Privacy Notice

Last updated: 18 September 2026

Who we are and how to contact us

VENDLOCUS LTD ("VendLocus", "we", "us") is the controller for the personal information described here. Company No. SC902846. Registered in Scotland. Registered Office: 48 West George Street, Glasgow, Scotland, G2 1BP. Website: vendlocus.co.uk. Privacy requests: info@vendlocus.co.uk. We provide a UK business-to-business matching and introduction service for locations and vending or automated retail operators.

This notice covers our website, Operator Requirements Form, Location Submission Form, enquiries, business research and relationship administration. VENDLOCUS LTD is registered with the Information Commissioner’s Office (ICO).

Information and sources

Operator forms collect business and contact names, business email, telephone where supplied, service-base postcode, coverage, equipment and product capabilities, preferred sites, travel radius, operating requirements, notes and acceptance of the introduction terms. Location forms collect site and contact names, business email, telephone where supplied, site address/postcode, location type, authority to act, staff/footfall estimates, hours, existing equipment, requested solutions, power/access, timing and notes.

Please provide business information only. Do not include sensitive information, children's details or unnecessary information about other people. Fields marked required are needed to assess or respond to the enquiry; without enough information we may be unable to proceed. Submitting an enquiry is voluntary and creates no statutory obligation to provide data. We also receive information in correspondence and from business representatives, operators or hosts involved in an enquiry.

Public-source business research uses company websites and official business registers, including Companies House. It can include trading identity, legal status, published business contact details, a relevant professional name/role where necessary, coverage and services, source URLs and collection/verification dates. Public availability does not remove privacy rights.

We do not use this process to seek private contact details or sensitive personal information. We hold enquiry and contact history, review/matching results, delivery failures, objections and suppression records, and records of any separately agreed introduction.

Website and form providers may process technical connection and security information to deliver their services.

Purposes and lawful bases

For enquiries, verification, duplicate prevention, relevant matching, introductions, service correspondence and relationship records, we rely on ordinary legitimate interests under Article 6(1)(f): operating an accurate, useful B2B introduction service and responding to business requests.

Where processing is necessary for a contract with you personally, or steps you request before that contract, Article 6(1)(b) applies; this does not automatically apply to an employee acting for a company. For carefully targeted B2B outreach to corporate subscribers, we may use public company information and generic corporate contact routes.

Where information identifies an individual, UK GDPR applies and we rely on an appropriate lawful basis, ordinarily legitimate interests where the documented three-part test is satisfied. Sole traders and uncertain or non-corporate subscribers are excluded from standard cold-email outreach unless a lawful route has been confirmed.

Individuals may object to direct marketing at any time. For security, troubleshooting, delivery-incident review and keeping records that prevent unwanted contact, we rely on legitimate interests in protecting the service and respecting contact preferences. We use Article 6(1)(c) where a specific legal obligation requires processing, including applicable accounting duties and responding to data-protection rights. We retain only what that obligation requires.

A form's terms acceptance is not consent to unrelated marketing.

Matching and sharing

Airtable rules assist with duplicate detection, postcode-based distance checks and recommendations based on coverage, equipment and stated requirements.

A person reviews proposed introductions; these recommendations do not guarantee a match or make a solely automated decision producing legal or similarly significant effects about you. After a potential match and internal review, an operator may receive a limited summary intended not to identify the host. If the operator is interested, any VendLocus fee and introduction terms are agreed in writing for that opportunity.

We then obtain confirmation from the location’s authorised representative before releasing the agreed identifying details. Host identity, exact address/postcode and personal contact details are withheld until this process is complete. Operators and hosts receiving details for an agreed introduction may act as independent controllers for their own dealings.

We do not sell contact lists.

Service providers and other recipients

We use Tally to collect and store form submissions; Airtable for intake, CRM, deduplication, matching and internal workflow; Google Workspace/Gmail for business email and internal alerts; and Carrd for the website. Postcodes.io receives postcodes for geographical lookup, not the form's contact name, email or full street address through that lookup. OpenAI tools support authorised administration and review.

Our research policy limits inputs to company information and anonymised material and excludes named-person enrichment. Providers and their relevant subprocessors receive information needed for their functions. Professional advisers and competent authorities may receive information when necessary for advice, claims or a legal obligation.

International processing

Our providers operate internationally, including in the EEA and the United States. We do not promise UK-only storage or access.

Tally is based in Belgium and states that form data is stored in Europe; its subprocessors may process technical information elsewhere. Carrd describes processing in the United States. Transfers covered by UK adequacy regulations can rely on that adequacy. Our accepted Google Workspace data-processing terms and executed Airtable data-processing agreement contain international-transfer provisions, including applicable contractual safeguards.

Tally’s data-processing terms also address subprocessors and international transfers. The mechanism depends on the recipient and the transfer; we do not represent every provider’s technical-data flow as UK-only or as using the same safeguard.

Some provider-specific technical-data and onward-transfer details remain under review. For the safeguards relevant to your information, or to request a copy with confidential material protected, contact info@vendlocus.co.uk.

Retention

Enquiry and matching information is normally retained for up to 24 months after our last meaningful contact, and removed sooner where no longer needed.

Uncontacted public-source personal-data prospects are reviewed within 30 days of collection for relevance, accuracy and the duty to provide privacy information, including the earlier applicable Article 14 deadline. Unnecessary information is removed; it is not retained indefinitely simply because it is public. Contract, fee, accounting and dispute evidence is kept only for the applicable legal record-keeping or claim period, or while a specific unresolved matter requires it.

Operational logs are retained only while needed for troubleshooting, security and accountability. We retain a minimal suppression record, such as the contact identifier, scope, reason and date of an objection or contact restriction, for as long as needed to prevent renewed unwanted contact. This can outlast other enquiry records. Suppression is not used as a prospect list.

Retention reviews must cover forms, CRM, email and working copies; a justified legal hold limits deletion only for the relevant material.

Your rights and marketing objections

You can object to direct marketing at any time. We will stop using your personal data for that marketing. Reply to the message or email info@vendlocus.co.uk; no account or fee is required to opt out.

A minimal suppression record may be kept to honour your choice. Subject to the conditions in UK data-protection law, you can request access, correction, erasure, restriction, portability and object to processing based on legitimate interests. If we rely on consent for a particular activity, you can withdraw it without affecting earlier lawful processing. Rights are not all absolute; we explain any lawful reason for refusing or limiting a request.

We may ask for proportionate identity information and normally respond within one month, subject to lawful extensions. For information obtained indirectly, we must actively provide privacy information within the applicable period, normally no later than one month, and earlier at first communication or disclosure where required.

Publishing this page alone is not treated as evidence that each researched individual has been informed.

Cookies and device storage

The Carrd website links to separately hosted Tally forms. Our review found no separate advertising or analytics script on the website, and neither form has a connected Google Analytics or Meta Pixel integration. Tally’s optional “Save answers for later” setting is disabled on both forms. The website has been observed using Cloudflare’s __cf_bm cookie for bot protection.

Cloudflare describes its expiry as 30 minutes of inactivity. This is provider security infrastructure; it is not an advertising integration. The Tally forms have been observed storing FORM_SESSION_2EWAkA or FORM_SESSION_pbEoVE and RESPONDENT in local browser storage. Tally describes these as supporting form-session state and recognising repeat submissions from a browser. Tally has told us that these entries have no fixed expiry and can remain until browser storage is cleared.

We therefore do not describe the forms as storage-free or all identifiers as anonymous. Tally also uses its own form-performance services and Sentry for error diagnostics. Tally states that Sentry is not sent the content of form answers. We are reviewing the remaining detail of these providers’ technical-data use, retention and applicable storage exceptions. No advertising purpose was identified in the reviewed configuration. Where a technology requires consent, it must not run before consent.

Any statistical-purpose exception has its own conditions, including information and a simple, free means to object; legitimate interests alone does not replace a PECR consent requirement. Contact info@vendlocus.co.uk with questions or objections about technical-data use, or to discuss your enquiry by email instead of the hosted forms.

Complaints and updates

You may complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

You can also raise a concern directly with us, without losing your right to complain to the ICO. We update this notice when our processing changes, show the revision date and bring material new uses to affected people where required. The current version is at vendlocus.co.uk/#privacy.