vendor policy