Data Processing Agreement

Last updated: 12 July 2026 · Forms part of our Terms & Conditions

1. Who this is between

This agreement is between you (the customer, acting as controller) and Vaulex Group Ltd, company number 17004770, of 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ (acting as processor). It forms part of our Terms & Conditions. Where they conflict on data protection, this agreement wins.

“UK GDPR” means the UK General Data Protection Regulation and the Data Protection Act 2018. “Customer Personal Data” means any personal data contained in the files and folders you put into the service.

2. What we will and will not do

We will:

• process Customer Personal Data only on your documented instructions — which, in practice, means storing it, keeping it available to you, and doing what you tell the software to do — unless the law requires otherwise, in which case we will tell you before we act unless we are legally barred from doing so;
• make sure everyone who can access the data is bound by a duty of confidentiality;
• apply appropriate technical and organisational security measures (see section 4);
• help you respond to requests from individuals exercising their rights;
• help you with data protection impact assessments and with consultations with the ICO, so far as is reasonable;
• tell you without undue delay if we become aware of a personal data breach affecting your data, and give you what you need to meet your own reporting duties;
• delete or return the data when the service ends (see section 6);
• make available the information you reasonably need to show that we are meeting these obligations, and allow for audits (see section 7).

We will not:

• use your data for our own purposes;
• sell it, mine it, or use it to train anything;
• look through your files, except where we must in order to run the service, fix a fault, respond to a lawful request, or investigate a report of abuse.

3. Your responsibilities

You confirm that you have a lawful basis for putting the data into Vaulex in the first place, that you have given the necessary privacy information to the people concerned, and that your instructions to us will not cause us to breach UK GDPR.

You are responsible for who you share folders with, and for removing access when someone no longer needs it.

4. Security measures

• Encryption of data in transit (HTTPS/TLS) and at rest.
• Storage in an ISO 27001, SOC 2 and PCI-DSS certified data centre in the United Kingdom.
• Passwords stored hashed; no plaintext password is retrievable by us.
• Card data never touches our systems — it is handled directly by Stripe.
• Access to production systems restricted to personnel who need it.
• Logging of access and administrative actions.
• Deleted files go to Trash, then to a deletion queue, and are removed from storage.

5. Sub-processors

You give us general authorisation to appoint the sub-processors listed below. We will give you reasonable notice before we add or replace one, and you may object on reasonable data protection grounds — in which case you may cancel your subscription without penalty if we cannot resolve it.

Note that Stripe, Mailgun and reCAPTCHA process account data, not the contents of your files. The only sub-processor that touches your files is Wasabi, and your files stay in the UK.

6. What happens at the end

When your account is closed, we delete Customer Personal Data from our live systems, ordinarily within 30 days, unless we are required by law to keep it. Please download anything you need before you close your account.

If you need a copy at the end and cannot get it yourself, ask us and we will help.

7. Audits

We will make available the information reasonably necessary to demonstrate our compliance with Article 28, including this page, our security description above, and the certifications held by our storage provider. If you need more than that — for example because your own regulator requires it — contact us and we will agree a proportionate approach. We may charge for our time on audits that go beyond the ordinary.

8. Processing details (Annex)

9. Liability and law

Each party’s liability under this agreement is subject to the limits set out in our Terms & Conditions. This agreement is governed by the law of England and Wales.