Privacy Policy

Last updated: 19 July 2026

This Privacy Policy explains how VAULTKEY LTD ("VaultKey", "we") collects and uses personal data when you use vaultkeys.net. We are the data controller. Contact: contact@vaultkeys.net, 128 City Road, London, EC1V 2NX, United Kingdom. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data we collect

Order data — name, email address, billing country, products bought, order value.
Payment data — processed entirely by our payment providers; we receive only confirmation of payment and the last digits/brand of the card, never full card numbers.
Support data — messages you send us, including screenshots of activation errors.
Technical data — IP address, device/browser information and site usage, collected via cookies and similar technologies (see the Cookie Policy).

2. Why we process it (lawful bases)

Contract — to take payment, deliver your keys by email and provide support.
Legal obligation — tax and accounting records, consumer-law compliance.
Legitimate interests — fraud prevention, service security, improving the store. We balance these interests against your rights.
Consent — marketing emails (only if you opt in; withdraw at any time) and non-essential cookies.

3. Sharing

We share data only with processors needed to run the store: Shopify (our e-commerce platform), payment providers, email delivery services, and professional advisers where legally required. We do not sell personal data. Some processors are outside the UK; transfers are protected by adequacy regulations or standard contractual clauses.

4. Retention

Order and invoice records are kept for 6 years after the tax year of purchase (HMRC requirement). Support correspondence is kept for 2 years after closure. Marketing consents are kept until withdrawn. Technical logs are kept up to 12 months.

5. Your rights

Under UK GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. You can withdraw consent at any time. To exercise any right, email contact@vaultkeys.net — we respond within one month. You may complain to the Information Commissioner's Office (ico.org.uk).