EKENUWhy might EKENU contact your accounts team?
EKENU is developing an early-stage business invoice resolution service. The purpose is to check whether an ordinary trade invoice was received, whether information is missing, or whether there is a genuine query to refer back to the supplier—before formal recovery becomes necessary.
Who would be contacting you?
EKENU is a trading name used by a UK sole trader based in Southampton, United Kingdom. For the legal operator’s identity, contact information and outstanding business-address requirements, see our service terms and business disclosures and main privacy notice. You can ask a question, object to a proposed contact or exercise your data rights at support@ekenu.com. A compliant full geographic establishment address is still being arranged before the managed service opens; we will not invent one.
Where would we obtain your information?
We may receive a work email address, business contact name or job role, organisation name and invoice reference from the supplier who asks for help. We would verify the appropriate business contact using relevant correspondence, the company’s public contact information, or a direct reply. We would not search for private personal phone numbers or contact family members.
What information and why?
Only the information reasonably needed to check an ordinary business invoice: the supplier’s name, invoice reference and agreed context, the business email/role of the relevant accounts-payable contact, the status question sent, and any response. No bank-password requests, credit-file enquiries, private phone-number harvesting or sale of contact data.
The envisaged purpose is to locate and resolve administrative delays such as a missing invoice, incorrect purchase-order reference, unconfirmed receipt, payment approval or a genuine issue requiring supplier review—not to make threats, initiate enforcement, or collect invoice funds. Any payment remains payable directly to the original supplier.
What legal basis would apply?
Where EKENU acts as an independent controller, a documented legitimate interests assessment may support a proportionate business-contact enquiry that the supplier has authorised, provided the impact on individuals does not outweigh those interests. Other lawful bases may apply to contract administration and legal obligations. We are reviewing EKENU’s controller/processor role for each processing activity before public managed intake begins; written agreements with business clients and suppliers must reflect the actual role. No lawful basis is presumed merely because a business requests contact.
Would you have to reply?
No. EKENU cannot demand a response or force payment. A relevant recipient may say the invoice is disputed, ask us not to contact them again, request correction, or refer us to a more appropriate business channel. We would pause and review rather than repeatedly chase or misrepresent any disagreement as a promise to pay.
Who might handle the data?
Cloudflare hosts the website and protected case workflow; email sending and receiving services would handle authorised correspondence, with other providers involved only when necessary. We assess their contracts, access controls, and any international transfer safeguards. Live managed-case processor arrangements have not yet been approved.
How long would it be kept?
Before live cases begin, EKENU must publish a specific retention schedule for case correspondence, complaint handling and legally necessary records, with deletion and review processes. The current prelaunch testing uses fictional records only. No promise of an unverified fixed retention period is made here.
Your information rights
Depending on the circumstances, you may ask for access to, correction, erasure or restriction of personal data, or object to processing based on legitimate interests. Email support@ekenu.com and include enough information for EKENU to locate the relevant contact without emailing sensitive documents. You can also complain to the Information Commissioner's Office.
Before any first live enquiry
EKENU must provide the actual business-contact privacy information in or with the first communication where required by UK GDPR Article 14, identify who it is acting for, and record the source, purpose and any objections. This proposed notice is not proof that all launch requirements are fulfilled.