Last updated: 12 July 2026
This Privacy Policy explains how Vaulex Group Ltd (“Vaulex”, “we”, “us”, “our”) collects, uses, shares and protects your personal data when you use Vaulex Secure File Transfer. We handle your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
- Company: Vaulex Group Ltd, registered in England & Wales, Company No. 17004770
- Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
- Data protection contact: dpo@vaulex.co.uk
- ICO registration number: ZC087196
Vaulex Secure File Transfer is a trading name of Vaulex Group Ltd.
2. The two different roles we play
This is the most important thing to understand about this policy, and most file transfer services gloss over it.
- We are the data controller for your account information — your name, email address, phone number, billing records and how you use the service. We decide what to do with that, and this policy explains what.
- We are a data processor for the contents of the files you upload. Those files are yours. If they contain personal data about your own customers, employees or clients, you are the controller of that data and we simply hold and deliver it on your instructions. We do not open your files, we do not read them, and we do not scan their contents to profile you or to sell anything.
3. The personal data we collect
- Identity and contact data: your name, username, email address, telephone number and country.
- Account data: your password (stored hashed — we cannot read it) and any two-factor authentication settings.
- Transaction data: your plan, billing records and payment history.
- Transfer data: file names, file sizes, expiry dates, download activity, and the recipient email addresses you enter.
- Marketing data: your preferences for receiving marketing from us (see section 5A).
- Technical data: IP address, browser, device and approximate location, used for security and fraud prevention.
We do not collect special category data, and you should not upload it without appropriate safeguards of your own.
4. How and why we use your data
| What we use it for | Our lawful basis |
|---|---|
| Creating and running your account | Performance of a contract |
| Storing your files and delivering them to the recipients you choose | Performance of a contract |
| Sending service messages (transfer notifications, download alerts, receipts, password resets) | Performance of a contract |
| Taking payment and keeping financial records | Contract, and legal obligation |
| Security, fraud prevention and abuse detection | Legitimate interests |
| Sending you marketing from Vaulex and our group of brands | Consent (you can withdraw at any time) |
5. Card payments
We never see or store your card number. Payments are handled entirely by our payment providers, who are PCI-DSS compliant. We receive only a reference, the amount, and whether it succeeded.
5A. Marketing communications and our group of brands
We think you are entitled to know exactly what you are agreeing to before you tick a box, so this section is deliberately specific.
What you are consenting to
When you create an account you may tick an optional box asking us to email you offers and news. That box is never pre-ticked, and you can create an account, use the service and pay for a plan without ever ticking it. If you leave it blank, we will not send you marketing. Full stop.
If you do tick it, you are consenting to receive marketing from Vaulex Group Ltd about the services in the Vaulex ecosystem — company formation, virtual office and mail forwarding, business banking, capital and lending, business telecoms, virtual receptionist and call answering, web design and hosting, secure cloud storage, and accredited online training.
Our group of brands
Vaulex Secure File Transfer is one of several brands operated by companies under common ownership. The others are:
- Vaulex Group Ltd (Company No. 17004770) — Vaulex, Vaulex Flexible Financing, Vaulex Capital, Vaulex Telecom, Vaulex Web Design, Vaulex Call Answering, Vaulex Training Hub, Vaulex Secure File Transfer and SecureMyFiles.
- UKBOX Ltd — UKBOX (web hosting, web design and digital marketing).
- Velvet Rose Box Ltd (Company No. 12072329) — Rosebox, Spices2Go and RecipeBox (consumer retail and food).
How your consent is kept separate
This is the part that matters, and it is where most groups get it wrong.
We hold a separate consent record for each brand. Ticking the box on this website subscribes you to marketing from the Vaulex business services list only. It does not add you to the Rosebox, Spices2Go or RecipeBox consumer lists, and we will not move you between them. If you want to hear from a consumer brand, you sign up to that brand.
Against your record we store the basis of your consent, the date and time you gave it, the exact wording you agreed to, and how it was captured. That is your audit trail as much as it is ours — if you ever ask us to prove you agreed to something, we can.
Withdrawing consent
Every marketing email carries a one-click unsubscribe, and we honour it immediately — not “within 28 days”. You can also email dpo@vaulex.co.uk and ask to be removed from any or all Vaulex Group brands at once.
Unsubscribing from marketing does not affect the service emails you actually need — transfer notifications, download alerts, receipts, expiry warnings and security messages. Those are part of the service you asked for, not marketing, and we will keep sending them for as long as you hold an account.
The platform we use
Our marketing email is sent through Listmonk, a self-hosted mailing platform run by Vaulex on EU infrastructure, with delivery by Mailgun (EU region). We do not use third-party ad networks for email, we do not sell or rent our lists, and we do not share your address with other companies for their own marketing.
6. Who we share your data with
We use a small number of third parties to run the service. They act on our instructions, as our processors, and cannot use your data for their own purposes.
- Our hosting and object storage providers — to hold your uploaded files and account records.
- Mailgun (EU region) — to deliver our emails to you.
- Our payment providers — to take card and subscription payments (PCI-DSS compliant).
- Google reCAPTCHA — to stop automated signups.
We do not sell your personal data. We do not share it with advertisers. We will only disclose it to law enforcement where we are legally required to, or to prevent fraud or other crime.
7. International transfers
Your data is stored on servers in the United Kingdom and the European Economic Area. Where any provider processes data outside the UK, an appropriate safeguard is in place — a UK adequacy decision, or the International Data Transfer Agreement / Standard Contractual Clauses — so your data receives an equivalent level of protection.
8. How long we keep things
- Uploaded files: deleted automatically at the end of your plan’s retention period (2 days on the free plan, 7 days on Plus, or the expiry you set on Pro). Deleting a transfer yourself removes it immediately.
- Account data: for as long as your account is open. If your subscription lapses and is not renewed, the account and its files are removed after 30 days.
- Billing records: six years, because HMRC requires it.
- Security logs: up to 12 months.
- Marketing data: until you withdraw consent, after which we keep a minimal suppression record so we do not accidentally email you again.
9. Your rights
Under UK GDPR you have the right to: request access to your data; have inaccurate data corrected; have your data erased; restrict or object to how we use it; receive your data in a portable format; and withdraw consent to marketing at any time.
Email dpo@vaulex.co.uk and we will respond within one month. If you are unhappy with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
10. Security
Transfers are encrypted in transit. Passwords are hashed and cannot be recovered by us or anyone else. Two-factor authentication is available on your account and we recommend you turn it on. You can password-protect individual transfers and set them to expire.
No system is perfect. If we ever suffer a breach that puts your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay.
11. Cookies
See our Cookie Policy.
12. Complaints
Please contact us first at complaints@vaulex.co.uk. See our Complaints Policy for what happens next. You also have the right to complain directly to the ICO.
13. Changes
If we change this policy materially we will email account holders. The date at the top always tells you when it last changed.