Privacy Policy

Vilmak ("Vilmak", "we", "us", "our") — this policy explains how we collect, use, and protect personal data on the Vilmak outreach platform (the "Service"), the business contact-management and email outreach software available at marketing.vilmak.co.uk, used by business customers ("tenants") and their team members. If anything here is unclear, contact us at info@vilmak.co.uk.

1. Who is responsible for your data

The data controller for this website and for the account/billing side of the Service is Vilmak Ltd (company number 17425133), registered office: Bowen Suite, The Globe Centre, 1 St. James Square, Accrington, BB5 0RE.

For the business contact data a tenant imports, sources, or enters into the Service (the people and companies it markets to), the tenant company is the data controller — it decides who to contact, why, and where that data came from. Vilmak acts as a data processor for that data, running the software on the tenant's behalf and only processing it according to the tenant's instructions. If you have received a marketing email sent using the Vilmak outreach platform, or want to know why you were contacted, that request should go to the business that emailed you, since they are the controller who decided to contact you; Vilmak can explain what the software does but does not decide who a tenant markets to. Every campaign sent through the Service includes a working unsubscribe link, and unsubscribe requests are enforced automatically, independent of the tenant.

Vilmak is also a data controller for information it needs to run its own business — the billing and account-administration contact for a tenant, support correspondence, security/audit logs of platform access, and payment data processed via Stripe. This is data Vilmak processes for its own purposes (getting paid, running its business, keeping the platform secure), not on a tenant's instructions.

Business name: Vilmak
Legal operator: Vilmak Ltd (company number 17425133), registered office: Bowen Suite, The Globe Centre, 1 St. James Square, Accrington, BB5 0RE
Contact: info@vilmak.co.uk

2. What personal data we collect

a) Vilmak's own business and account administration data

Processed by Vilmak as controller, for running its own business rather than on a tenant's instructions:

• Billing and account-administration contact details for each tenant.
• Payment and subscription data processed via Stripe, our payment processor — Vilmak does not store full card numbers itself (see section 5).
• Support correspondence.
• Security and audit logs of platform access, used to detect misuse and keep the service secure.

b) Account data

Processed by Vilmak as a data processor, on the tenant's instructions:

• Name, email address, hashed password (we never store passwords in plain text).
• Role (tenant owner or team member) and tenant/company identifier.

c) Business contact data

Processed by Vilmak as a data processor, on the tenant's instructions. This is data about third parties — the people and companies a tenant markets to — not Vilmak's own customers. The tenant determines the source of this data and is responsible for ensuring it was lawfully obtained (see section 4):

• Business contact details entered or imported by the tenant: name, email address, phone number, job title, company name, and website.
• Records of which campaigns a contact was sent, whether they replied, and their unsubscribe/suppression status.

d) Sending credentials and campaign data

Processed by Vilmak as a data processor, on the tenant's instructions:

• The tenant's own email-sending account credentials (SMTP and, where configured, IMAP username and password), stored encrypted at rest, used only to send that tenant's campaigns and check for replies on their behalf. Vilmak never uses a tenant's sending credentials for any other purpose.
• Campaign content, scheduling, and delivery/reply logs.

e) Technical data

Strictly necessary session and security cookies, including cookies used to maintain authenticated sessions and protect form submissions. We do not use advertising, analytics, or tracking cookies.

3. How we use this data

Purpose	Data used
Log you in and keep your account secure	Account data
Store and organise a tenant's business contacts, and send email campaigns on the tenant's instructions	Business contact data, sending credentials, campaign data
Check for and surface replies to a tenant's campaigns	Sending credentials (IMAP), campaign data
Enforce unsubscribe requests automatically across future sends	Business contact data
Bill tenants and administer their accounts, including processing subscription payments	Business/account administration data, Stripe payment data
Respond to support requests	Business/account administration data
Detect misuse and keep the platform secure	Security/audit logs
Keep the service running and recoverable (backups)	All of the above, backed up on a schedule
Maintain and improve the reliability, security and functionality of the platform	All of the above

4. Legal basis for processing (UK GDPR)

Account data and platform usage: Where Vilmak processes personal data on behalf of a tenant, it does so as a data processor in accordance with the tenant's documented instructions and the Data Processing Agreement, and as necessary to provide the Service under its contract with the tenant. Vilmak may also process certain information where necessary for its legitimate interests, including operating, maintaining, securing and improving the platform, preventing misuse, and protecting the integrity of the service.

Vilmak's own business and account administration data (billing contacts, support correspondence, security/audit logs, payment data processed via Stripe): processed under Vilmak's legitimate interest in running its business, invoicing tenants, providing support, and keeping the platform secure, and as necessary to perform our contract with the tenant.

Business contact data and campaign sending: the tenant acts as the controller for the business contact data it imports or sources and for the campaigns it sends, and is responsible for determining and documenting the appropriate lawful basis for that processing — typically the legitimate-interests basis available for direct marketing to other businesses under UK GDPR and PECR, provided the tenant identifies itself clearly, gives a working opt-out, and only contacts details that were already published by that business for a similar purpose (for example, a published "contact us" address or a public directory listing). Vilmak requires tenants to comply with applicable direct-marketing law as a condition of using the Service, and provides tools to support compliance (identity and unsubscribe footers, List-Unsubscribe headers, automatic suppression of opt-outs), but does not itself vet or verify the source of a tenant's contact data before it is imported — that responsibility rests with the tenant as controller.

Vilmak does not independently decide who a tenant markets to or what a tenant's campaigns say. The platform provides contact management, campaign sending, and reply tracking, and does not make or recommend judgments about individual campaign recipients. Any such decisions remain entirely the responsibility of the tenant.

Where Vilmak processes business contact data solely on behalf of a tenant and in accordance with its documented instructions, Vilmak acts as a data processor, with the tenant remaining responsible for the purposes and lawful basis of that processing.

5. Who we share data with

We use a small number of subprocessors to run the service. We do not sell personal data, and we do not use advertising or analytics networks. Where required, material changes to our subprocessors will be communicated to affected tenants.

Subprocessor	Purpose	Data involved
IONOS Cloud Ltd. (company number 3953678)	Hosting the platform's server and database	All data stored in the platform
IONOS Cloud Ltd. (company number 3953678)	Sending transactional emails: password resets, account notifications	Name, email address
IONOS Object Storage	Off-site storage of database backups, in addition to local backups	All data stored in the platform, as part of full-database backups
Stripe	Payment processing for subscriptions — Vilmak does not store full card numbers	Billing name, billing email, card/payment details (held by Stripe, not Vilmak), subscription plan and status

The platform's primary server and database are hosted by IONOS Cloud Ltd. in a United Kingdom data centre. Database backups are additionally stored off-site with IONOS Object Storage in their eu-central-3 region (Berlin, Germany). This means personal data may be transferred outside the UK to the European Economic Area (EEA) as part of routine backups. The UK's data protection framework recognises the EEA as providing an adequate level of protection for personal data, so this transfer does not require additional safeguards beyond compliance with UK GDPR.

Stripe processes payment data under its own applicable data protection terms as an independent controller for certain payment-related purposes (such as fraud prevention and compliance with card network rules); further detail is available in Stripe's privacy policy.

A tenant's own sending-mailbox credentials (SMTP/IMAP) are stored encrypted and used only to relay that tenant's own campaigns and check for replies — they are not shared with any third party, and Vilmak staff do not use them to send or read email on a tenant's behalf outside of the automated platform functions the tenant configured.

6. Cookies

The Service uses only strictly necessary cookies — the session cookie that keeps you logged in, and a CSRF-protection cookie that helps secure form submissions. These cookies are used only where necessary for the operation and security of the service and are not used for advertising or analytics — but if analytics or marketing cookies are added later, this section and a cookie banner will need to be added.

7. Data retention

Account data: retained for as long as the tenant's subscription is active, plus a reasonable period afterwards for legal/accounting purposes.

Business contact data and campaign data: the tenant determines the appropriate retention period for the contacts and campaigns it manages, and can delete contacts or campaigns at any time within the platform. Where a contact unsubscribes or a send bounces/complains, Vilmak retains a minimal suppression record (the email address and the reason) indefinitely across that tenant's account, even if the underlying contact is otherwise deleted — this is necessary to reliably prevent that address being re-contacted in future, which is itself a data-protection safeguard for the recipient.

Where a tenant requests deletion of specific records, Vilmak will process that request in accordance with the applicable agreement and data-protection requirements, subject to any legal requirement to retain the information. Following termination of the Service, Tenant Data is made available for export for 30 days and is then deleted in accordance with the DPA, subject to any legal requirement to retain particular information, other than suppression records as described above.

Backups: retained on a rolling basis per the automated backup schedule (currently: backups taken every 6 hours, stored locally and off-site). Deleting a record from the live platform does not immediately remove it from backups already taken — it will age out as older backups are rotated out on the same schedule.

Payment data: billing history and subscription records are retained by Stripe and by Vilmak for as long as necessary for accounting, tax, and legal compliance purposes after a subscription ends.

8. Your rights

Subject to some exceptions, UK GDPR gives you the right to:

• Ask what personal data we hold about you and get a copy (access).
• Correct inaccurate data (rectification).
• Ask for data to be deleted (erasure), where applicable.
• Object to or restrict certain processing.
• Receive your data in a portable format.

If you have received a marketing email sent using the Vilmak outreach platform, you can unsubscribe at any time using the link in that email — this is enforced automatically and applies across all future campaigns from that sender. For any other request (such as access or erasure), contact the business that emailed you first, since they are the data controller who decided to contact you and hold the record of why.

If you contact Vilmak directly and the tenant is the controller, we will normally refer your request to the relevant tenant and assist as required under our agreement and applicable data-protection law. If you are a tenant, contact info@vilmak.co.uk.

You also have the right to complain to the UK Information Commissioner's Office (ICO) if you believe your data has been mishandled.

9. Security

• Passwords are hashed, never stored in plain text.
• A tenant's own email-sending credentials (SMTP/IMAP passwords) are encrypted at rest.
• Database backups are taken automatically and stored both locally and off-site.
• Access to tenant data within the platform is restricted by tenant (each company only sees its own data) and by role (only tenant owners can access admin-level features, including billing and team management).
• Access to production systems and customer data is restricted to authorised personnel and subject to appropriate access controls.
• Payment card details are handled directly by Stripe and never pass through or are stored on Vilmak's own servers.
• Authorised Vilmak staff can, where necessary for support or troubleshooting, temporarily access a tenant's account in the same way that tenant's own users would (an "impersonation" feature). This access is logged, and Vilmak does not use it to read a tenant's business contact data or campaigns other than as needed to resolve the specific issue raised.

10. Changes to this policy

We may update this policy from time to time. The "effective date" at the top will be updated when we do, and material changes will be communicated to tenant administrators.

11. Contact us

Email: info@vilmak.co.uk