not permitted to use it for their own marketing.

Where a provider processes personal data outside the UK or EEA, we rely on appropriate safeguards such as contractual protections and approved transfer mechanisms where required.

How debtor contacts are informed

Where we receive debtor-side contact data from a client, we provide privacy information when we first contact the relevant debtor contact, unless an exemption applies.

Debtor contacts may also access this policy at any time through the Vindox website.

Your rights

If you are an individual whose personal data we process, you have the following rights under UK data protection law:

• Access — you can request a copy of the personal data we hold about you
• Rectification — you can ask us to correct inaccurate data
• Erasure — you can ask us to delete your data in certain circumstances
• Restriction — you can ask us to restrict processing in certain circumstances
• Objection — you can object to processing based on legitimate interests
• Portability — you can request your data in a portable format where applicable

To exercise any of these rights, contact us at contact@vindox.co.uk. We will respond within one calendar month.

Complaints

If you are concerned about how we handle your personal data, please contact us first at contact@vindox.co.uk. We will aim to resolve any complaint promptly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Significant changes will be communicated to active clients directly.