Data Processing Agreement

1. Roles

Where we are the controller. For identity verification, anti-money laundering checks, screening, statutory filings, billing and our records of the service, Vaulex Group Ltd is an independent controller – the law requires us to hold and assess this data ourselves.

Where we are your processor. For the contents of your post that we scan, the documents you upload and the files you store with us, we process personal data on your instructions: you decide what is forwarded, downloaded, retained or (outside our statutory records) deleted. The rest of this agreement sets out the terms on which we do that.

2. What we process for you

• Subject matter and purpose: receiving, scanning, storing and forwarding your post; storing documents and files you give us; and, when you ask, running a portal AI tool on a document of yours.
• Types of data: whatever personal data appears in your post, documents and files – typically names, addresses and business correspondence.
• People it relates to: your staff, customers, suppliers and other correspondents.
• Duration: for as long as you are a customer, then as set out in section 7.

3. Our commitments as your processor

• We process your data only on your documented instructions – which include using our services as designed – unless the law requires otherwise, in which case we will tell you unless the law prevents us. If we think an instruction breaks data protection law, we tell you straight away.
• Everyone who handles your post and files is bound by confidentiality.
• We keep your data secure: restricted and logged access, two-step verification on staff logins to our portal, encryption in transit and when stored, and secure destruction of originals.
• We help you respond to requests from people exercising their data protection rights, and with your own security, breach and impact assessment obligations, as far as the service allows.
• We tell you without undue delay if we become aware of a personal data breach affecting your data.
• We give you the information you reasonably need to show that these commitments are met, and allow and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice.

4. Sub-processors

You authorise us to use the following providers, each under a written contract with data protection terms no less protective than these:

We will email you at least 30 days before adding or replacing a provider that processes your post or files, so you have the chance to object. For the providers we use as a controller – for example for identity checks and payments – see our Privacy Policy.

5. International transfers

Where a provider processes data outside the UK, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum.

6. What we do not do

We do not sell personal data, and we do not use your post or files for advertising, for training AI models, or for any purpose of our own beyond providing the service and meeting our legal obligations.

7. At the end of the service

When you leave, you choose – we ask you when you cancel in your portal: we delete your scans and files straight away, or keep them available for you to download for 12 months and then delete them. If you do not choose, we keep them for 12 months. Physical post is held for 30 days for collection or forwarding, then securely destroyed. Anti-money laundering and identity records are kept for the statutory periods set out in our Privacy Policy – we cannot delete them earlier, and we will not pretend otherwise.

8. Your rights and contact

You have the usual UK GDPR rights, including access, rectification, erasure where the law allows, portability, and the right to complain to the Information Commissioner's Office. Requests: email compliance@vaulex.co.uk or message us from your portal.