Privacy Policy

1. Who we are and our two roles

LC Vending Limited (company number 06829745), The Grove Trading Estate, Dorchester, Dorset, DT1 1ST, United Kingdom, trading as VendsetGO and Vendset, runs the VendsetGO platform. Contact: privacy@vendset.co.uk. ICO registration: ZA854121.

We act in two different roles, and this policy covers both:

• Controller for information about the people who create and use accounts (sign-in, billing, support, product use, marketing you ask for) and visitors to our websites.
• Processor for the operational data our business customers put into the platform about their own machines, sites, staff and customers. The customer decides why and how that data is used; we process it on their instructions under our Data Processing Addendum. If you are an individual whose data a customer holds (for example a site contact), contact that customer first; we will help them respond.

Our customers are businesses, including sole traders, limited companies and LLPs. For a sole trader, information about the business is also information about the individual, and this policy applies to it.

2. What we collect

• Account data: name, email, password (stored only as a hash), role, organisation, preferences, language and timezone.
• Business details: legal name, business type, registration and tax numbers, country, billing contact.
• Platform activity: actions taken in the product (an audit log), device and browser information, IP address, sign-in events and security signals such as failed logins.
• Customer content we process for you: machines, locations, sales and stock figures, tasks, visits, tickets, notes, photos and attachments, and contact details of your staff, drivers and site contacts.
• Mobile apps: device push tokens, app version, and optionally location or camera access if you choose to use features that need them.
• Support and enquiries: what you send us and our replies; machine fault reports submitted through public forms.
• Consent records: your acceptance of our terms and your cookie and marketing choices.

3. Why we use it and our legal basis

4. Who we share it with

We use carefully chosen service providers to run the platform (hosting, file storage, email, push notifications, abuse prevention and, when enabled, payments and the optional AI assistant). They process data only on our instructions. The current list is at /subprocessors, and we give customers notice before adding one.

We share data with integrations you switch on (for example a cashless payments or accounting provider), with professional advisers and insurers under confidentiality, and with authorities where the law requires. We do not sell personal data. If our business is sold or reorganised, data may transfer to the successor on the same terms.

5. International transfers

Some providers are in the United States or other countries outside the UK and EEA. Where that happens we rely on an adequacy decision or, failing that, on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses (with the UK Addendum), together with supplementary measures where needed. Ask us for a copy.

6. How long we keep it

• Account and sole-owned organisation data: access is restricted when deletion is requested and permanent deletion is scheduled after a 30-day grace period. You can download the final export or cancel during that period.
• Customer content: until the customer deletes it or closes the account, then within 30 days. Shared operational history may be pseudonymised and retained under the business customer's instructions.
• Audit and security logs: 30 days by default.
• Product and page analytics: up to 365 days.
• Billing and tax records: as long as tax and accounting law requires (typically six years in the UK).
• Consent decision evidence: up to six years after the final decision or account closure; associated IP address and browser metadata are removed after 30 days.
• Support correspondence: up to two years after the matter is closed.
• Generated privacy exports and encrypted organisation backups: seven days.

7. Your rights

Depending on where you live you can ask us to access, correct, delete, restrict or move your personal data, and object to processing based on legitimate interests or used for direct marketing. You can withdraw consent at any time (this does not affect earlier processing).

You can request a comprehensive export and schedule deletion from inside the product, or write to privacy@vendset.co.uk. We respond within one month. If you are unhappy, you can complain to your data protection authority, such as the UK Information Commissioner's Office (ico.org.uk); we would appreciate the chance to put things right first.

8. Security

We separate each customer's data, encrypt data in transit and at rest, hash passwords, restrict and log staff access, rate-limit and monitor sign-in, and test our controls, including tenant isolation. No system is perfectly secure. If a breach affects personal data we will notify affected customers without undue delay and, where required, the regulator within 72 hours of becoming aware.

To report a security concern, email security@vendset.co.uk.

9. Cookies

We use strictly necessary cookies to keep you signed in and secure. Optional product and website analytics is off unless you agree, and withdrawal is enforced by our servers as well as your browser. Details and your choices are in our Cookie Policy.

10. Children

The Service is for businesses and is not directed at anyone under 18. Account holders must be 18 or over. We do not knowingly collect children's data.

11. Changes to this policy

We will update this policy as our service or the law changes, show the version date above, and notify account owners of material changes.