Privacy policy
Last updated: May 2026Who we are
Vindox is a commercial invoice escalation service operating in England and Wales. We are engaged by businesses (creditors) to build evidence files and manage escalation processes in relation to serious overdue B2B invoices.
Vindox operates as a sole trader. For the purposes of data protection law, Vindox is the data controller for the personal data described in this policy.
Contact for data matters: contact@vindox.co.uk
What data we collect and why
We collect and process personal data in connection with three distinct contexts.
1. Client data
When a business engages Vindox, we collect:
- Name, job title and contact details of the client representative
- Company name, registered address and company number
- Invoice details, payment history and correspondence relating to the overdue matter
- Documents provided to support the evidence file (agreements, SOWs, delivery records)
Legal basis: Performance of a contract (our engagement letter). We cannot provide the service without this data.
2. Debtor data
In the course of managing an escalation, we process personal data relating to individuals at the debtor company. This may include:
- Names, job titles and email addresses of debtor-side contacts
- Correspondence received from or sent to those individuals
- Records of commitments made, deadlines set and responses received
Legal basis: Legitimate interests. Vindox has a legitimate interest in processing debtor contact data to carry out the escalation service on behalf of the creditor. The processing is necessary, proportionate and limited to commercial invoice matters. We do not contact individuals about consumer debts.
3. Website enquiry data
If you contact us via the website, we collect the information you provide (name, company, contact details, matter summary). This data is used solely to respond to your enquiry and assess whether your matter is suitable for Vindox.
Legal basis: Legitimate interests. We have a legitimate interest in processing enquiry data to assess and respond to potential client matters.
What we do not collect
- We do not use tracking cookies or advertising pixels on this website
- We do not collect data from social media platforms
- We do not handle consumer debt and do not process personal data relating to consumer debtors
- We do not collect payment card data — fees are invoiced separately
How long we keep data
- Matter files (client and debtor data) — retained for six years from the date the matter closes. This reflects the standard limitation period for contract claims in England and Wales.
- Website enquiry data — retained for 12 months from the date of enquiry, or until the matter is formally opened (at which point it becomes part of the matter file).
- Rejected or referred matters — contact data retained for 90 days from the date of the suitability decision, then deleted.
Who we share data with
We do not sell, rent or trade personal data.
In the course of a matter, we may share data in the following limited circumstances:
- With the client — we share matter file contents, escalation logs and outcome documents with the creditor who engaged us. This is inherent to the service.
- With a solicitor — if a matter proceeds to legal review, we prepare and deliver a legal-review file to the client's solicitor. The client directs this transfer.
- With Companies House — we use publicly available Companies House data to verify debtor entity status. No personal data is shared with Companies House.
We do not use third-party marketing platforms, CRMs with data-sharing arrangements, or cloud services that process data outside the UK or EEA without appropriate safeguards.
Your rights
If you are an individual whose personal data we process, you have the following rights under UK data protection law:
- Access — you can request a copy of the personal data we hold about you
- Rectification — you can ask us to correct inaccurate data
- Erasure — you can ask us to delete your data in certain circumstances
- Restriction — you can ask us to restrict processing in certain circumstances
- Objection — you can object to processing based on legitimate interests
- Portability — you can request your data in a portable format where applicable
To exercise any of these rights, contact us at contact@vindox.co.uk. We will respond within one calendar month.
If you are a debtor contact and wish to object to Vindox holding your data, please note that our retention of correspondence and contact records is integral to the legitimate escalation process we are engaged to carry out. We will consider any objection on its merits and respond in writing.
Complaints
If you are concerned about how we handle your personal data, please contact us first at contact@vindox.co.uk. We will aim to resolve any complaint promptly.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Significant changes will be communicated to active clients directly.