This policy explains how we collect, use, and protect personal data across two contexts:
yourcompany.vilmak.co.uk), used by tenant administrators and their factory workers.If anything here is unclear, contact us at info@vilmak.co.uk.
For the public website, the data controller is Vilmak Ltd (company number 17425133), registered office: Bowen Suite, The Globe Centre, 1 St. James Square, Accrington, BB5 0RE.
For data processed inside The Logical Auditor, where the tenant company (your employer, or the business that set up your account) determines the purposes and means of processing worker-related data, the tenant is the data controller for that data — for example, worker shift and quality data. Vilmak acts as a data processor for that data, running the software on the tenant's behalf and only processing it according to the tenant's instructions. If you are a factory worker using the app, questions about how your employer uses your data should first be directed to your employer; Vilmak can explain what the software does, but the employer sets the policy on how that data is used.
Vilmak is also, separately, a data controller for certain information it needs to run its own business — for example, the billing and account-administration contact for a tenant company, support correspondence, and security/audit logs of platform access. This is data Vilmak processes for its own purposes (getting paid, running its business, keeping the platform secure), not on a tenant's instructions, so Vilmak — not the tenant — is responsible for it.
Business name: Vilmak
Legal operator: Vilmak Ltd (company number 17425133), registered office: Bowen Suite, The Globe Centre, 1 St. James Square, Accrington, BB5 0RE
Contact: info@vilmak.co.uk
Processed by Vilmak as controller, for running its own business rather than on a tenant's instructions:
Processed by Vilmak as a data processor, on the tenant company's instructions:
Also processed by Vilmak as a data processor, on the tenant company's instructions, and collected as part of using the shift-tracking and quality-control features. Generally linked to the named worker who performed the action, and therefore capable of constituting personal data; the tenant determines the purposes for which that data is used:
| Purpose | Data used |
|---|---|
| Log you in and keep your account secure | Account data |
| Show live station status on the Active Shifts board and CEO Command Center | Activity data |
| Detect and alert on Quality Lock breaches in real time | Activity data |
| Generate and email scheduled PDF reports to recipients nominated by the tenant admin | Account + activity data |
| Respond to enquiries submitted via the contact form | Contact form data |
| Bill tenant companies and administer their accounts | Business/account administration data |
| Respond to support requests | Business/account administration data |
| Detect misuse and keep the platform secure | Security/audit logs |
| Keep the service running and recoverable (backups) | All of the above, backed up on a schedule |
| Maintain and improve the reliability, security and functionality of the platform | All of the above |
Website contact form: information submitted through our contact form is processed for the purpose of responding to enquiries and, where applicable, taking steps at the request of the individual prior to entering into a business relationship. Where consent is specifically requested for an additional purpose, such as marketing communications, that consent will be obtained separately.
Tenant account data and platform usage: Where Vilmak processes personal data on behalf of a tenant company, it does so as a data processor in accordance with the tenant's documented instructions and the Data Processing Agreement, and as necessary to provide the service under its contract with the tenant company. Vilmak may also process certain information where necessary for its legitimate interests, including operating, maintaining, securing and improving the platform, preventing misuse, and protecting the integrity of the service.
Vilmak's own business and account administration data (billing contacts, support correspondence, security/audit logs): processed under Vilmak's legitimate interest in running its business, invoicing tenant companies, providing support, and keeping the platform secure.
Worker activity data (shift check-ins, quality reporting, scrap logs): the tenant company acts as the controller for worker-related data entered into or generated through the platform, and is responsible for determining and documenting the appropriate lawful basis and purposes for processing that data. Depending on the tenant's circumstances, this may include legitimate interests or another lawful basis available under UK GDPR.
Where operational data is linked to identifiable workers and is used for purposes such as coordinating shifts, tracking production, quality control, safety, or compliance, it may constitute workplace monitoring. The tenant is responsible for assessing whether its use of the platform constitutes workplace monitoring and for ensuring that the monitoring is lawful, necessary, proportionate and transparent. Where required, the tenant should carry out a data protection impact assessment (DPIA) and provide appropriate information to affected workers. Workers should refer to their employer's own privacy notice for information about how their personal data is processed.
Vilmak does not independently determine employment outcomes, disciplinary action, or other employment decisions based on worker activity data. The platform provides operational visibility — live station status, quality breach alerts, and production/scrap records — and does not make or recommend judgments about individual worker performance. Any such decisions remain entirely the responsibility of the tenant company.
Where Vilmak processes worker data solely on behalf of the tenant company and in accordance with its documented instructions, Vilmak acts as a data processor, with the tenant company remaining responsible for the purposes and lawful basis of that processing.
We use a small number of subprocessors to run the service. We do not sell personal data, and we do not use advertising or analytics networks. We may also use other service providers where necessary to operate the platform, subject to appropriate contractual and data-protection safeguards. Where required, material changes to our subprocessors will be communicated to affected tenant companies.
| Subprocessor | Purpose | Data involved |
|---|---|---|
| IONOS Cloud Ltd. (company number 3953678) | Hosting the platform's server and database (all application infrastructure) | All data stored in the platform |
| IONOS Cloud Ltd. (company number 3953678) | Sending transactional emails: password resets, scheduled reports, contact form notifications | Name, email address, report contents |
| IONOS Object Storage | Off-site storage of database backups, in addition to local backups | All data stored in the platform, as part of full-database backups |
The platform's primary server and database are hosted by IONOS Cloud Ltd. in a United Kingdom data centre. Database backups are additionally stored off-site with IONOS Object Storage in their eu-central-3 region (Berlin, Germany). This means personal data may be transferred outside the UK to the European Economic Area (EEA) as part of routine backups. The UK's data protection framework recognises the EEA as providing an adequate level of protection for personal data, so this transfer does not require additional safeguards beyond compliance with UK GDPR.
The Logical Auditor and vilmak.co.uk use only strictly necessary cookies — the session cookie that keeps you logged in, and a CSRF-protection cookie that helps secure form submissions. These cookies are used only where necessary for the operation and security of the service and are not used for advertising or analytics — but if analytics or marketing cookies are added later, this section and a cookie banner will need to be added.
Subject to some exceptions, UK GDPR gives you the right to:
If you are a factory worker, the shift and quality tracking features in this app are provided to your employer to help them coordinate production and maintain quality and safety standards. Requests about your in-app activity data should generally go to your employer first, since they are the data controller who decides how it's used — but if you contact Vilmak directly, where the tenant is the controller we will normally refer your request to the relevant tenant company and assist the tenant as required under our agreement and applicable data-protection law. If you are a tenant admin or a website visitor, contact info@vilmak.co.uk.
You also have the right to complain to the UK Information Commissioner's Office (ICO) if you believe your data has been mishandled.
We may update this policy from time to time. The "effective date" at the top will be updated when we do, and material changes will be communicated to tenant administrators.
Email: info@vilmak.co.uk