1. Controller
MX Hospitality B.V., trading as Vendira, Strevelsweg 700, 303 - A1991, 3083 AS Rotterdam, Netherlands, registered under KvK 82019487, VAT NL862307168B01, is the controller in respect of the processing described in section 3.
Data protection enquiries may be sent to support@vendira.co. We have not appointed a Data Protection Officer, as Article 37 does not require one.
2. Our roles
We act in two capacities, and different obligations follow from each.
- As controller, in respect of personal data relating to our customers and their users: account, contact, billing and usage data. Sections 3 to 9 concern this processing.
- As processor, in respect of data we retrieve from Amazon on a customer's instruction and hold in their account. The customer determines the purposes and means of that processing. We act on documented instructions and process it only to provide the service. Where that data includes personal data, our processing is governed by a data processing agreement available on request.
3. Categories of personal data
| Category | Source |
|---|---|
| Name and email address | Provided by you |
| Company name and country of establishment | Provided by you |
| Authentication records, including sign-in times and session data | Generated by the service |
| Billing status, subscription identifiers and invoice records | Stripe, and generated by the service |
| Correspondence with us | Provided by you |
| Enquiries submitted through the website, including name, email and any message | Provided by you |
Business records retrieved from Amazon on your instruction — orders, financial transactions, settlements, inventory, catalogue, advertising and traffic data — are processed in our capacity as processor. Such records are not directed at identifying individuals. Free-text fields supplied by Amazon, such as return comments, may contain personal data supplied by a buyer; we do not use that data for any purpose and it is deleted with the account.
We do not call Amazon operations that return buyer identity data, and do not request, receive or store buyer names, addresses or telephone numbers.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service, including authentication and account management | Article 6(1)(b) — performance of a contract |
| Billing, and collection of amounts due | Article 6(1)(b) — performance of a contract |
| Responding to enquiries and providing support | Article 6(1)(b), or Article 6(1)(f) where no contract exists |
| Maintaining the security and integrity of the service, including logging | Article 6(1)(f) — legitimate interests |
| Sending service messages relating to your account | Article 6(1)(b) — performance of a contract |
| Compliance with accounting, tax and other legal obligations | Article 6(1)(c) — legal obligation |
Where we rely on legitimate interests, our interest is in operating and securing the service. We have assessed that this does not override your interests or fundamental rights, and you may object under Article 21 as set out in section 9.
Provision of the data in section 3 is necessary to enter into and perform the contract. Without it we cannot provide the service.
5. Recipients
We disclose personal data to the categories of recipient below. Each processes it on our instructions under a written contract that meets Article 28.
- Hosting and infrastructure providers.
- Email delivery providers.
- Payment service providers.
- Professional advisers, and public authorities where required by law.
The identified sub-processors are listed on our Sub-processors page. We do not sell personal data and do not disclose it for the purposes of advertising.
6. International transfers
Personal data is hosted within the European Union. Where a recipient is established outside the European Economic Area, the transfer is made under the European Commission's Standard Contractual Clauses or on the basis of an adequacy decision. A copy of the relevant safeguards may be requested at support@vendira.co.
7. Retention
| Data | Period |
|---|---|
| Account and business data | For the duration of the contract, and 30 days after it ends |
| Authentication and security logs | 12 months |
| Invoices and accounting records | 7 years, as required by Dutch law |
| Enquiries that do not result in an account | 24 months |
| Backups | Up to 30 days, after which they are overwritten in the ordinary cycle |
Data is erased or anonymised at the end of the applicable period, other than where a longer period is required by law.
8. Erasure
You may request erasure of your account at support@vendira.co. On erasure, account and business data is deleted. Backups taken before the request are overwritten in the ordinary cycle described in section 7 and are not separately edited. Records we are required by law to retain, and enquiries submitted before an account existed, are retained for the periods stated in section 7 unless separately requested.
9. Your rights
Subject to the conditions in the General Data Protection Regulation, you have the right to:
- Request access to your personal data (Article 15).
- Request rectification of inaccurate data (Article 16).
- Request erasure (Article 17).
- Request restriction of processing (Article 18).
- Receive your data in a portable format (Article 20).
- Object to processing based on legitimate interests (Article 21).
Requests should be sent to support@vendira.co. We will respond within one month, which may be extended by two further months where Article 12(3) permits.
You have the right to lodge a complaint with a supervisory authority, in the Member State of your residence or place of work, or of the alleged infringement. Our lead supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), autoriteitpersoonsgegevens.nl.
10. Automated decision-making
We do not carry out automated decision-making producing legal effects or similarly significant effects within the meaning of Article 22.
11. Security
We apply technical and organisational measures appropriate to the risk, as required by Article 32. A summary is set out on our Security page.
13. Changes
We may amend this policy. The date of the current version is shown above. Where a change materially affects the processing described here, we will notify account holders by email before it takes effect.