How Vitalex Ltd collects, uses, shares and protects personal information
1. About Vitalex Ltd
Vitalex Ltd is a company registered in England and Wales under company number 16068365. Our registered office is The Stamp Exchange, 7 Westgate Road, Newcastle upon Tyne, NE1 1SA. Our website is www.vitalexltd.co.uk.
2. Who is responsible for your personal information
For the personal information described in this policy, Vitalex Ltd generally acts as the controller. This means we decide why and how the information is used. In some supply-chain or service arrangements another organisation may act as an independent controller for its own purposes, for example a manufacturer, courier, waste contractor or healthcare organisation.
Data-protection enquiries or complaints can be sent to customerservices@vitalexltd.co.uk with “Data Protection” in the subject line, or by post to The Stamp Exchange, 7 Westgate Road, Newcastle upon Tyne, NE1 1SA.
3. The personal information we may collect
Depending on how you interact with us, we may collect:
- ▪ business contact details such as name, job title, organisation, work email address, work telephone number and business address;
- ▪ enquiry, quotation, sample, product-evaluation, tender and account-management information;
- ▪ order, delivery, invoice and payment-administration information, excluding full payment-card details where these are handled by a separate payment provider;
- ▪ supplier, manufacturer, logistics and professional-adviser contact information;
- ▪ preference cards, component lists, pack specifications and other files submitted to us;
- ▪ email correspondence, meeting notes, telephone-enquiry records and CRM activity;
- ▪ product complaint, quality, traceability, field-safety, recall and regulatory information where a named contact is involved;
- ▪ GreenCycle account, collection and sustainability-reporting contacts and related business records;
- ▪ website and device information such as IP address, browser information, security logs and information collected through cookies or similar storage/access technologies, depending on the technologies used and your choices;
- ▪ marketing preferences, opt-outs and suppression records; and
- ▪ other information you choose to provide to us.
Please do not send patient-identifiable information
Vitalex Ltd does not need or invite patient-identifiable information through ordinary website forms, quotation requests or commercial email. If a product-safety or complaint matter genuinely requires sensitive information, please contact us first so that an appropriate secure route and minimum necessary data can be agreed.
4. How we obtain information
We collect personal information directly from you, from your organisation, through our website and communications, and in some cases from legitimate professional or public sources such as organisation websites, procurement portals, professional directories, event attendee information or business-networking sources. We may also receive contact information from customers, suppliers, manufacturers, advisers or service partners where relevant to a business relationship.
5. Why we use personal information and our lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Respond to enquiries, arrange meetings, prepare quotations and provide samples | Legitimate interests in developing and managing business relationships; and, where the individual is contracting personally, steps requested before entering a contract. |
| Process orders, deliveries, invoices and customer or supplier administration | Legitimate interests in performing and administering B2B contracts; contract where the individual is personally a party; legal obligation where applicable. |
| Manage product specifications, complaints, traceability, recalls, field safety and regulatory cooperation | Legal obligation where applicable and legitimate interests in product quality, safety, traceability and regulatory compliance. |
| Manage suppliers, manufacturers, logistics, GreenCycle and professional services | Legitimate interests in operating and improving our supply and service arrangements; contract where applicable. |
| Maintain accounting, tax, corporate and compliance records | Legal obligation and legitimate interests in governance and defending legal claims. |
| Protect website, systems, users and business information | Legitimate interests in cybersecurity, fraud prevention, service availability and incident investigation. |
| Send relevant B2B marketing and business-development communications | Legitimate interests where permitted by data-protection and electronic-marketing law; consent where required. We provide a simple opt-out. |
| Use cookies and similar technologies | Consent where required. Certain technologies may be used without consent only where a statutory exception applies and its conditions are met. |
6. Business-to-business marketing
We may contact professional contacts about products, services, procurement opportunities or information we reasonably believe is relevant to their organisation, subject to UK data-protection and electronic-marketing rules. The rules differ between corporate subscribers and individual subscribers such as sole traders and some partnerships. Where consent is required, we will seek it. Every direct-marketing message will provide an appropriate way to opt out, and we keep suppression information so that we can respect opt-outs.
7. Cookies and similar storage/access technologies
Our website may use cookies, pixels, local storage and similar technologies. Some may be necessary for security or requested functionality. Other uses may require consent unless a statutory exception applies. Where the statistical-purpose or appearance exception is relied on, we will provide the information and objection mechanism required by law. Our separate Cookie and Storage Technologies Notice describes the technologies actually used on the live website, their purposes and the relevant controls.
8. Uploaded pack specifications and preference cards
Files submitted to us may contain confidential operational information and named clinician or employee details. We use them only for legitimate commercial, technical, quality and account-management purposes. Please remove patient identifiers before submission. Access is restricted to people who need the information for the relevant enquiry, quotation, evaluation or account.
9. Special-category and health information
We do not normally need special-category personal data. If sensitive information is provided in connection with a product-safety, complaint or regulatory matter, we will minimise the information, restrict access and identify an appropriate legal basis and special-category condition before using it where required. We may ask you to provide the information through a more secure channel.
10. Who we share information with
Where necessary for the purposes described above, we may share limited personal information with:
- ▪ our CRM provider, currently HubSpot, subject to the configuration and data flows used by Vitalex Ltd;
- ▪ website hosting, form, email, cloud-storage, backup, cybersecurity, analytics and IT service providers;
- ▪ manufacturers and approved suppliers where needed to quote, configure, investigate or support a product;
- ▪ couriers, freight, warehousing and logistics providers;
- ▪ Biffa, PHS Group and other approved GreenCycle or waste-service partners where relevant to service administration;
- ▪ accounting, banking, payment, insurance, legal, regulatory and professional advisers;
- ▪ public authorities, regulators, courts, law enforcement or other bodies where disclosure is required or permitted by law; and
- ▪ a purchaser, investor or adviser in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.
We do not sell personal information to advertisers.
11. International transfers
Some technology or service providers may process personal information outside the United Kingdom. Where this happens, we use a lawful transfer mechanism and appropriate safeguards where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, or another mechanism permitted by law. The exact transfer position depends on the providers and configurations in use and is maintained in our internal processor register.
12. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, contractual, product-safety, traceability, quality and regulatory requirements. Our retention schedule is reviewed periodically.
| Record type | Retention approach |
|---|---|
| General enquiries not converted to an account | Normally up to 24 months after the last meaningful contact, unless there is a reason to retain longer. |
| Customer, order, invoice and supplier commercial records | Normally 6 years after the relevant transaction or end of the relationship where needed for tax, accounting and legal-claims purposes. |
| Marketing contacts and preferences | While relevant to the business relationship; opt-out/suppression records retained as needed to honour the preference. |
| Website security logs | For a limited period proportionate to cybersecurity and incident-detection needs. |
| Product complaint, traceability, recall and regulatory records | For the period required by applicable medical-device law, quality-system requirements and relevant manufacturer/supply agreements; this may be longer than ordinary commercial retention. |
| Uploaded preference cards/specifications | For the active enquiry/account and thereafter in accordance with the approved commercial/quality retention schedule. |
13. Security
We use proportionate technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration or disclosure. Measures may include access controls, password and authentication controls, role-based access, supplier due diligence, secure backups, system updates, malware protection, confidentiality obligations and incident-management procedures. No system can be guaranteed completely secure, and we do not claim otherwise.
14. Your data-protection rights
Depending on the circumstances, you may have rights to request access, rectification, erasure, restriction, portability, objection to processing and withdrawal of consent. You also have an absolute right to object to direct marketing. Some rights are subject to statutory conditions and exemptions.
To exercise a right, contact customerservices@vitalexltd.co.uk with “Data Protection Request” in the subject line. We may need to verify your identity before acting on a request.
15. Data-protection complaints
If you are concerned about how we have used your personal information, please contact us first at customerservices@vitalexltd.co.uk. We will provide a clear complaints route, acknowledge a data-protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay.
You may also complain to the Information Commissioner’s Office (ICO). Current contact and complaint information is available from the ICO website. You do not have to complain to Vitalex Ltd before contacting the ICO.
16. Children
Our website and services are intended for professional and business use and are not directed at children. We do not knowingly use the website to collect personal information from children for marketing purposes.
17. Changes to this policy
We may update this policy to reflect changes in law, our website, service providers or business operations. The current version and last-updated date are published on the website.