PRIVACY POLICY

Vendelux Privacy Policy 

Effective: April 18, 2025 

This Privacy Policy (the “Policy”) explains how Vendelux Inc. (“Vendelux” or “we”) collects information about businesses and business people (“Business Information”) and all other types of information, including personal information, through our online services (the “Services”), website, and mobile applications, if applicable (collectively with the Services, the “Site”); how we maintain, use, and share that information; and how you can take charge in managing information about you.

I. Overview

     A. What Does Vendelux Do?

Vendelux collects certain information relating to B2B conferences, events, trade shows and meetups (collectively, “Events”) such as the names of the Events, dates, locations, fees, website URL information, and other information about the Events. This Event information may also include information about: (i) entities who sponsor Events or are exhibitors at the Event (“Event Participants”); (ii) entities who organize events (“Event Organizers”); and (iii) individuals who attend or may attend such events (“Attendees”). Attendee information may include business contact and similar information related to individuals when they are working in their professional or employment capacity such as name, job title, city, region, country, organization, company size, Events associated with that Attendee, public speaking engagements, and top business topics associated with that Attendee. We provide this information to our customers, who may be businesses trying to decide which Events to sponsor and/or attend and who may also be trying to generate more leads at events by reaching business professionals for their own business-to-business sales, marketing, and recruiting activities.

     B. How Can You, as an Individual, Opt Out of Our Database?

You can opt out of our database by visiting our Privacy Center on our website. At the Privacy Center you can also submit an access request or claim your professional profile and update your profile information. The Privacy Center offers the fastest and easiest way to access, delete, or correct your information. Alternatively, you may email us at [email protected].

     C. What Are Potential Outcomes of Remaining In Our Database?

By remaining in our database, you may be contacted by our customers who are looking to network with other professionals at Events for industry knowledge sharing, learning and development or when they are conducting their business-to-business sales, marketing, and recruiting activities. While our customers may send you communications that may be relevant to your professional role or employment, we do not guarantee that you will find them to be relevant or interesting.

II. Highlights in Privacy Code of Conduct

In addition to any other restrictions in the Terms and Conditions (the “Terms”), you shall not access or use the Site or Services for any purpose except your business-to-business sales, marketing, recruiting, or business development activities in connection with business conferences, events or trade shows. 

If you access or use any Licensed Contact (defined below), you shall do so solely in accordance with the Terms and this Privacy Policy and for your own benefit in a professional capacity and not on behalf of any other person or entity. A “Licensed Contact” means a record regarding a natural person, consisting of at a minimum such person’s name or company affiliation, viewable in Vendelux’s database and made available to our customers as part of any of the Services. 

You will, at all times, act in compliance with all applicable local, state, federal and international laws, rules, and regulations, including, without limitation, any anti-SPAM laws (“Applicable Laws”). Subject to a customer’s compliance with Applicable Laws and the Terms and the payment of any applicable fees, such customer may use the Services during the Term to: (i) view the Licensed Materials; (ii) communicate with any Licensed Contact in a manner that relates to such person’s profession, business, or employment; and (iii) identify prospective sales opportunities, research a customer’s existing customers and prospects, and otherwise analyze the Licensed Materials in a manner relating to customer’s business-to-business sales, marketing, recruiting, and business development activities. It is your sole responsibility to ensure your own compliance with any contractual obligations and Applicable Laws in connection with your use of the Site and the Services (including use of any Licensed Contacts). You shall not, directly or indirectly, incorporate (or permit the incorporation of) any portion of the Site, Services or Licensed Materials into your own (or any third party’s) products or services. You are solely responsible for any communications between you and any Licensed Contact.

III. How Vendelux Collects Information

Vendelux collects data about Events, Event Participants, Event Organizers, Attendees, and other people and companies through multiple channels, including directly from Event Organizers as well as from the web, information provided by our users and customers, information licensed from other companies, and research from our in-house research team.

     A. Where does Vendelux get the Business Information for  its Professional and Business Profiles?

In connection with Events, Vendelux provides information about Attendees (“Professional Profiles”) as well as organizations such as Event Participants as well as Event Organizers (“Business Profiles”). Business Information in a Professional Profile may include an Attendee’s name, business or job title, organization or company name, email address, seniority level within the organization (e.g., C-Suite, VP and Director or Professional), names of Events and number of total Events associated with the Attendee as an expected or past participant, speaking engagements associated with the Attendee, top business event topics associated with the Attendee, company team members,  phone number, postal address of company and business-related postal address of the person, employment history, and education history. Business Profiles may also include links to articles by, about, or quoting an individual, and links to an individual’s social media profiles.

Vendelux obtains the data for its Business Information through several methods, which may include:

*We license information from other companies.

*At their option, our users and customers voluntarily contribute information about themselves or other people and companies. 

*We gather information through market research surveys, phone interviews, and other research conducted by our in-house research team.

*We receive data directly from Event Organizers.

*Our search technology scans the web and gathers publicly-available information.

     B. Customer Information 

Collection of Customer Information. Vendelux may collect the following information from or regarding its customers: (1) contact information regarding users of the Services (“User Information”); (2) information uploaded or otherwise provided to our system by a user of the Services (“Uploaded Information”); (3) usage logs regarding the use of the Site and Services, including logins and other actions taken, time stamps, IP address, device or other ID, and other usage data (“Usage Logs”); and (4) any other information from or relating to users of our Services (“Related Information”) (collectively, “Customer Information”).

Use of Customer Information. Vendelux may use Customer Information for legitimate business purposes, such as responding to inquiries and requests, completing transactions, and providing customer service, administrative information, and a personalized Site experience. Additionally, Customer Information may be used to understand users, enhance the Services and Site, contact customers and users regarding Vendelux services, promotions, opportunities, and general information, and investigate and prosecute potential security or license agreement breaches.

Vendelux may disclose Customer Information to a third party in the following circumstances:

• In connection with a legitimate use as set forth in this Policy;
• In connection with a bona fide legal dispute to which such information is relevant;
• In response to valid, compulsory legal process;
• In response to a valid data subject request where required by applicable law; or
• As otherwise required by law.

Whenever possible, Vendelux will obtain confidentiality obligations from any service provider to whom Customer Information is disclosed and ensure any recipient service providers are committed to employing appropriate technological security measures.

While Vendelux takes reasonable precautions to safeguard Customer Information through the use of security and back-up procedures, Vendelux is not responsible or liable for any loss or corruption of Customer Information. Users are advised to keep copies of all Uploaded Information on their own systems.

Vendelux may use aggregated and anonymized Customer Information for any legitimate business purposes, including, without limitation, for benchmarking, testing, research, promotional and informational purposes, such as identifying the most in-demand Events across all users or scoring which Events have the highest ROI across Vendelux’s client base. You hereby grant Vendelux an unlimited, perpetual and irrevocable right to use, reproduce and distribute such aggregated and anonymized Customer Information for any legal purpose.

     C. How else does Vendelux Collect Information? 

Information Submitted or Otherwise Collected Through our Site. By submitting information through this Site, including name, email address, phone number, and other details for account creation, service inquiries, event registration, surveys, contests, sweepstakes, job applications, or form completion (regardless of submission), users consent to the data practices outlined in this Policy. If you disagree with this Policy, do not submit any information, and delete all cookies from your browser cache after visiting the Site.

Managing Professional Profiles. Vendelux permits individuals to claim their Professional Profile and update their information. The submitted information will be used solely to verify identity, update the profile, and respect privacy preferences. 

Use of Vendelux Services. Registration may be required to use certain Vendelux Services. We may send emails about our products and services to users, but they will always have the option to opt out of these emails. We may also use email to communicate with users about their use of our Services or Site or if there are changes to this Policy. 

Information From and To Our Customers. The data we receive from or on behalf of our customers about their end users may include any type of data, but typically contains name, contact information, and company information, such as company name. We collect this data because of the nature of our Services. Additionally, we may automatically collect data through the use of our Services, as described in the “Cookies and Other Similar Technologies” section below. Generally, when we provide services to a customer, we function as a data processor, while the customer assumes the role of data controller. These roles are further elaborated in the sections below titled “When Vendelux is a Controller” and “When Vendelux is a Processor.”

Referring a Friend. If you invite a friend to join Vendelux, we will ask for their name and email address. We will then send an email to your friend inviting them to visit the Site.

Purchasing our Products and Services. To purchase our online subscription-based, software-as-a-service (“SaaS”) Services, you may need to (or choose to) provide credit card or other payment information. This information will be stored in an encrypted format and used solely to fulfill the purchase request. We will not sell, share, or reuse this information without prior consent. (The only exceptions are described in the sections below on “Disclosures to Service Providers,” “Disclosures for Legal Reasons,” and “Disclosures to a Buyer of the Company”).

Using Vendelux Integrations. Vendelux’s integrations allow Business Information from customer’s Customer Relationship Management (CRM), Marketing Automation Technology (MAT), or sales enablement software to be transmitted to Vendelux. This data may then be used for purposes of matching, correcting or cleansing the customer’s data against Vendelux’s database. In that event, Vendelux may retain and store such Business Information for purposes of identifying potential contacts to supplement the Services, verifying the accuracy of such Business Information, removing out-of-date Business Information from the Services, or otherwise improving Vendelux’s research processes and the content provided through the Services. Information so received may be difficult to attribute to one specific source, and we will not disclose the source of particular data, if available, except as required by law or with the customer’s consent. Any customer who wishes to opt out of Vendelux’s use of such information may do so by contacting Vendelux at [email protected]. 

From Third Parties. Vendelux may obtain personal information from third parties such as service providers and strategic partners to, among other things, enhance existing information, improve accuracy, or further the purposes described in this Policy.

Creation of Aggregated and Anonymized Data. Vendelux may collect and aggregate non-personally identifiable information about our users to better understand our customer base and enhance the Site and the Services provided by us and our strategic partners and customers.

Automated Information Collection. We also collect information using cookies and other similar technologies. See the “Cookies and Other Similar Technologies” section below.

IV. How We Use Information 

In addition to the uses described elsewhere in this Policy, we may also use Business Information and/or personal information for one or more of the following purposes:

• Provide, maintain, and improve the Site 
• Maintain, verify, update, and cleanse Business Information and other information provided through the Site or by other methods described in this Policy
• Deliver and provide the Services, process transactions, and send related information, including invoices and communications
• Deliver technical notices, updates, security alerts, and support and administrative messages.
• Provide customer service and support, which includes responding to questions, comments, and requests
• Establish Vendelux accounts and manage user logins
• Share news and information about Vendelux products, services, offers, promotions, rewards, events, and other opportunities
• Analyze and monitor usage, activity, and trends related to the Site and Services
• Send calendar invites when a user saves an Event
• Prevent, detect, and investigate fraudulent and other illegal activities
• Safeguard the rights and property of Vendelux, our customers, and others
• Enhance and personalize the Site and Services, including possibly by training Artificial Intelligence models
• Use personal information and other information we already have in order to draw inferences and make predictions regarding whether an Attendee is likely to attend an Event (e.g., a “Predicted” status for a particular Attendee at a particular Event)
• Announce significant changes to the Site, including updates to this Privacy Policy
• Administer and manage contests, sweepstakes, and other promotions, including processing entries and delivering rewards
• Communicate about potential employment and job applications, and consider individuals for employment with Vendelux
• Manage requests from people who want to access, correct, delete, or exercise other legal rights related to their personal information
• Create aggregated statistical data, inferred non-personal data, or anonymized or pseudonymized data (rendered non-personal and non-identifiable), which we or our business partners or customers may use to provide and improve our respective services
• Comply with our legal and contractual obligations, enforce our agreements and resolve user disputes
• Fulfill any other purpose communicated when the information was gathered
  

V. How Vendelux Shares Information 

Disclosures of Business Profiles. The Business Information that we may make available to our Site users, strategic partners, and customers includes information that: our users contribute to our Site; we gather from public web sources; we collect through market research surveys, phone interviews and other research that our in-house research team conducts; we license from third parties; we receive directly from Event Organizers; or we collect as otherwise described in this Policy.  If you provide information, including Business Information, to create or update a Professional Profile, it will be included on the Site and viewable by third parties.

Disclosures via Public Site. We make certain limited Business Information from Professional Profiles publicly available in our public Site. 

Disclosures to Service Providers. Vendelux may from time to time disclose Business Information or other collected information to service providers, solely for providing functions related to our operation of the Site and provision of the Services, including:

*using service providers to process credit card payments on our Site, including providing information such as name, billing address, phone number, email address, and credit card information to service providers for verification and to manage any recurring payments

*using software hosted by a service provider to provide us with information regarding our visitors’ activities on our Site such as individuals’ browsing activity on our Site

Disclosures to Integration Partners. Business Information from Vendelux may be disclosed to a customer’s CRM, MAT, or sales enablement software as requested or directed by our customers when such customers use Vendelux’s integrations, such as Vendelux’s Salesforce integration and web browser extensions.

Disclosures for Legal Reasons. If we believe in good faith that disclosure is necessary or desirable, we may disclose collected information, including Business Information, to a third party: (i) to comply with subpoenas, lawful requests, search warrants, or orders by public authorities, including to meet national security or law enforcement requirements; (ii) to address an actual or alleged violation of the law; (iii) to protect the property, rights, or safety of Vendelux, its users, or the public; (iv) to allow Vendelux to respond to a legal claim or exercise its legal rights; or (v) to respond to data subject requests for access to data to the extent necessary to comply with applicable laws.

Disclosures to a Buyer of the Company. In the event that Vendelux is acquired, merges with another company, or goes bankrupt, your information may be transferred as part of the company’s assets.

Other Disclosures. If you sign up for a Vendelux event that includes a third-party speaker, your personal information will usually be shared with the speaker, and any sponsors or partners involved with the event.

Customer testimonials, including customer names, may be displayed on our Site. Prior to posting a testimonial, we obtain customer consent. To update or delete their testimonial, customers should contact us at [email protected].

Our Site may offer publicly accessible blogs or community forums. You can request the removal of your personal information from our blog or community forum by contacting us at [email protected]. Please note that we may not always be able to remove the personal information, and in such cases, we will inform you of the reasons why. Any content provided in these areas may be read, collected, and used by others who access them.

VI. Cookies and Other Similar Technologies

Most websites, including ours, use browser cookies – small text files stored on your computer. This allows the website to recognize your computer on future visits, enabling features like auto login and user tracking of how the user is using the site.

Our servers, and those of our service providers, automatically collect certain information that your web browser sends when you visit our Site. This includes your web request, IP address, browser type, referring/exit pages and URLs, domain names, landing pages, pages viewed, time and date of use, page loads, clicks, and other data. This information may be linked to personal information you submit through our Site, which could allow you to be personally identified.

  Individuals can configure their browser settings to accept all cookies, reject all cookies, erase cookies, or receive notifications when a cookie is set. Please note that rejecting or disabling cookies may significantly limit your ability to use our Site. Vendelux may also utilize other technologies that serve similar functions as cookies. Please see Vendelux’s Cookie Policy for more information.

     A. Third Party Cookies

Use of Cookies and Similar Technologies by Third Parties

This policy does not cover the use of cookies and similar technologies by our partners, affiliates, tracking utility company, and service providers. These third parties may use session ID cookies to:

• Personalize visitor experiences
• Analyze visitor website page navigation
• Provide website features, including social sharing widgets
• Measure advertising effectiveness
• Track visitor website page navigation for remarketing purposes

We do not have access to or control over third party cookies.

To decline or disable third-party cookies, please go to the third-party’s website or adjust your browser settings.

     B. Google Analytics

Our Site uses Google Analytics, a web analytics service provided by Google, Inc. Google Analytics uses cookies and other tracking technologies to collect information such as IP address, time of visit, whether a visitor is a return visitor, and any referring website. This information is used to analyze how users interact with and use the Site, compile reports on the Site’s activity, and provide other services related to Site activity and usage. The information generated by Google Analytics is transmitted to and stored by Google and is subject to Google’s privacy policies. To learn more about Google’s partner services and how to opt out of tracking of analytics by Google, please click here.

     C. Web Beacons

Vendelux uses web beacons on its Site, along with cookies, to gather and analyze aggregated statistics on Site usage. Web beacons are also used in some emails to track which emails and links recipients open. This allows Vendelux to measure how effective its customer communications and marketing campaigns are.

     D. Your Advertising Choices and Control

Third parties may use cookies and similar tracking technologies to collect information and infer interests for interest-based advertising purposes on our Site. To opt out of receiving personalized ads based on browser or device usage and stop receiving tailored advertisements, individuals can generally express their opt-out preference. These individuals will still see advertisements, but the advertisements will no longer be tailored to their interests.

To stop receiving interest-based advertising from participating companies, please visit the following consumer choice mechanisms.

• European Interactive Digital Advertising Alliance’s consumer opt-out page (http://youronlinechoices.eu) 
• Digital Advertising Alliance’s self-regulatory opt-out page (http://optout.aboutads.info/) and mobile application-based “AppChoices” download page (https://youradchoices.com/appchoices) 

• Network Advertising Initiative’s self-regulatory opt-out page (http://optout.networkadvertising.org/) 

VII. Your Choices

     A. How to Change or Delete Your Professional Information

Vendelux has a self-service Privacy Center where people can claim and update their Professional Profiles, submit access requests, and opt out of our database.

Update Professional Vendelux Profile. People can keep their Professional Profiles current for those who may want to reach them by verifying and updating their Professional Profile. Please click here to view, verify, and update your Professional Profile.

Request Access to Information Vendelux has Collected. Those who want to access the information that Vendelux has collected about them can submit an access request by clicking here. After an individual’s identity has been verified, a report containing the collected information about that individual will be sent.

Remove Vendelux Profile Completely. To delete your Professional Profile and its data from our Services and Site, please click here. Your Professional Profile will be removed from our search results as soon as possible. If you are unable to, or choose not to utilize our Privacy Center, please submit a request to [email protected].

     B. How To Change or Delete Information About Events, Event Participants and/or Event Organizers

An authorized representative of a business can also use Vendelux’s Privacy Center to claim and update that business’s Business Profile. 

Update a Business Profile on Vendelux. An authorized individual can verify the relevant Business Profile to update details of an Event, company or organization, including descriptions, web address, industry, location of event or entity, and more. Please click here to update a Business Profile.

Removal of Business Profiles. Vendelux is a specialized directory focused on sharing information about corporate Events, Event Participants, Event Organizers and Attendees. As a company policy, Vendelux does not remove company information from our directory. If any company information is incorrect, please update that information here or contact us.

     C. How To Opt-Out of Certain Uses of Information

Individuals may opt out of having their personal information used for particular purposes by Vendelux. If you no longer want to receive our newsletter and promotional communications, you can opt out by following the instructions included in each newsletter or communication.  We will send a confirmation email to the requestor after we receive a request to unsubscribe that individual.

VIII. How Do We Keep Information Secure?
We are committed to meeting the level of security required by the GDPR by implementing appropriate technical and organizational measures to ensure a level of security that is appropriate to the risk involved in the processing of personal data. While we follow generally accepted industry standards to protect the information submitted to us, both during transmission and once we receive it, please note that no method of Internet transmission or electronic storage is 100% secure. We strive to safeguard your information using methods that are generally accepted in the industry; however, we cannot provide an absolute guarantee of security. For more information on Vendelux’s security practices, see the Vendelux Trust Center page of our website.

IX. Data Retention

We will keep personal information for as long as it is needed for the original reasons we collected it, as explained in this Policy, including keeping the information: (i) for as long as we have an ongoing relationship with the person the information is about; (ii) as long as it is needed to provide Services to users, our customers, or our partners; (iii) as required to follow our legal obligations; (iv) as needed to resolve disputes or protect ourselves from future disputes; or (v) as needed to enforce our agreements. The length of time personal information is kept will be based on the amount, nature, and sensitivity of the information, as well as why it was gathered. We will delete your personal information after the retention period. In cases where we are unable to comply with such requests, we will take appropriate steps to ensure that the information in question is not used in any other way.

X. Links to Other Sites

Vendelux does not own or control external websites that may be linked to on this Site. This Policy applies solely to information collected by this Site or as otherwise described in this Policy. Vendelux is not responsible for the privacy practices of other websites and encourages users to review the privacy statements of any website that collects personally identifiable information when they leave this Site.

XI. Information for Individuals Outside the U.S.

Please note that if you use our Site and you are located outside of the United States, your personal information may be collected, processed, and stored in the United States or other countries where we, our affiliates, or subcontractors maintain facilities. U.S. laws may differ from those in your location regarding personal information. Disclosures may be required by law enforcement, courts, or national security authorities in the U.S. or other jurisdictions holding the information.

A list of Vendelux’s sub-processors, their locations, and their processing activities is available here. Vendelux endeavors to comply with applicable international privacy laws and with the EU-US and Swiss-US Data Privacy Frameworks, including the UK Extension. Individuals elsewhere outside the U.S. with concerns or questions about our privacy practices not addressed in this Policy may contact us.

     A. Users in the European Economic Area (EEA), the UK, and Switzerland

This information pertains to residents of the European Economic Area, the United Kingdom, and Switzerland.

Vendelux is committed to comply with the provisions of the General Data Protection Regulation (“GDPR”) as to any information in its possession regarding EEA-, UK-, and Switzerland-based persons (“Data Subjects”). Vendelux processes personal data of Data Subjects only when it has a legal basis to do so, including consent of the individual, performance of a contract, compliance with legal obligations, or legitimate interests of Vendelux or a third party.

Vendelux provides notice to all data subjects as required by the GDPR, and honors the rights of data subjects provided by the GDPR, including the right to be forgotten. For any opt-out requests or other inquiries related to privacy, please visit our Privacy Center or email [email protected].

Purposes of processing and legal basis for processing: Our processing of personal information depends upon a Data Subject’s use of our Site, and is based on the following legal bases:

* consent;

* as necessary to perform our agreement to provide Services or other applicable agreements;

* as necessary to comply with a legal obligation; or

* as necessary for the legitimate interests of Vendelux and Vendelux’s customers and partners to engage in direct marketing, sales, and recruiting activities, and Vendelux’s legitimate interests in organizing and making available Professional Profiles and Business Profiles, given the limited impact that use of this Business Information and similar information presents to an individual’s private life.

Vendelux has implemented safeguards to protect personal privacy and individual choice, including disclosures of its data processing activities, the use of consent or opt-outs wherever possible, and the creation and maintenance of a Privacy Center. 

Right to File a Complaint: Data Subjects residing in the EEA, the UK, or Switzerland have the right to file a complaint with their relevant supervisory authority about our data collection and processing practices. Data protection authorities can be contacted here.

Transfers: Personal information may be transferred to, and stored and processed in, the United States or any other country in which we or our affiliates or subcontractors maintain facilities. In accordance with the applicable requirements of the GDPR, we will implement appropriate safeguards as described in Article 46 of the GDPR, such as the UK or EU Standard Contractual Clauses, as applicable, to transfers of personal information to a third country or an international organization.

Individual Rights: If you are a resident of the EEA, the UK, or Switzerland, the GDPR grants you specific rights. We may ask you to provide personal information to verify your identity before you can access any records containing your personal data.

• The right to access, correction, and restriction of processing. Data Subjects have the right to request access to, and a copy of, their personal information at no charge, as well as certain information about our processing activities with respect to their data. Data Subjects have the right to request correction or completion of their personal information if applicable. If Data Subjects dispute the accuracy of the data we possess about them, they have the right to restrict our processing of it while the data is verified.
• The right to data portability. Data subjects may request a copy of their data in a machine-readable format. Additionally, if technically feasible, they can ask that their data be sent directly to another designated entity.
• The right to request data erasure. Data Subjects may have their personal data erased from our Site if the data is no longer necessary for the purpose for which it was collected, they withdraw consent and no other legal basis for processing exists, or their fundamental rights to data privacy and protection outweigh our legitimate interest in continuing the processing.
• The right to object to our processing. Data Subjects may object to our processing if we are processing data based on legitimate interests or the performance of a task in the public interest as an exercise of official authority (including profiling); using data for direct marketing (including profiling); or processing data for purposes of scientific or historical research and statistics. 

When Vendelux is a Controller. Vendelux assumes the role of data controller when it collects and uses information about Data Subjects who visit our Site. Vendelux also acts as data controller when it collects and uses information about Data Subjects to create and maintain Professional Profiles, and to provide Services to its customers. Vendelux’s Data Protection Officer can be contacted by email at [email protected].

When Vendelux is a Processor. When our customers utilize our Services, they act as the data controller and are responsible for ensuring that any personal information collected about Data Subjects is processed in accordance with the law. In such cases, we function as a data processor, receiving personal information solely to process it as instructed by our customers, acting as their agents. Vendelux customers, as data controllers, are solely responsible for determining whether and how they wish to use our Services. Under applicable law, our customers are also responsible for addressing Data Subject rights requests made by their users and other individuals whose data they process through the Services. This Policy does not generally cover Vendelux’s obligations with respect to personal information for which we are solely a data processor. These obligations are defined in our agreements with our customers. In some cases, Vendelux may act as an independent controller of personal information in connection with its provision of the Services to customers, such as when customers agree to contribute data to our database.

     B. Data Privacy Frameworks 

While Vendelux primarily relies on Standard Contractual Clauses as the appropriate safeguard where necessary to ensure the lawful transfer of personal data, Vendelux also is committed to comply with the EU-US Data Privacy Framework (including the UK Extension) and Swiss-U.S. Data Privacy Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal data transferred from the EU, UK, and Switzerland to the United States. 

Vendelux aligns its practices with the Data Privacy Framework Principles. If there is any conflict between the terms in this Policy and the Data Privacy Framework Principles, the Data Privacy Framework Principles shall govern.  To learn more about the Data Privacy Framework program and any rights to binding arbitration before a Data Privacy Framework Panel, please visit https://www.dataprivacyframework.gov. To access the Data Privacy Framework List, visit https://www.dataprivacyframework.gov/list.

Vendelux will require third parties who receive personal information under the Data Privacy Frameworks from Vendelux to safeguard that personal information consistent with this Policy by contract, obligating those third parties to provide at least the same level of protection as is required by the Data Privacy Framework Principles. Vendelux may be liable to individuals if it fails to handle the onward transfer of their information to third parties in accordance with this Policy or the law.

In compliance with the Data Privacy Framework Principles, Vendelux commits to resolve complaints about our collection or use of your personal information. European Union, United Kingdom and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the Data Privacy Framework Principles should first contact Vendelux at [email protected]. Individuals located in Switzerland, the United Kingdom, and the European Union have the right to access personal data related to them. 

Under certain conditions, you may have the right to binding arbitration. Vendelux commits to refer unresolved privacy complaints concerning our handling of personal data received in reliance on the Data Privacy Framework Principles to JAMS (Judicial Arbitration & Mediation Services), an independent alternative dispute resolution provider located in the United States and recognized for this purpose by the US Department of Commerce. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. 

The Federal Trade Commission (FTC) has enforcement authority regarding Vendelux’s compliance with the Data Privacy Framework Principles. 

     C. Our Article 27 Representative

GDPR Local Ltd (GDPRLOCAL) has been appointed as Vendelux’s representative in the EU for data protection matters, pursuant to Article 27 of the GDPR. For individuals who are in the European Economic Area, GDPRLOCAL can be contacted in addition to our Data Privacy Officer only on matters related to the processing of personal data. Contact details are as follows: [email protected]; +353 15 549 700 (EU); EU address: Office 2, 12A Lower Main Street, Lucan Co, Dublin, K78 X5P8, Ireland. Contact details for UK residents are as follows: [email protected]; +441 772 217 800 (UK); UK address: 1st Floor Front Suite 27-29 North Street, Brighton England BN11EB.

XII. California Privacy Rights 

California residents can request details about any sharing of their personal information by Vendelux with third parties for direct marketing purposes. To submit a request, please contact us by mail or email at the address listed under “Contact Us” below.

XIII. Do Not Track Signals 

Vendelux’s information collection and disclosure practices, and the choices provided to visitors, will continue to operate as described in this Policy, whether or not a Do Not Track signal is received from your browser or device. 

XIV. Children’s Privacy

We do not direct or intend our Site for individuals under the age of 16. The Site does not knowingly collect or use any personal information from users under the age of 16. Individuals under the age of 16 should not submit any personal information to our Site. We will promptly delete the personal information if we discover that it was collected from a child under the age of 16. Please reach out to us at [email protected] if you believe that we have collected personal information of a minor under the age of 16.

XV. Changes to this Policy

As Vendelux reserves the right to modify this Policy from time to time, please review it regularly. If we make material changes to this Policy, We will provide notice by email and/or by posting a notice on our homepage prior to the changes becoming effective. By continuing to use the Site or Vendelux Services after any changes are made, you are agreeing to the updated Privacy Policy.

XVI. Contact Us 

For questions or concerns regarding this Privacy Policy or our privacy practices, please contact us at: 

Vendelux, Inc. 

Attn: Privacy 

115 West 30th Street, Suite 600

New York, NY 10001

Email: [email protected] 

Privacy Statement for Residents of Certain States

This Privacy Statement for Residents of Certain States (“Privacy Statement” or “Statement”) supplements the information contained in the Vendelux Privacy Policy. Vendelux has adopted this Statement to comply with the state privacy laws adopted in certain states, including the California Consumer Privacy Act, as amended (the “CCPA”) and other California privacy laws, the Colorado Privacy Act (“CPA”), the Connecticut Personal Data Privacy and Online Monitoring Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), and the Virginia Consumer Data Protection Act (“VCDPA”) (each individually a “State Privacy Law” and collectively, “State Privacy Laws”). This Statement applies solely to “consumers” as such term is defined in each respective State Privacy Law. 

Limited Applicability in Commercial or Employment Context 

Many state privacy laws, including the CPA, CTDPA, UCPA, VCDPA, and other similar legislation, do not apply to individuals where they are acting in a commercial or employment context (one notable exception is the CCPA in California). Therefore, these state privacy laws may have limited applicability to Vendelux’s activities with respect to residents of the states where these laws are in effect. “Personal Information,” as used in this Privacy Statement, is equivalent to the terms “Personal Data” or “Personal Information” as defined by the relevant State Privacy Law. The scope includes information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household and that is not deidentified, aggregated, or publicly available information, but only to the extent the Personal Information is not deemed excluded from the laws’ scope because of the Personal Information’s commercial or employment context or other applicable exclusions under the applicable State Privacy law. 

Please see the section “Other State Laws” for a discussion of rights under the CPA, CTDPA, UCPA, VCDPA, and similar legislation. 

Information Vendelux Collects

The section “How Vendelux Collects Information” in the Policy details the types of information Vendelux collects and how that information is collected. To the extent the CCPA requires that these details be reported according to specific categories, in the last twelve (12) months, we may have collected the following categories of Personal Information: 

Identifiers, such as name, Internet Protocol address, device or other ID, email address, including business and/or other email addresses, job title and department, phone numbers (general or direct business numbers, faxes, and/or mobile numbers), business-related postal address, and social networking URLs. 

Personal Information Categories Listed in the California Customer Records Statute, such as name, business address, telephone numbers (general or direct business numbers, faxes, and/or mobile numbers), education, employment and employment history.

Commercial Information, such as products or services purchased.

Internet or Other Similar Network Activity, such as Internet Protocol address and information on a consumer’s interaction with a website, application, or advertisement. 

Professional or Employment-Related Information, such as email address, including business and/or other email addresses, telephone numbers (general or direct business numbers, faxes, and/or mobile numbers), business-related physical address, current or past job history, and job title.

Inferences, which may be drawn from the information identified above to make predictions about your preferences and interests.

Sensitive Information, such as your Vendelux account login and password (if you are a Vendelux customer or user). Vendelux only uses or discloses sensitive information as is reasonably necessary and proportionate for the purposes specified in the CCPA regulations. 

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing prior notice. 

Categories of Sources

Vendelux collects personal information from the following categories of sources: 

• Publicly available information
• First-hand research
• Submissions from Vendelux’s customers or free users
• Third-party data providers
• Vendelux’s affiliates
• Directly and indirectly from activity or submissions on Vendelux’s website
• Directly and indirectly from our customers or their representatives
• Directly from vendors, Event Organizers and other third parties
• Through communications with prospective customers and other businesses and their representatives
• Any other sources described in our Privacy Policy under “How Vendelux Collects Information.”

Collection, Disclosure, Sharing, and Sale of Personal Information 

Vendelux collects, discloses, shares, and sells personal information for the following business and commercial purposes: 

• Provide, maintain, and improve the Site
• Verify, cleanse, update, and maintain Business Information and other information provided through the Site
• Provide and deliver the Services, process transactions, and send related information, including communications and invoices
• Send technical notices, updates, security alerts, and support and administrative messages
• Respond to comments, questions, and requests, and provide customer support
• Create Vendelux account(s) and identify users signing into their account
• Communicate about products, services, offers, promotions, rewards, and events offered by Vendelux and others, and provide news and information
• Monitor and analyze trends, usage, and activities in connection with the Site
• Detect, investigate, and prevent fraud and other illegal activities
• Protect the rights and property of Vendelux, our customers, and others ● Personalize and improve the Site and Services, including by training LLMs or other Artificial Intelligence models
• Provide notice of important changes to the Site, including changes or updates to this Privacy Policy
• Facilitate contests, sweepstakes, and promotions, process entries, and deliver rewards
• Consider persons for possible employment with Vendelux, and communicate about employment opportunities or submitted employment applications
• Create aggregated statistical data, inferred non-personal data, or anonymized or pseudonymized data (rendered non-personal and non-identifiable), which we or our business partners or customers may use to provide and improve our respective services
• Comply with our contractual and legal obligations, resolve disputes with users, and enforce our agreements
• Carry out any other purpose described at the time the information was collected or as otherwise set forth in the CPRA

Third-Party Recipients 

Vendelux may disclose personal information to the following third-party recipients for the business and commercial purposes identified above: 

• Vendelux affiliates
• Service providers
• Vendelux customers
• Vendelux partners
• Any other recipients described in our Privacy Policy under “How Vendelux Shares Information”

Sale, Sharing, and Disclosure of Personal Information 

We sell personal information collected for our database of business-related information to our customers. This database may contain information about consumers’ business personas including name, employer, job title and department, email address, phone number, office address, social media or professional profile link, and work or educational history. Vendelux licenses the information to its customers solely for business-to-business sales, marketing, and recruiting purposes. The information is sold subject to license agreements that restrict the use of this information to those purposes only.

The following categories of personal information were shared with or sold to Vendelux customers, partners, or affiliates over the past year:

• Identifiers
• Personal information categories listed in the California Customer Records statute
• Internet or other similar network activity
• Professional or employment-related information
• Inferences

Vendelux may also disclose personal information to its service providers to the extent that it is reasonably necessary for those service providers to perform business-related functions for Vendelux in connection with Vendelux’s operation of its business and provision of its products and services.

In the preceding twelve (12) months, we have disclosed for a business purpose the following categories of personal information to our service providers: 

• Identifiers
• Personal information categories listed in the California Customer Records statute 
• Internet or other similar network activity 
• Professional or employment-related information 
• Inferences 

Vendelux does not sell or share personal information of children under the age of 16.

The Right of a Consumer to Opt-Out of the Sale or Sharing of Personal Information 

Consumers can opt out of the sale or sharing of their personal information by Vendelux. Consumers may opt out of the sale of their own personal information by visiting our our Privacy Center (or emailing us at [email protected]) and submitting a request to remove the consumer’s profile or to delete the consumer’s data. 

Vendelux may also share your information with third parties for advertising and marketing purposes. Individuals can disable cookies to prevent the sharing of their information by visiting our Cookies Page. Vendelux complies with opt-out preference signals sent via the Global Privacy Control (“GPC”). To learn more about the GPC, including how to download and use the GPC, please visit the Global Privacy Control website. 

Other State Laws Residents of Colorado, Connecticut, Nevada, Utah, and Virginia may have the right to opt out of the processing of their Personal Information for purposes of sale or targeted advertising, subject to certain limitations. If you live in Colorado, Connecticut, or Virginia, you may also have the right to opt out of profiling. To exercise this right, please follow the opt-out instructions provided above.

Additional State Law Rights and Choices 

Consumers have specific rights regarding their personal information under State Privacy Laws. 

Access to Specific Information and Data Portability Rights

A consumer has the right to request that we provide certain information to that consumer about our collection and use of that consumer’s personal information over the past twelve (12) months. After confirming a consumer’s verifiable consumer request, we will disclose: 

• The categories of personal information we collected about that consumer.
  ● The categories of sources from which the personal information was collected.
  ● Our business or commercial purpose for collecting, selling, or sharing that personal information. 
• The categories of third parties to whom we disclose that personal information. 
• The specific pieces of personal information we collected about that consumer (also called a data portability request). 

Other State Laws Subject to certain limitations, residents of Colorado, Connecticut, Utah, and Virginia may have a right to confirm whether Vendelux is processing their Personal Information and to access their Personal Information. In less common situations, some residents may also have a right to obtain their Personal Information in a portable and, to the extent technically feasible, readily usable format. If you believe these rights apply to you, follow the instructions below to contact us. 

Correction Request Rights 

A consumer has the right to request that we correct personal information that we maintain about that consumer if it is inaccurate, taking into account the nature of the personal information and the purposes for which it is processed. Upon receiving and confirming a consumer’s verifiable consumer request, we will use commercially reasonable efforts to correct any inaccurate personal information. If necessary, we may require documentation to confirm the accuracy of the requested correction. We may deny the request if: 

1. We determine, based on the totality of the circumstances, that the contested personal information is more likely than not accurate as maintained.
   2. We determine that the requested correction would be impossible or would involve disproportionate effort. 
2. The requested correction is in conflict with federal or state law. 
3. We denied the same request to correct within the past six months and the consumer has not provided additional documentation in support of the request.
   5. We have a good-faith, reasonable, and documented belief that the request to correct is fraudulent or abusive. 

We will notify you of the action taken in response to your request, and if the request is denied, we will provide the reasons for the denial. A consumer may have the right to delete disputed data if their request to correct the information is denied, unless an exception applies.

Other State Laws If you are a resident of Colorado, Connecticut, Utah, or Virginia, you may have the right to request that we correct inaccurate Personal Information that we have about you, subject to certain limitations. If you believe this right applies to you, please follow the instructions below to contact us.

Right to Request Deletion 

A consumer has the right to request that Vendelux delete any personal information of that consumer that we have collected and retained, subject to certain exceptions. We will delete a consumer’s personal information from our records, and direct our service providers and/or customers to do the same, upon receiving and confirming the consumer’s verifiable consumer request, unless an exception applies.

We may deny a consumer’s request to delete if retaining the information is necessary for us or our service providers or customers to: 

1. Complete the transaction for which we collected the personal information, fulfill the terms of a product warranty or product recall conducted in accordance with federal law, provide a good or service that a consumer requested, take actions reasonably anticipated within the context of our ongoing business relationship with that consumer, or otherwise perform our contract with that consumer. 
2. Help to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for those purposes.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law. 
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.). 
6. Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the ability to complete such research, if a consumer provided informed consent. 
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on a consumer’s relationship with us and compatible with the context in which the consumer provided the information. 
8. Comply with a legal obligation. 

Other State Laws Residents of Colorado, Connecticut, Utah, and Virginia may have the right to request that we delete their Personal Information, subject to certain limitations. If you believe this right applies to you, follow the instructions below.

Exercising Access, Correction, Data Portability, and Deletion Rights 

You can submit a verifiable consumer request to us to exercise your rights to access, data portability, correction, and deletion as outlined above by either:

• Visiting our Privacy Center or
• Emailing us at [email protected]

Only a consumer, or a natural person or business entity that a consumer authorizes to act on such consumer’s behalf (an “Authorized Agent”), may make a verifiable consumer request related to that consumer’s personal information. A consumer may also make a verifiable consumer request on behalf of that consumer’s minor child. 

A consumer or their Authorized Agent can submit no more than two verifiable consumer requests for access or data portability within a 12-month period. The verifiable consumer request must: 

• Provide adequate information to permit Vendelux to reasonably verify that a consumer is the person about whom we collected personal information.
  ● If an Authorized Agent for a consumer is being used, provide sufficient proof that the consumer has provided that Authorized Agent with permission to submit the request on such consumer’s behalf, such as signed permission or a power of attorney executed pursuant to California Probate Code Sections 4121 to 4130.
• Describe that consumer’s request with adequate detail that allows Vendelux to properly understand, evaluate, and respond to it.

If we cannot verify the identity of the consumer or Authorized Agent, and/or their authority to make the request, and confirm that the personal information relates to that consumer, we cannot respond to the request or provide personal information. You do not need to create an account with us to make a verifiable consumer request. The personal information included in a verifiable consumer request will only be used to verify the identity and authority of the requestor.

Response Timing and Format 

We expect to respond to a verifiable consumer request within 45 days of  receipt. If we need more time (up to 90 days), we will inform the consumer in writing of the reason and the expected time period. Our written response will be delivered either by mail or electronically. The disclosures we provide will only cover the 12-month period preceding the receipt of the verifiable consumer request, except where another applicable period applies. We will explain why we cannot comply with a request, if applicable. The format we choose to provide a consumer’s personal information for data portability requests will be readily useable and should allow the consumer to transmit the information from one entity to another without hindrance.

We may charge a fee to process or respond to any verifiable consumer request that is excessive, repetitive, or manifestly unfounded. If we determine that a fee is appropriate for a particular request, we will explain why we are charging a fee and give you an estimate of the cost before we fulfill your request. 

Appeal of Adverse Decision

Other State Laws Colorado, Connecticut, and Virginia residents may have the right to appeal an adverse decision made in response to their exercise of a consumer data rights request. If you believe this right to appeal applies to you after such an adverse decision, you may email us at [email protected] to initiate an appeal. 

Non-Discrimination 

Consumers who exercise their rights under the CCPA will not be discriminated against by us.

Deidentified Data 

Vendelux will not attempt to reidentify any deidentified data we may collect or process, except to determine whether our deidentification processes meet applicable requirements. We will maintain and use any such information solely in a deidentified form.

Data Retention 

We will retain all categories of personal information we collect for a period of time that is consistent with and no longer than is reasonably necessary for the original purpose(s) for which it was collected, as described in this Privacy Policy, including, as applicable: (i) for as long as we have an ongoing relationship with the individual to whom the information pertains; (ii) for as long as needed to provide users, our customers, or our partners the Services; (iii) as necessary to comply with our legal obligations; (iv) as necessary to resolve disputes or to protect ourselves from potential future disputes; or (v) as necessary to enforce our agreements. The length of time personal information is kept will depend on how much information there is, what kind of information it is, how sensitive it is, and why it was collected. We will delete your personal information after the retention period. If we cannot delete your personal information, we will ensure that appropriate measures are put in place to prevent any further use of such information.

Changes to Our Privacy Statement

This privacy statement may be amended at any time at our discretion. We will notify you by email or by posting a notice on our website’s homepage when we make material changes to this privacy statement.

Metrics on Consumer Rights Requests  

During the previous calendar year, Vendelux received the following number of requests from California residents: 

	Received	Complied with in Whole or in Part	Denied	Mean Number of Days to Respond
Requests to know	101	46	55	46
Requests to delete	0	0	0	0
Requests to opt-out	1,416	1,142	274	43
Request to correct	0	0	0	0

How to Reach Us

If you have any questions or comments about this Statement, our Privacy Policy, the ways in which we collect and use a consumer’s personal information, how to receive a copy of the Privacy Policy and/or this Statement in an alternative format (for consumers with a disability), a consumer’s choices and rights regarding such use, or to exercise consumer rights under California or other state law, please contact us at: 

Vendelux, Inc. 

Attn: Privacy 

115 West 30th Street, Suite 600

New York, NY 10001 

Email: [email protected] 

This Privacy Policy was last updated on April 18, 2025