1. Scope of this notice
This notice explains how VendRisk360 (“VendRisk360”, “we”, “us”) handles personal information when you visit www.vendrisk360.comor contact us through it. For this website we act as the data controller (or “business” or “data fiduciary”, depending on the law that applies to you).
It does not cover the VendRisk360platform at app.vendrisk360.com. Information that customers and their vendors place in the platform is processed on the customer’s behalf under the customer’s agreement with us, including our data processing terms.
2. Information we collect
Information you give us
When you request a demo, contact sales or email us, we collect what you choose to provide, which may include:
- your name, work email address, company, job title or role, and country or region;
- details about your organization’s program, such as industry, approximate number of third parties, priorities, regulators or frameworks of interest and preferred time zone;
- the content of your message and any follow-up correspondence.
Please do not send sensitive personal information (such as health, financial account or government identification details) through our forms.
Information collected automatically
Like any website, our hosting and content delivery infrastructure records technical request data: IP address, date and time, requested page, referring page, browser type and approximate location derived from the IP address. We use this to deliver the site, keep it secure and diagnose problems. Our forms endpoint may also use your IP address briefly to limit abusive submissions.
3. How we use your information and our lawful bases
| Purpose | Information used | Lawful basis (GDPR / UK GDPR) |
|---|---|---|
| Responding to your demo or sales request, scheduling and follow-up | Form and correspondence data | Steps at your request before a contract, and our legitimate interest in responding to business inquiries |
| Preparing proposals, procurement and security review documents | Form and correspondence data | Steps at your request before a contract; legitimate interests |
| Operating, securing and troubleshooting the website, and preventing spam and abuse | Technical request data | Legitimate interests in running a secure website |
| Complying with legal obligations and establishing or defending legal claims | Any of the above, as needed | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights and you can object at any time. Where the law requires consent (for example, for certain electronic communications, or under India’s Digital Personal Data Protection Act), we ask for it on the form, and you can withdraw it at any time by emailing privacy@vendrisk360.com. We do not add you to marketing lists because you asked for a demo or contacted sales.
We do not use your information for automated decision-making that has legal or similarly significant effects on you.
4. Cookies and analytics
This website does not use advertising trackers, social media pixels or third-party analytics cookies. We use only what is strictly necessary to deliver the site securely. If we ever introduce optional analytics or other non-essential cookies, we will update this notice first and, where the law requires it, ask for your consent before setting them.
5. Who we share it with
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only with:
- Service providers who process it on our behalf under contract, such as our cloud hosting, content delivery and email delivery providers, and the business email and productivity tools our team uses to respond to you;
- Professional advisers such as lawyers and auditors, under duties of confidentiality;
- Authorities when required by law, or to protect our rights, users or the public;
- A successor organization in the event of a merger, acquisition or sale of assets, subject to this notice.
6. International transfers
We serve organizations in many regions, and our service providers may process information in countries other than yours, including the United States. Where the law requires it, we protect those transfers with recognized safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, and we assess our providers’ security. You can ask us for more information about these safeguards at privacy@vendrisk360.com.
7. Retention
- Inquiries and correspondence: kept while we are in discussion with you and for up to 24 months after our last contact, unless you become a customer (in which case your customer agreement applies) or ask us to delete them sooner.
- Technical request logs: kept for a short period for security and troubleshooting, generally no longer than 90 days, unless needed to investigate an incident.
- We keep information longer only where the law requires it or to establish or defend legal claims.
8. Security
The website is served over encrypted connections (HTTPS with modern TLS), and access to inquiry data is limited to the team members who need it to respond. No method of transmission or storage is completely secure, but we work to protect your information with measures appropriate to its sensitivity. To report a security concern, email security@vendrisk360.com.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy;
- correct inaccurate or incomplete information;
- delete your information;
- restrict or object to our processing, including processing based on legitimate interests;
- receive your information in a portable format;
- withdraw consent at any time, without affecting processing that took place before;
- not be discriminated against for exercising your rights; and
- complain to a data protection authority.
How to exercise them: email privacy@vendrisk360.com with your request. We will confirm receipt, may need to verify your identity (usually by replying from the email address you used with us), and will respond within the period the law allows you (for example, one month under GDPR, or 45 days under the CCPA, extendable where permitted). An authorized agent may submit a request on your behalf with proof of authorization.
10. Regional information
European Economic Area and United Kingdom
You may lodge a complaint with the supervisory authority in the country where you live or work, or where an alleged infringement took place. In the UK, this is the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first.
California (CCPA / CPRA)
In the past 12 months we have collected identifiers (such as name and email address), professional or employment-related information (such as company and job title), and internet or network activity information (technical request data), from you and your device, for the business purposes described in section 3. We disclose these only to service providers and the other recipients in section 5. We do not sell or share personal information, we do not use or disclose sensitive personal information for purposes that require a right to limit, and we have no actual knowledge of selling or sharing information of consumers under 16. You have the rights to know, delete and correct, and to opt out of sale or sharing (which we do not do).
India (Digital Personal Data Protection Act, 2023)
You may access a summary of your personal data and its processing, request correction, completion, updating or erasure, withdraw consent, and nominate another person to exercise your rights in the event of death or incapacity. For grievances, contact us at privacy@vendrisk360.com. If you are not satisfied with our response, you may approach the Data Protection Board of India.
Australia (Privacy Act 1988)
We handle personal information in line with the Australian Privacy Principles. You may request access to or correction of your information. If you have a complaint, contact us first at privacy@vendrisk360.com; if you are not satisfied, you may contact the Office of the Australian Information Commissioner (OAIC).
Other regions
If you are in another country, such as Canada, Singapore, the Philippines, New Zealand or a Gulf state, you may have similar rights under local law. Contact us and we will honor applicable requests.
11. Children
This website is intended for business professionals. It is not directed at children, and we do not knowingly collect information from anyone under 18.
12. Changes to this notice
We may update this notice from time to time. We will change the “Last updated” date above and, for significant changes, make the update clear on this page.
13. Contact us
For privacy questions or requests: privacy@vendrisk360.com. For general questions: info@vendrisk360.com.