Our approach
Vanta Tools Limited, company number 16779743, whose registered office is 417b Petre Street, Sheffield, S4 8LL, is committed to handling personal information lawfully, fairly and transparently. We apply the UK GDPR principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability to information used in our business.
Responsibility and lawful processing
Responsibility for data-protection enquiries sits with Vanta Tools Limited. Before processing personal information, we identify a lawful basis and use information only for compatible purposes. Access is limited to people and service providers who require it for their work.
Accuracy, access and correction
We take reasonable steps to keep business contact information accurate. Individuals may request confirmation of whether we process their information and, subject to legal limits, receive a copy. Inaccurate or incomplete data may be corrected. Requests should be sent to harnek@vantatools.co.uk and may require identity verification.
Erasure, restriction and objection
You may ask us to erase information, restrict its use or object to processing in appropriate circumstances. These rights are not absolute; for example, we may retain records needed to establish legal claims, meet tax obligations, protect security or perform an existing contract. We will explain the outcome of a request.
Portability and automated decisions
Where processing is based on consent or contract and carried out by automated means, you may have a right to receive information in a structured, commonly used format. We do not make solely automated website decisions that produce legal or similarly significant effects.
Retention and disposal
Records are reviewed according to their purpose. Enquiry, contract, financial, technical and security records may require different retention periods. When information is no longer required, it is deleted, anonymised or securely disposed of as appropriate.
Suppliers and processors
Providers processing information for us must act on documented instructions, keep information secure, support relevant rights and notify us of incidents. Due diligence and contractual protection are used in proportion to the processing risk.
Security incidents
Suspected personal-data incidents should be reported promptly to harnek@vantatools.co.uk. We assess containment, risk, evidence, notification and corrective action. Where the law requires it, we will notify the Information Commissioner’s Office and affected individuals within the applicable timescale.
Training and review
People handling personal information are expected to understand their responsibilities. This policy is reviewed when operations or legal requirements materially change. It applies from 15 September 2026.