Privacy policy
Last updated: [TBD: date of publication]
This policy explains how Vender Finance AB processes personal data when you visit venderfinance.com, contact us, or use the Vender platform as a buyer, supplier or investor.
Vender is a business-to-business service. Most of the data we handle is about companies; the personal data we process is mainly about the people who represent, own or work for those companies, and about suppliers that are sole traders.
1. Who is responsible
Vender Finance AB, org. no. 559604-9980, Junohällsvägen 8, 112 64 Stockholm, Sweden ("Vender", "we") is the controller for the processing described in this policy, except as set out below.
- When we import supplier and invoice details from a buyer's accounting system on the buyer's instruction, we act as processor for the buyer. This is governed by a data processing agreement, which is an appendix to our agreement with the buyer.
- When we use those details to offer early payment to the supplier, onboard the supplier and administer the early-payment flow, including making the payouts, we act as controller.
- Our partner bank, [TBD: partner bank name], provides the accounts through which payments are made. When the bank carries out its own credit and customer due diligence checks during onboarding, it is an independent controller for that processing; see the bank's own privacy notice.
Privacy questions: privacy@venderfinance.com.
2. What we collect, why, and on what legal basis
| Who | Data | Source | Purpose | Legal basis |
|---|---|---|---|---|
| Website visitors | Pages visited, device and browser data, approximate location, clicks, masked session recordings | You | Understand and improve the website | Consent (cookie banner) |
| People who contact us or request an account | Name, company, work email, role, message | You | Answer and handle your request | Legitimate interest – responding to business enquiries |
| Investors accessing our investor brief | Email address, time of access, browser type | You | Give access and follow up on investor interest | Legitimate interest – managing investor relations. Analytics on the investor brief only with consent (section 4). |
| Platform users (buyers and suppliers) | Name, work email, role, login and activity data | You or your employer | Provide the service, manage access, keep it secure | Legitimate interest – delivering the service our customer has contracted for and protecting it against misuse. Contract where you are a sole trader. |
| Representatives, signatories and beneficial owners of buyers and suppliers | Name, personal identity or passport number, nationality, country of residence, ownership share, role, ID documents, PEP and sanctions information | You, your company, public registers (e.g. Bolagsverket) and screening providers | Customer due diligence and anti-money-laundering checks | Legal obligation (Swedish Anti-Money Laundering Act 2017:630) |
| Supplier contacts | Name, work email, payout bank account, declarations (PEP/sanctions, account ownership) | You or your company | Enable payout to the correct account and prevent fraud | Legitimate interest – secure payouts and fraud prevention; contract for sole traders; legal obligation for AML declarations |
| People named in invoices (incl. sole-trader suppliers) | Supplier name, contact details, invoice number, amount, due date | The buyer's accounting system (e.g. Fortnox or Spiris) | Offer and administer early payment | Legitimate interest – offering suppliers early payment on invoices the buyer has approved; contract once a sole trader accepts |
Where we rely on legitimate interest we have assessed that our interest is not overridden by your interests or rights. You can ask us for more information about that assessment.
Data we must collect under anti-money-laundering law is a requirement for entering into a business relationship. If it is not provided, we cannot onboard the company or arrange early payment.
3. Data we receive from others
If you are a supplier, we may first receive your details from a buyer that uses Vender, through the buyer's accounting system. We inform you about this processing and link to this policy no later than the first time we contact you, and in any case within one month. If you do not take up the offer of early payment, we delete your invoice-related data as set out in section 7.
4. Cookies and analytics
We only use analytics after you accept in the cookie banner. This applies to the whole website, including the investor brief. You can change your choice at any time via "Cookie settings" in the footer. If you decline, no analytics cookies are set.
We use Google Analytics 4 (Google) for traffic statistics and Microsoft Clarity (Microsoft) for heatmaps and session recordings. In the logged-in platform, text is masked in recordings, and analytics is switched off entirely on identity verification, onboarding, two-factor authentication and payout-account pages. Analytics never runs on invite links.
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| vender_consent (local storage) | Vender | Remembers your cookie choice | Until you change it |
| sb-… (auth cookies) | Vender / Supabase | Keeps you signed in (necessary) | Session / up to 1 week |
| _ga, _ga_M4RSDG5Z0V | Distinguishes visitors (analytics) | 2 years | |
| _clck, _clsk | Microsoft | Clarity session and user identifiers | 1 year / 1 day |
| MUID, SM (set on clarity.ms) | Microsoft | Clarity / Microsoft user identifier | 13 months / session |
5. Who we share data with
We do not sell personal data. We share data with:
- Our partner bank [TBD: partner bank name], which provides the payment accounts and carries out its own credit and due diligence checks during onboarding as an independent controller.
- Service providers acting on our behalf under data processing agreements: Supabase (database, hosted in Stockholm, Sweden), Vercel (web hosting, USA), Resend (email delivery, USA), Google (analytics), Microsoft (Clarity), and providers of identity verification and sanctions screening [TBD: provider name].
- Your accounting system provider (e.g. Fortnox or Spiris) when it is connected – we read data from it on the buyer's instruction.
- The other party in a buyer–supplier relationship, to the extent needed (for example, the buyer sees the supplier's name and invoice status).
- Authorities, such as the Swedish Financial Supervisory Authority, the Swedish Police (Financial Intelligence Unit) or the Swedish Tax Agency, when required by law.
6. Transfers outside the EU/EEA
Our database is hosted in Sweden. Some service providers are located in, or process data in, the USA. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses. You can request a copy of the safeguards we rely on by contacting privacy@venderfinance.com.
7. How long we keep data
- KYC and anti-money-laundering records: 5 years after the business relationship ends, or up to 10 years where required under the Anti-Money Laundering Act.
- Accounting records (invoices, payouts): 7 years after the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act.
- Platform user accounts: for as long as the account is active, and deleted or anonymised within 12 months after the customer relationship ends, unless a longer period applies above.
- Invoice data about suppliers who do not take up early payment: deleted 12 months after the invoice due date.
- Contact and account requests: up to 24 months after our last contact.
- Investor brief access records: up to 24 months.
- Analytics: Google Analytics 14 months; Microsoft Clarity recordings 30 days, aggregated heatmaps up to 13 months.
8. Automated decision-making
When a buyer or supplier is onboarded, credit, customer due diligence and sanctions checks are reviewed manually by Vender and by our partner bank. Once a buyer's credit line and a supplier have been approved, individual invoices are handled automatically within the approved terms: an early payment is made when the buyer has approved the invoice and the supplier has accepted the offer.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
9. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict processing, and to receive data you have provided to us in a portable format where processing is based on consent or contract. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
Right to object: Where we process your data on the basis of legitimate interest, you have the right to object at any time on grounds relating to your particular situation. We will then stop the processing unless we can show compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims.
Some data must be kept despite a request for erasure, for example KYC records required by anti-money-laundering law and accounting records required by the Bookkeeping Act.
Contact us at privacy@venderfinance.com. You can also lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.
10. Security
Access to data is limited by role: buyers only see their own company, suppliers only their own relationships, and payouts are only made to bank accounts that have been verified. Customers sign in with two-factor authentication. Data is encrypted in transit and at rest, and access to production systems is restricted to authorised staff.
11. Changes
We may update this policy. The date at the top shows when it was last changed. Material changes will be communicated to platform users before they take effect.