1. Scope of this notice
This notice explains how VendRisk360 (“VendRisk360”, “we”, “us”) handles personal information when you visit www.vendrisk360.com or contact us through it. For this website we act as the data controller (or “business” or “data fiduciary”, depending on the law that applies to you).
It does not cover the VendRisk360 platform at app.vendrisk360.com. Information that customers and their vendors place in the platform is processed on the customer’s behalf under the customer’s agreement with us, including our data processing terms.
2. Information we collect
Information you give us
When you request a demo, contact sales or email us, we collect what you choose to provide, which may include:
- your name, work email address, company, job title or role, and country or region;
- details about your organization’s program, such as industry, approximate number of third parties, priorities, regulators or frameworks of interest and preferred time zone;
- the content of your message and any follow-up correspondence.
Please do not send sensitive personal information (such as health, financial account or government identification details) through our forms.
Free trial requests
When you request a free trial we also collect the operating model you choose, what you want to evaluate, your optional phone number, and the Trial Agreement you sign: your typed signature, the statements you confirm, the time, your IP address and browser. See section 4.
Information collected automatically
Like any website, our hosting and content delivery infrastructure records technical request data: IP address, date and time, requested page, referring page, browser type and approximate location derived from the IP address. We use this to deliver the site, keep it secure and diagnose problems. Our forms endpoint may also use your IP address briefly to limit abusive submissions.
Spam and bot protection on our forms
The Start trial, Book a demo and Talk to sales pages use Google reCAPTCHA to tell people from automated bots. When you open one of those pages, Google collects information about your device and how you use the page, such as your IP address, browser and device details, cookies Google has set, and your interaction with the page, and gives us a score for your submission. We use the score only to decide whether to accept the submission, and we do not store it. reCAPTCHA does not run on other pages of this website. Google’s Privacy Policy and Terms of Service apply to its processing.
3. How we use your information and our lawful bases
| Purpose | Information used | Lawful basis (GDPR / UK GDPR) |
|---|---|---|
| Responding to your demo or sales request, scheduling and follow-up | Form and correspondence data | Steps at your request before a contract, and our legitimate interest in responding to business inquiries |
| Preparing proposals, procurement and security review documents | Form and correspondence data | Steps at your request before a contract; legitimate interests |
| Operating, securing and troubleshooting the website, and preventing spam and abuse | Technical request data | Legitimate interests in running a secure website |
| Protecting our forms from spam and automated abuse with Google reCAPTCHA | Device and interaction data on the form pages, and the score Google returns | Legitimate interests in keeping our forms and inboxes free of automated abuse |
| Reviewing, providing and managing your free trial, including its emails | Trial request, account and activity data | Performance of the Trial Agreement, and steps at your request before a contract |
| Keeping the executed Trial Agreement and the trial’s history | Trial Agreement and lifecycle records | Legitimate interests in establishing, exercising or defending legal claims |
| Following up about your trial and a possible subscription | Contact and trial activity data | Legitimate interests; product news only with your consent |
| Complying with legal obligations and establishing or defending legal claims | Any of the above, as needed | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights and you can object at any time. Where the law requires consent (for example, for certain electronic communications, or under India’s Digital Personal Data Protection Act), we ask for it on the form, and you can withdraw it at any time by emailing privacy@vendrisk360.com. We do not add you to marketing lists because you asked for a demo or contacted sales.
We do not use your information for automated decision-making that has legal or similarly significant effects on you.
4. Free trials
A free trial runs in a separate trial environment for 14 days, unless we extend or end it earlier. When it ends, sign-in stops and the data in your trial workspace is kept for 30 days, then permanently deleted; we keep a record that the deletion happened. Please use synthetic or minimal data in a trial.
We keep your trial request, contact details and the trial’s history for up to 24 months after the trial closes, then anonymize them, unless you become a customer or ask us to erase them sooner. We keep the executed Trial Agreement, including your typed signature and the evidence of signing, for at least 7 years after the trial closes, because it records obligations that continue after the trial and may be needed to establish or defend legal claims; erasing your contact details does not remove it.
5. Cookies and your choices
This website does not use advertising trackers or social media pixels. It sets one strictly necessary cookie, vr360_consent, which remembers your cookie choices for 12 months. Optional cookies are grouped as functional, analytics and marketing, and none of them is set unless you allow that category. Today the site sets no optional cookies; if we add any, we will list them in the preferences panel and update this notice first.
On the Start trial, Book a demo and Talk to sales pages, Google reCAPTCHA may set or read its own cookie, _GRECAPTCHA, to protect those forms from automated abuse (see section 2). Because the forms cannot be protected without it, it is treated as strictly necessary and is listed in the preferences panel.
You can change your choices at any time with the round cookie button at the bottom left of every page, or here: . If your browser sends a Global Privacy Control signal, we treat it as an opt-out of marketing cookies.
6. Who we share it with
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only with:
- Service providers who process it on our behalf under contract, such as our cloud hosting, content delivery and email delivery providers, and the business email and productivity tools our team uses to respond to you;
- Google, which provides reCAPTCHA on our form pages and receives the device and interaction data described in section 2, under Google’s own Privacy Policy;
- Professional advisers such as lawyers and auditors, under duties of confidentiality;
- Authorities when required by law, or to protect our rights, users or the public;
- A successor organization in the event of a merger, acquisition or sale of assets, subject to this notice.
7. International transfers
We serve organizations in many regions, and our service providers may process information in countries other than yours, including the United States. Where the law requires it, we protect those transfers with recognized safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, and we assess our providers’ security. You can ask us for more information about these safeguards at privacy@vendrisk360.com.
8. Retention
- Inquiries and correspondence: kept while we are in discussion with you and for up to 24 months after our last contact, unless you become a customer (in which case your customer agreement applies) or ask us to delete them sooner.
- Free trials: trial workspace data is deleted 30 days after the trial ends; trial requests and contact details are anonymized 24 months after the trial closes; executed Trial Agreements are kept for at least 7 years (see section 4).
- Technical request logs: kept for a short period for security and troubleshooting, generally no longer than 90 days, unless needed to investigate an incident.
- We keep information longer only where the law requires it or to establish or defend legal claims.
9. Security
The website is served over encrypted connections (HTTPS with modern TLS), and access to inquiry data is limited to the team members who need it to respond. No method of transmission or storage is completely secure, but we work to protect your information with measures appropriate to its sensitivity. To report a security concern, email security@vendrisk360.com.
10. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy;
- correct inaccurate or incomplete information;
- delete your information;
- restrict or object to our processing, including processing based on legitimate interests;
- receive your information in a portable format;
- withdraw consent at any time, without affecting processing that took place before;
- not be discriminated against for exercising your rights; and
- complain to a data protection authority.
How to exercise them: email privacy@vendrisk360.com with your request. We will confirm receipt, may need to verify your identity (usually by replying from the email address you used with us), and will respond within the period the law allows you (for example, one month under GDPR, or 45 days under the CCPA, extendable where permitted). An authorized agent may submit a request on your behalf with proof of authorization.
11. Regional information
European Economic Area and United Kingdom
You may lodge a complaint with the supervisory authority in the country where you live or work, or where an alleged infringement took place. In the UK, this is the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first.
California (CCPA / CPRA)
In the past 12 months we have collected identifiers (such as name and email address), professional or employment-related information (such as company and job title), and internet or network activity information (technical request data), from you and your device, for the business purposes described in section 3. We disclose these only to service providers and the other recipients in section 6. We do not sell or share personal information, we do not use or disclose sensitive personal information for purposes that require a right to limit, and we have no actual knowledge of selling or sharing information of consumers under 16. You have the rights to know, delete and correct, and to opt out of sale or sharing (which we do not do).
India (Digital Personal Data Protection Act, 2023)
You may access a summary of your personal data and its processing, request correction, completion, updating or erasure, withdraw consent, and nominate another person to exercise your rights in the event of death or incapacity. For grievances, contact us at privacy@vendrisk360.com. If you are not satisfied with our response, you may approach the Data Protection Board of India.
Australia (Privacy Act 1988)
We handle personal information in line with the Australian Privacy Principles. You may request access to or correction of your information. If you have a complaint, contact us first at privacy@vendrisk360.com; if you are not satisfied, you may contact the Office of the Australian Information Commissioner (OAIC).
Other regions
If you are in another country, such as Canada, Singapore, the Philippines, New Zealand or a Gulf state, you may have similar rights under local law. Contact us and we will honor applicable requests.
12. Children
This website is intended for business professionals. It is not directed at children, and we do not knowingly collect information from anyone under 18.
13. Changes to this notice
We may update this notice from time to time. We will change the “Last updated” date above and, for significant changes, make the update clear on this page.
14. Contact us
For privacy questions or requests: privacy@vendrisk360.com. For general questions: info@vendrisk360.com.