Privacy Policy

Controller

VERTEX IMPORT EXPORT LLC, 5900 Balcones Dr, Ste 100, Austin, TX 78731, USA is the controller of personal data for this website and for the subscription software. Contact privacy@vertexexport.com. That address is also the contact for privacy requests and for the data-protection role until a separate DPO is appointed.

VERTEX COMERCIO, EXPORTAÇÃO E IMPORTAÇÃO LTDA., CNPJ 47.137.159/0001-16, Q SCS Quadra 02, Bloco C, Número 22, Sala 706, parte B, CEP 70.300-902, Brasília/DF, Brazil is a related company. It may process personal data for operations in Brazil on the controller’s instructions, or as a separate controller only where Brazilian law requires it. It is not the billing party for the subscription.

What we process

On the public site today we process the page you request, a short server log (IP address, user agent, time and URL), and, only if you accept cookies, a currency preference. We do not run advertising cookies and we do not sell personal information.

When accounts open, we expect to process account name, work email, company name, role, sign-in events, support messages, and customer content you upload (catalogs, offers, shipment files). Payment card numbers are handled by Stripe, not stored on our servers.

Why we process it, and the legal bases

We process data to provide the software (contract), to keep the service secure and to improve it in a limited way (legitimate interests), to meet tax, accounting and legal duties (legal obligation), and, where we ask, on consent. You can withdraw consent without affecting earlier lawful processing.

Under the LGPD the same purposes map to contract, legitimate interest, legal obligation and consent. Under the CCPA/CPRA we do not sell or share personal information for cross-context advertising. Under PIPL we do not process personal information of people in China, and we do not transfer it across a border, until a specific notice and a lawful basis are in place.

Retention

Server logs are kept for up to 90 days unless a security incident requires a longer hold. A consent cookie lasts up to six months. A currency cookie, if you accept it, lasts up to one year.

Account and customer content will be kept for the life of the subscription and then for up to 24 months, unless a longer period is required for tax, a dispute or a legal hold. You can ask for deletion sooner, subject to those holds.

International transfers

The service is operated from the United States. If we transfer personal data from the EEA or the UK, we use the European Commission’s standard contractual clauses (2021/914) and the UK addendum or IDTA, plus any required transfer assessment.

Transfers from Brazil follow the LGPD transfer rules in force at the time. Transfers from Switzerland follow the nFADP and the Swiss recognition of adequate safeguards, including SCCs where they apply. We do not transfer personal information subject to PIPL until the PIPL conditions are met. PIPEDA rights for people in Canada are handled through the same privacy mailbox.

Your rights

Depending on where you live, you may ask to access, correct, delete, export or restrict your personal data, to object to processing based on legitimate interests, and to withdraw consent. You may complain to a supervisory authority. EEA and UK requests are answered under the GDPR or UK GDPR. Brazilian requests are answered under the LGPD. Swiss requests are answered under the nFADP. Canadian requests are answered under PIPEDA.

California residents, and residents of other US states with similar laws (including Colorado, Connecticut, Virginia, Utah, Oregon and Texas), may ask to know, correct and delete personal information, and to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights.

Write to privacy@vertexexport.com. We may need to confirm you are the person the data is about, or that you act for them. We aim to answer within 30 days, or the shorter period a local law requires.

Children and changes

The software is for businesses. It is not directed at children under 16, and we do not knowingly collect their data.

A new version of this policy will show a new “Last updated” date. If a change is material and you have an account, we will notify the account email.