Skip to main content
Vendo

Data Breach Policy

Last Updated: July 22, 2026

1. Purpose

This policy defines Vendo's procedures for identifying, containing, investigating, and communicating data breaches. It supports Vendo's compliance with applicable data protection laws, contractual commitments, and its role in the affected processing.

2. Definition

A data breach is any event that results in unauthorized access, disclosure, alteration, loss, or destruction of personal data or confidential information. This includes:

  • Unauthorized access to systems containing personal data
  • Accidental or intentional disclosure of personal information to unauthorized parties
  • Loss or theft of devices or media containing personal data
  • Ransomware or malware attacks that affect data availability or integrity
  • Human error resulting in data exposure (e.g., misdirected emails)

3. Detection and Reporting

All Vendo personnel are responsible for promptly reporting any suspected or confirmed data breach. Reports should be made to:

Reports should include as much detail as possible, including the nature of the breach, the data affected, and any immediate actions taken.

4. Containment

Upon identification of a data breach, assigned responders will take appropriate steps to contain the breach, including:

  • Isolating affected systems or accounts
  • Revoking compromised credentials
  • Securing physical areas if applicable
  • Preserving evidence for investigation

5. Assessment

Assigned responders will assess the breach to determine:

  • The nature and extent of the breach
  • The types and volume of data affected
  • The individuals or groups affected
  • The likely consequences and risks to affected individuals
  • Whether the breach triggers notification obligations

6. Notification

Vendo will make notifications according to applicable law, contractual commitments, and whether Vendo acts as a controller or processor for the affected data:

  • Affected customers: Without undue delay and within any applicable contractual timeframe when customer data is affected
  • Controllers: When Vendo acts as a processor, notify the relevant controller without undue delay as required by law and contract
  • Regulatory authorities: Within the statutory timeframe when Vendo is responsible for the notification and the applicable legal threshold is met
  • Affected individuals: When required by applicable law, taking account of the relevant risk and notification threshold

7. Remediation

Following containment and notification, Vendo will:

  • Implement corrective measures to prevent recurrence
  • Update security controls and procedures as needed
  • Conduct a post-incident review
  • Document lessons learned

8. Record Keeping

Vendo documents data breaches as required by applicable law and contract. Records may include the facts of the breach, its effects, decisions about notification, and remedial actions taken.

9. Contact

To report a data breach or for questions about this policy, please contact us at support@vendodata.com