Privacy Policy

This policy explains what information the SKUHerder service (“SKUHerder”, “we”, “us”), operated by SVI UK, collects and processes, why, and the rights available to individuals whose data may be included. It covers the SKUHerder software and its data-processing activities, including our use of official government APIs such as HMRC’s “Check a UK VAT number” service.

SKUHerder is a business-to-business (B2B) market-intelligence and regulatory-compliance service. It builds profiles of UK e-liquid and vaping retailers for trade customers (brands, distributors and wholesalers), drawing on information that businesses publish on their own websites and on official public registers.

What information we process

The great majority of the data we process is business information about companies — product listings, prices, stock levels, trading names, VAT numbers, registered offices and compliance markers. A company is a legal person, so this is generally not personal data.

However, some of the information we process does relate to identifiable individuals and is therefore personal data under UK GDPR. Specifically:

• names, roles and appointment/resignation history of company officers, directors and persons of significant control, obtained from Companies House;
• the registered name and address associated with a VAT registration, which — for a sole trader — is an individual’s name and (often) home address;
• business contact details (such as a named individual’s email address) where a retailer publishes them on its website.

Where it comes from

We obtain information from:

• publicly accessible pages of UK retailer websites;
• Companies House (the UK register of companies);
• HMRC’s “Check a UK VAT number” API, used to verify a VAT number a retailer displays and to retrieve the associated registered name and address;
• other official public registers relevant to compliance (for example the UK WEEE producer register).

We do not collect information from individuals directly, and we do not process special-category data.

Why we process it (lawful basis)

Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)): providing a B2B market-intelligence and regulatory-compliance service to trade customers, and enabling due-diligence on businesses operating in the UK vaping market. We limit processing to information in a business context, use only data that is already published or held on official public registers, and do not use it to make decisions about individuals in a personal capacity.

How the information is used and shared

We compile the information into compliance profiles and market-intelligence reporting that we make available to our subscribing trade customers as part of the service. The verification result from the HMRC VAT check — whether a retailer displays a valid, live VAT registration — forms one signal within a retailer’s compliance profile.

We do not sell or redistribute the underlying government registers in bulk, and we do not operate a standalone VAT-number-checking service.

Retention

We retain profile, pricing, stock and compliance information for as long as it is relevant to the service, including historical records used for trend and change analysis. Where personal data is no longer necessary for these purposes, we remove or anonymise it.

Your rights

If your personal data is included, you have rights under UK GDPR, including the right to access it, to have it corrected or erased, to restrict its processing, and — because we rely on legitimate interests — the right to objectto our processing of it. To exercise any of these rights, contact us using the details below. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Security

Data is transmitted over encrypted (TLS) connections and access to our systems is restricted to authorised personnel. To report a security concern or vulnerability, please contact security@sviuk.com.

Contact us

For any privacy question or to exercise your rights, contact SVI UK at privacy@sviuk.com.