Privacy Policy
What Vortox Lab collects, why we collect it, who else sees it, and the choices you have.
Effective date: 5 August 2026
Vortox Lab is a remote-first growth partner for the green industry and works with clients internationally. We do not operate a public office or customer visit location. All contact is handled through the details on this page.
What this policy covers
This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you visit vortoxlab.com, contact us, request an audit, subscribe to marketing, download a resource, or become a client. It also explains the choices and rights available to you.
For data collected through our own website and sales process, Vortox Lab is normally the controller. When we handle leads, customer records or account data solely to deliver services for a client, we normally act as that client's processor or service provider. The client agreement and any data processing terms govern that work.
The personal data we collect
Information you provide
- Name, job title, company name and business contact details.
- Website address, service interests, business information and the details included in an enquiry, audit request or meeting booking.
- Messages, files, briefs, approvals, support requests and other information exchanged during a client relationship.
- Contract, invoice and payment status information. Payment card details may be collected directly by a payment provider and are not intended to be stored by Vortox Lab.
- Marketing preferences, webinar or resource registrations, and responses to email campaigns.
Information collected automatically
- IP address, browser, device, operating system, approximate location, referral source and pages viewed.
- Cookie identifiers and similar technology data used for site operation, analytics, advertising measurement and preference management.
- Information from Meta Pixel and other advertising or analytics tags when you have provided any consent required by law.
- Email interaction data, such as delivery, opening and link activity, where the email platform and applicable law permit this tracking.
- Security logs used to prevent fraud, misuse and unauthorised access.
Information received from other sources
- Business contact information provided by a colleague, referral partner, client or professional adviser.
- Lead and customer data placed in systems we manage for a client.
- Information from advertising platforms, analytics services, scheduling tools, website forms and email providers.
- Public business information where its use for business development is lawful and proportionate.
Why we use personal data
| Purpose | Typical data | Lawful basis |
|---|---|---|
| Respond to enquiries and prepare proposals | Contact, company, website and enquiry details | Steps requested before a contract; legitimate interests |
| Provide marketing, development, automation and consulting services | Client contacts, instructions, files, account and project data | Contract; legitimate interests |
| Bill clients and maintain legal records | Contract, invoice, payment status and correspondence | Contract; legal obligation |
| Operate, secure and improve the website | Device, browser, logs and usage data | Legitimate interests; consent where required |
| Measure campaigns and advertising | Cookie, pixel, referral and conversion data | Consent where required |
| Send marketing communications | Business contact and preference data | Consent or legitimate interests where permitted; applicable electronic marketing rules also apply |
| Protect rights and comply with law | Relevant account, transaction, security and correspondence data | Legal obligation; legitimate interests; legal claims |
Direct marketing objection: You can object to direct marketing at any time. Use the unsubscribe link in an email or contact hi@vortoxlab.com.
Cookies, analytics and advertising technology
We use essential website technology and may use analytics, email tracking and Meta Pixel. Where consent is required, optional analytics and advertising technology should remain inactive until you make a choice. You can change your choice through the cookie preference control. See the Cookie Policy for more detail.
How we share personal data
- Service providers: hosting, security, analytics, email, CRM, forms, scheduling, cloud storage, payment and professional service providers that support our operations.
- Client-authorised platforms: advertising, CRM, field-service, analytics or automation systems selected by a client for service delivery.
- Professional advisers: accountants, solicitors, insurers and consultants where reasonably necessary.
- Authorities and legal recipients: where disclosure is required by law, court order, regulation, fraud prevention or the protection of legal rights.
- Business transfers: a buyer, investor or successor if all or part of the business is reorganised, sold or transferred, subject to appropriate confidentiality and legal safeguards.
We do not sell personal data for money. Advertising and analytics providers may process identifiers for measurement or targeted advertising. In some US states, that activity may be treated as sharing or targeted advertising. Where applicable, you can use our cookie preferences or contact us to exercise an opt-out right.
International transfers
Vortox Lab works with clients internationally. Some suppliers or client-selected platforms may process data in a country other than your own. Where the law requires it, we use an approved transfer mechanism, contractual safeguards or another lawful basis for the transfer.
Retention
- Enquiry and proposal records are normally reviewed after 24 months from the last meaningful contact and deleted or minimised when no longer required.
- Marketing records are retained until you unsubscribe, object, or the information is no longer useful and accurate. Suppression records may be retained so that we can respect an opt-out.
- Client contracts, invoices and core business records may be kept for up to seven years after the relationship ends where needed for accounting, tax, legal claims or compliance.
- Cookie, analytics, email and advertising data is retained according to the relevant platform settings and our documented business need.
- Client-controlled data processed during service delivery is returned or deleted according to the client agreement, subject to legal retention duties and secure backups.
Security
We use proportionate technical and organisational measures intended to protect personal data, including controlled access, reputable service providers, secure account practices and removal of access when it is no longer required. No internet service can promise absolute security. Please do not send passwords, financial account credentials or highly sensitive personal data through a general website form.
Your rights
Depending on the law that applies, you may have rights to:
- Request access to personal data and information about its use.
- Ask us to correct inaccurate or incomplete data.
- Request deletion or restriction in circumstances provided by law.
- Object to processing based on legitimate interests and object at any time to direct marketing.
- Withdraw consent without affecting processing already carried out lawfully.
- Receive certain data in a portable format.
- Complain to the competent privacy or data protection regulator for your location.
- Exercise additional rights available under an applicable US state privacy law, including rights relating to targeted advertising, sale or sharing.
We may need to verify your identity before completing a request. Some rights are not absolute, and we may retain information where required for legal obligations, security, contracts or legal claims. We will not discriminate against you for making a legally protected request.
Marketing preferences
Submitting an enquiry allows us to reply about that enquiry. It does not automatically require you to receive unrelated marketing. We send promotional email where consent has been given or another lawful route is available. Every promotional email will provide an unsubscribe method. Service, billing, security and contract communications may still be sent when required to manage an active relationship.
Children
Our website and services are intended for business users and are not directed to children. We do not knowingly collect personal data from children under 16 through the website. Contact us if you believe a child has provided data to us.
Changes to this policy
We may update this policy when our tools, services or legal obligations change. The effective date at the top of the page will identify the current version. Material changes may also be communicated through the website or by email where appropriate.
Contact
Questions, notices and privacy requests can be sent to hi@vortoxlab.com. You can also visit vortoxlab.com.
Contact
Questions, notices and privacy requests can be sent to hi@vortoxlab.com.