This privacy policy

This Privacy Policy tells you what to expect when iVendi collects your personal data. We are committed to complying with data protection legislation, as well as upholding your right to confidentiality and respecting your privacy. iVendi will take measures to ensure that the personal data we hold is accurate and secure.

What information do we collect?

We will collect, store and use the following kinds of personal information:

• Information you provide to us as part of an enquiry or complaint including your name, the company you work for and contact details.
• Information you provide to us when applying for a job with iVendi.
• Information relevant to customer surveys and/or offers.
• Any other information that you choose to share with us, for example as a result of a customer support enquiry.

Using your personal information

We require this information to understand your needs and provide you with a better service. We will use your personal information to:

• process and respond to your enquiry and/or complaint;
• process your job application;
• improve our products and services;
• process any individual rights request you send to us;
• periodically send promotional emails, special offers or other information which we think you may find interesting;
• deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you.
• use data analytics to improve the Website, products/services, marketing, customer relationships and experiences.
• create anonymised demographic, statistical data. It will not be possible to identify you individually once the data has been anonymised.
• occasionally contact you for market research purposes.

We may also receive some personal data indirectly, in the following scenarios:

• An employee of ours gives your contact details as an emergency contact or referee.
• A complainant or enquirer refers to you in their correspondence.

We will not provide your personal information to any third parties for the purpose of direct marketing without your consent.

When processing your personal data, we must have legal reason to do so. Generally, we collect and use your personal data where:

• You have entered a contract or are taking steps to enter into a contract.
• It is required by law.
• You, or your legal representative, have given consent.
• It is in our legitimate interests to do so.

Generally, we do not rely on consent as a legal basis for processing your personal data, but we will make it clear to you if we need to. We will get your consent before sending third party direct marketing communications to you via email or text message; you have the right to withdraw consent to marketing at any time by contacting us.

Who do we share your information with?

We may disclose your personal information:

• to the extent that we are required to do so by law;
• in connection with any legal proceedings or prospective legal proceedings;
• in order to establish, exercise or defend our legal rights, including providing information to others for the purposes of fraud prevention;
• due to a court order.

We use vetted and approved third party companies providing the following services for the Website.

Third Party: HubSpot

Purpose: Hosting and content management

Third Party: Amazon Web Services

Purpose: Cloud Hosted Infrastructure

Security of your personal information

We will take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.

Data is stored within secure data centres both in the United Kingdom and the European Union or a country providing adequate protection and appropriate safeguards in line with UK GDPR. All data is encrypted both when transmitted and when stored.

iVendi have successfully obtained certifications in the following:

• Cyber Essentials Plus
• ISO/IEC 27001
• ISO/IEC 20000-1
• ISO/IEC 9001

Policy amendments

We may update this privacy policy from time-to-time by posting a new version on our website. You should check this page occasionally to ensure you are happy with any changes. Any changes will be compliant with current Data Protection Legislation.

Your rights

As a Data Subject (person whose personal data is processed under this policy) you have several rights under current Data Protection Legislation, including:

Right to Access: You may instruct us to provide you with a copy of any personal information we hold about you.

Right to Rectification: you may request that incorrect personal information is corrected.

Right to Erasure: you may request that your personal data is erased where it is no longer needed for the purpose for which it was collected and another lawful basis for processing does not exists.

Right to object: you may object to processing of your personal data where legitimate grounds do not exist for processing.

Right to Restrict Processing: you may request that your personal data are not processed, rather than erased, where there are grounds to continue storing the data (e.g. for legal reasons or while a dispute is resolved) but you no longer wish your data to be processed.

Right to withdraw consent: You can withdraw your consent where we are relying on it to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Our Information Security and Compliance team will examine your request and respond to you as quickly as possible.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Data Retention Times

Links to other websites

Our website may contain links to other websites of interest. However, once you used these links to leave our site, we do not have any control over the third-party website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites, such sites are not governed by this privacy notice. You should exercise caution and look at the privacy statement applicable to the website in question.

Contact

If you have any questions about this privacy policy or our treatment of your personal data or wish to exercise your rights in relation to your personal data, please write to us by email to:

dpo@ivendi.com

Or by post to:

Data Protection Officer,
iVendi Limited,
Llys Eirias,
Abergele Road,
Colwyn Bay,
LL29 8BW.
Tel: +44 (0)345 226 0503

If you remain dissatisfied with how we have handled your personal data, you may wish to contact the Information Commissioner’s Office by:

• Post: Customer Contact, Information Commissioners Officer, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Telephone: +44 (0)303 123 1113
• Visiting the ICO website: www.ico.org.uk

We last updated this privacy notice on 9 th April 2024. We keep this privacy policy under regular review and update it if any of the information changes.