Vendset

Data Processing Addendum

Effective 6 October 2026, version 2026-10-08

1. Scope and roles

This addendum forms part of the Terms of Service between LC Vending Limited ("Processor") and the Customer ("Controller"). It applies to personal data contained in Customer Data that we process to provide the Service, under UK GDPR, EU GDPR and equivalent laws ("Data Protection Law"). If you are a sole trader, this addendum applies to the personal data of your staff, customers and site contacts, and you remain the controller.

2. Details of processing

  • Subject matter and duration: providing the Service for the life of the agreement and the retention period in the Privacy Policy.
  • Nature and purpose: hosting, storing, displaying, transmitting and backing up Customer Data to operate machines, routes, stock, tasks, visits and tickets.
  • Types of personal data: names, business contact details, job roles, account identifiers, location and activity data generated in the course of field work, photos and notes.
  • Data subjects: the Customer's staff and drivers, customer and site contacts, and any other individuals the Customer records.

3. Our obligations

  • Process personal data only on the Controller's documented instructions (the Terms and the Customer's use of the Service), unless the law requires otherwise, in which case we will tell you first where allowed.
  • Ensure that people authorised to process it are bound by confidentiality.
  • Implement appropriate technical and organisational measures, including tenant isolation, encryption in transit and at rest, access control and logging, and regular security testing.
  • Assist with data subject requests, security, breach notification, impact assessments and consultations, taking into account the nature of processing.
  • Notify the Controller without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting Customer Data.
  • At the Controller's choice, delete or return personal data at the end of the services. Access is restricted immediately, live customer data is purged after the documented 30-day grace period, and encrypted backups expire within seven days, unless the law requires limited continued storage.
  • Make available the information reasonably necessary to show compliance and allow audits by the Controller (or a mutually agreed auditor), on reasonable notice, no more than once a year unless a breach has occurred, during business hours and subject to confidentiality. We may satisfy this by providing recent third-party audit or test summaries.
  • Tell the Controller if we think an instruction breaches Data Protection Law.

4. Sub-processors

The Controller gives general authorisation for the sub-processors listed at /subprocessors. We impose data protection terms on them no less protective than this addendum and remain liable for their performance. We will give 30 days' notice of changes; the Controller may object on reasonable data protection grounds, and if we cannot resolve it, end the affected service and receive a pro-rata refund.

5. International transfers

We will transfer personal data outside the UK or EEA only where permitted by Data Protection Law, using an adequacy decision or the UK International Data Transfer Agreement / EU Standard Contractual Clauses with the UK Addendum, which are incorporated by reference and apply to the extent a transfer requires them.

6. Liability and order of precedence

Each party's liability under this addendum is subject to the limits in the Terms of Service. If this addendum conflicts with the Terms on the processing of personal data, this addendum prevails.

7. Contact

Data protection contact: privacy@vendset.co.uk. A signed copy for your records is available on request.