What we hold, why we hold it, who sees it, how long we keep it, and what you can ask us to do about it. Including the parts the law will not let us delete.
| Category | Examples | Where it comes from |
|---|---|---|
| Identity data | Title and full name, date of birth, gender, place of birth, nationality, country of residence, photograph, identity document images and chip data, selfie and facial match result | You, and our identity verification provider |
| Contact data | Home address, forwarding address, email, telephone number | You |
| Company and business data | Company name and number, officers, people with significant control, share structure, what the business does, why you need our service, how a new company will be funded | You, and the public register |
| Screening data | Sanctions, politically exposed person and adverse media results; electronic identity and address check results | Our identity verification and screening providers |
| Verification records | The checks we ran, the documents seen, the decision, who made it and when; notes of any video call (we do not record calls) | Us |
| Mail data | Sender, date received, type of item, scanned images of post addressed to you, forwarding requests | Post delivered to us, and you |
| Messages | What you send us by email or through the portal, and our replies, including any replies written by our AI assistant | You, and us |
| Transaction data | Orders, invoices, payment status, disputes. We never see or store full card numbers | You, and our payment processor |
| Technical data | IP address, browser, device, pages viewed, login and session records, the time you accepted our terms and asked us to start | Your use of our websites |
| How you found us | The website, search engine, AI assistant or advert that brought you to us, any campaign tags on the link, the page you first landed on, and your answer to "How did you hear about us?". If you clicked one of our adverts, the advert's click reference | Your visit, and you |
| Purpose | Lawful basis |
|---|---|
| Providing the services you ordered | Performance of a contract |
| Verifying identity, screening, risk-assessing and monitoring for money laundering and terrorist financing | Legal obligation, and substantial public interest for any special category data |
| Verifying identity for Companies House and telling Companies House | Legal obligation, and substantial public interest |
| Filing at Companies House and HMRC on your instruction | Performance of a contract |
| Receiving, scanning and forwarding your post | Performance of a contract |
| Answering your messages, including with our AI assistant | Performance of a contract, and legitimate interests in answering quickly |
| Running an AI tool you choose to use in the portal, such as explaining a letter | Performance of a contract, at your request |
| Taking payment, dealing with disputes and keeping accounting records | Contract, and legal obligation |
| Keeping our services secure and preventing fraud | Legitimate interests |
| Understanding which of our marketing works, from how you found us | Legitimate interests – and your consent where we remember it in your browser (see our Cookie Policy) |
| Telling Google Ads that an advert you clicked led to an order | Legitimate interests. Only if you clicked one of our adverts |
| Service emails about your account, your post and your deadlines | Performance of a contract |
| Marketing about our other services | Consent, or legitimate interests where you are an existing customer. You can opt out at any time |
Identity verification involves reading the chip in your identity document where it has one and comparing a selfie with the photograph on the document. Where this produces biometric data used to identify you, we rely on the substantial public interest conditions in the Data Protection Act 2018 for preventing or detecting unlawful acts, protecting the public against dishonesty and meeting regulatory requirements, and on our legal obligations as an Authorised Corporate Service Provider and an HMRC-supervised firm. The same conditions cover any information about offences that screening turns up. Our Appropriate Policy Document explains how we protect this data. We use biometric data only to verify you. It is never sold, and never used for anything else.
Anti-money laundering data. Personal data we obtain for our anti-money laundering checks is used only to prevent money laundering, terrorist financing and proliferation financing, unless the law allows another use or you agree to it.
If verification cannot be completed with technology, we confirm your likeness on a live video call. We do not record the call; we note the date, time and outcome on your file.
You cannot opt out of verification and still be appointed as a director or person with significant control – that requirement comes from Companies House, not from us.
Our systems flag some orders automatically for a closer look – for example an address outside the UK, or a card check that fails. A person at Vaulex Group makes every decision to accept or refuse a customer. We do not make decisions about you based solely on automated processing, and our AI assistant does not make decisions about identity checks, refunds, complaints or your account.
| Who | Why |
|---|---|
| Business Data Group Ltd (the eFiling platform) | Runs vaulex.co.uk: orders, payments on that site and company formation filings, and the anti-money laundering and identity checks we run through it – including for some portal customers |
| nCino Identity Solutions | Identity verification technology and screening |
| Credit reference agencies, such as Equifax | Electronic identity and address checks. The agencies explain how they use data in their Credit Reference Agency Information Notice (CRAIN) |
| Stripe | Card payments and fraud prevention on both sites |
| Companies House and HMRC | Filings, identity verification statements and registrations we make on your instruction or as the law requires |
| The AI service behind our AI assistant and the portal's AI tools – Google does not use this content to improve its products, and keeps it only for a limited period to detect misuse. reCAPTCHA, which protects some forms on vaulex.co.uk from automated abuse. And Google Ads, only if you clicked one of our adverts: the advert's click reference and the date and value of your order | |
| Mailgun and SendGrid | Delivering our emails |
| Zoom | Video calls, where we verify you on a call |
| WhatsApp (Meta) | Only if you choose to message us on WhatsApp |
| Royal Mail and DHL | Delivering post and parcels you ask us to forward |
| A qualified accountant | Only where you buy an accountant-checked registration: the application data and trading evidence, under a written data processing agreement, never our identity or anti-money laundering file |
| Our hosting provider | Runs the server, in a UK data centre, that hosts the portal and stores documents, under contract and on our instructions only |
| Law enforcement, the National Crime Agency, HMRC and our supervisors | Where we are legally required to report or disclose. We may be prohibited by law from telling you |
Each provider processes only what it needs, under contract. We do not sell personal data, and we do not share it with advertisers.
Our portal and its document storage are hosted in the United Kingdom. Some of our providers process data outside the UK – for example Stripe, Google and our email delivery providers. Where they do, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum.
| Data | Retention | Why |
|---|---|---|
| Identity, screening and anti-money laundering records | Until 5 years after our relationship ends, or 7 years from the date of an identity check for Companies House, whichever is later | Money Laundering Regulations, and Companies House ACSP duties |
| Filing records | 7 years | Statutory record keeping |
| Accounting records | 6 years after the end of the financial year | Companies Act and HMRC |
| Account, messages and mail log | 5 years after our relationship ends | Service delivery, and evidence of our checks |
| Scanned mail | While you are a customer, plus 12 months – or less, if you ask us to delete it when you leave | Service delivery |
| Physical mail | 90 days (30 days after your service ends, if sooner), then securely destroyed | Service delivery |
| Advert click references | 90 days | Telling the ad platform which adverts led to orders |
| Website and marketing data | 26 months from last activity | Legitimate interests |
An important limit on erasure. Because the law requires us to keep identity and anti-money laundering records for these periods, we cannot delete them on request, even if you close your account. We can still restrict how they are used.
You have the right to access your data, to have inaccurate data corrected, to erasure where no legal obligation requires us to keep it, to restrict or object to processing, to data portability, and to withdraw consent where consent is the basis we rely on. You can object at any time to our use of your data for marketing, and to our use of how you found us.
To exercise any of these, email compliance@vaulex.co.uk or message us from your portal. We respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first – see our Complaints Procedure.
Some of what you give us is published by Companies House and is outside our control once filed: company name, registered office, officer names and service addresses, month and year of birth, and details of people with significant control. Your usual residential address, the day of your date of birth and your Companies House personal code are not published. This is precisely why we include a director's service address in our formation and switch packages.
Access to your records is restricted to people who need it, and staff logins use two-step verification. Documents you upload to the portal – including identity documents – and scans of your post are encrypted when we store them, and every view of an identity document is logged. Everything you send us through our websites is encrypted in transit. Card payments are handled by a PCI DSS Level 1 payment processor and card details never touch our servers.
See our Cookie Policy.
We will post any change here with a new version number and date, and tell you by email if the change materially affects you.
Cookies. This site sets only the essential cookies it needs to work. With your permission we also use analytics cookies to understand how the site is used – nothing else, and never for advertising. Cookie policy