How Vindox collects, uses, shares and retains personal data for clients, debtor-side contacts and website enquiries. It also sets out the rights that apply. We are not a law firm and do not provide legal advice.
Vindox is a commercial debt recovery service operating in England and Wales. We are engaged by businesses (creditors) to build evidence files and run recovery in relation to serious overdue commercial invoices.
Vindox is the trading name of VFVM LTD, a company registered in England and Wales under company number 14014509. For the purposes of data protection law, VFVM LTD trading as VINDOX is the data controller for the personal data described in this policy.
VFVM LTD trading as VINDOX is registered with the Information Commissioner's Office as a data controller under registration number ZC161805.
We collect and process personal data in connection with four distinct contexts.
When a business engages Vindox, we collect:
Performance of a contract (our engagement letter). We cannot provide the service without this data.
In the course of running a recovery, we process personal data relating to individuals at the debtor company. This may include:
Legitimate interests. Vindox has a legitimate interest in processing debtor contact data to carry out the recovery service on behalf of the creditor. The processing is necessary, proportionate and limited to commercial invoice matters. We do not contact individuals about consumer debts.
Where a matter is in active recovery, Vindox may make a brief telephone call to a debtor-side contact to confirm that written correspondence has been received and to restate the written deadline. The calls carry no substantive content. Any payment proposal, dispute or other response must be in writing. Written correspondence remains the primary channel and the standard record. Each call is confirmed to the debtor in writing on the same working day.
These calls are not recorded. No audio of these calls is captured, retained or stored. The personal data we process in connection with these calls is limited to the matter reference, the fact and date of the call, the name of the debtor-side contact spoken with (where known), the outcome of the call and the same-day written confirmation.
Legitimate interests. Vindox has a legitimate interest in confirming receipt of correspondence in commercial invoice matters and in maintaining an accurate written record of contact. The processing is limited to what is necessary for that purpose and is restricted to commercial debtors only. We do not contact individuals about consumer debts.
Future introduction of recording. Vindox may at a future date introduce the recording of these calls. If recording is introduced, this privacy notice will be updated before the first recorded call to set out the purpose, the legal basis, the retention period and the rights that apply. Recording will not begin until that update is published.
If you submit the suitability form or otherwise contact us via the website, we collect the information you provide (name, company, contact details, matter summary and any other details included in the form). This data is used solely to respond to your enquiry and assess whether your matter is suitable for Vindox.
Legitimate interests. We have a legitimate interest in processing enquiry data to assess and respond to potential client matters.
Vindox identifies and contacts commercial decision-makers at UK limited companies and LLPs whose published payment behaviour or other public business information suggests they may be carrying a stalled commercial invoice. Outreach is directed only to people in their professional commercial role. We do not contact individuals as private persons and we do not handle consumer matters.
For this purpose we may process:
Legitimate interests (UK GDPR Article 6(1)(f)). Vindox has a legitimate interest in identifying commercial firms whose published behaviour signals a stalled-invoice pattern and in offering to assess whether the matter is a fit for the service. A legitimate-interests assessment has been conducted specifically for this outreach activity and is available on request.
A note on payment-practices data. Payment-practices data is a behaviour signal only and does not prove any individual supplier is unpaid. Vindox does not assert or imply that any particular invoice is overdue with any particular debtor. Outreach is framed conditionally. Suitability is assessed only on the prospect's own description of their position in any reply.
Recipients may opt out of further contact at any time by reply to the email or to contact@vindox.co.uk. The unsubscribe is processed promptly and the record is retained only to honour the opt-out.
We use Cloudflare Web Analytics to understand aggregate website usage, such as page views, referral sources and basic performance information. We use this to improve the website.
We do not use analytics cookies for advertising or cross-site tracking.
This website may also load fonts and static assets from third-party content delivery services. Those services may receive limited technical information, such as IP address, browser details and the page requested, when your browser requests those files.
We do not sell, rent or trade personal data.
In the course of a matter, we may share data in the following limited circumstances:
These providers process personal data only to provide services to us and are not permitted to use it for their own marketing.
Where a provider processes personal data outside the UK or EEA, we rely on appropriate safeguards such as contractual protections and approved transfer mechanisms where required.
Where we receive debtor-side contact data from a client, we provide privacy information when we first contact the relevant debtor contact, unless an exemption applies.
Debtor contacts may also access this policy at any time through the Vindox website.
If you are an individual whose personal data we process, you have the following rights under UK data protection law:
To exercise any of these rights, contact us at contact@vindox.co.uk. We will respond within one calendar month.
If you are a debtor contact and wish to object to Vindox holding your data, please note that our retention of correspondence and contact records is integral to the legitimate recovery process we are engaged to carry out. We will consider any objection on its merits and respond in writing.
If you are concerned about how we handle your personal data, please contact us first at contact@vindox.co.uk. We will aim to resolve any complaint promptly.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Significant changes will be communicated to active clients directly.