Last updated: October, 2026
Applicability of Privacy Statement
This is the Privacy Statement of Virtual Vaults Nederland B.V. which applies to the websites within the virtualvaults.com domain (hereinafter jointly referred to as: “Websites”) and the services on the Virtual Vaults software-as-a-service platform (hereinafter "Services"). This statement provides you, as a user of the Websites and Services, insight into what data of yours Virtual Vaults processes during your visit to these web pages, the purposes for which Virtual Vaults processes the data and the way in which the data is processed.
This Privacy Statement does not apply to the processing of your personal data when using the Service by or on behalf of Virtual Vaults customers. For information regarding the processing of your personal data by customers using the Virtual Vaults services, please refer to the organization on behalf of which you have gained access to the Service.
To the extent there are links on our Websites to third-party websites, after clicking the aforementioned links you will be redirected to the website of the relevant third-party (hereinafter: “Third-Party Websites”). The use of such Third-Party Websites is subject to the privacy statement of the relevant third party. You should read the privacy statement of these third parties to understand how this party handles your personal data. Virtual Vaults is not responsible for the information that is provided, processed or collected by third parties during the visits of these Third-Party Websites.
Users and Customers may also choose to connect third-party applications or services to the Services. The use of such third-party applications or services may be subject to the terms and privacy statements of the relevant third party. Further information regarding such integrations is provided below under "Third Party Applications and Integrations"
What personal data does Virtual Vaults collect, receive and use, and from whom?
Personal data is any information that directly or indirectly relates to an identified or identifiable individual such as a name, address, email address, telephone number or job title. Virtual Vaults processes personal data of individuals with whom it has, has had, or seeks to have a direct or indirect relationship, including customers, prospective customers and their representatives, individuals associated with organizations with which Virtual Vaults has a relationship and visitors to the Websites. Virtual Vaults does not review or verify the Content uploaded by Customers to its Services and therefore does not know whether and which personal data may be contained in such Content Customers are responsible for ensuring that any personal data uploaded to the Services is processed in accordance with applicable laws and regulations.
Depending on your use of the Services, Virtual Vaults may also process technical, usage and audit data, including account and user identifiers, login and access records, actions performed within the Service, documents viewed or downloaded, IP address, device and browser information, and technical information relating to integrations, APIs and MCP server usage, such as the application used, functions called, request parameters and related metadata.
Below is a description of each type of processing, the basis for processing and the applicable retention period.
Use of our services
Description and scope of data processing.
When you wish to use our services, we process the data you provide with the purpose of entering into an agreement and concluding a contract between you and us. To use our services, registration on our website is also required, which involves your (company) email address, first name, last name, and a password. You may also voluntarily provide your company and job title. For payment of the agreed price, we require your payment details. Your bank details are necessary because we collect the payable amount through automatic debit. The payment data is transmitted to our authorized payment provider. Without providing this information, we cannot execute the agreement. We do not have control over the content you upload to our platform. This content may include personal data. It is the customer's responsibility to ensure that they can lawfully process personal data on our platform.
When you use the Service, Virtual Vaults also generates and processes service usage and audit records. These records may include login activity, timestamps, actions performed within the Service, documents viewed or downloaded, IP address, browser and device information, and technical information relating to integrations, APIs and MCP server usage. Such records are necessary to operate, secure, maintain and support the Service.
When Virtual Vaults processes data solely to provide, maintain and secure the Services for a customer, we generally act as that customer’s processor. When we process limited account, security and usage information for our own purposes, such as protecting our platform, preventing fraud, complying with law and managing legal claims, Virtual Vaults Nederland B.V. acts as controller. The relevant role may depend on the particular processing purpose.
Third Party Applications and Integrations
Users and Customers may choose to connect third-party applications to the Service, including AI-enabled applications, through available integrations, APIs or MCP (Model Context Protocol) services.
Such applications are provided by independent third parties and are not operated by Virtual Vaults. Any personal data or content that a User or Customer chooses to share with those applications will be processed by the relevant third-party provider in accordance with its own terms, privacy notices and policies.
Virtual Vaults is not responsible for the privacy, security or processing activities of such third-party providers. Users and Customers should carefully review the applicable terms and privacy notices of those providers before sharing data through such integrations.
The decision to connect a third-party application and to transfer data to that application remains the responsibility of the relevant User or Customer.
Purpose and legal basis for processing.
The purpose of processing is the execution and handling of the agreement with you, our customer. In connection with the provision of the Services, Virtual Vaults may also process personal data to authenticate User(s), manage access rights, maintain audit trails and activity records, protect the security and integrity of the Services, detect and prevent fraud, misuse or security incidents, provide customer support, troubleshoot technical issues, monitor performance and reliability, comply with legal obligations and improve the functionality and effectiveness of the Services.
In individual cases, data processing may result from legal requirements. These legal obligations may include compliance with retention and identification requirements, tax audit notifications, reporting obligations, and data processing in response to requests from authorities. Data processing may take place in the pursuit of our legitimate interests. It may be necessary to further process the personal data you provide beyond the actual execution of the agreement to improve our services. If you participate in a contract offer we provide using a digital signature (e.g., DocuSign), we process your data, including your email address, IP address, and the time at which you edited, released, viewed, or digitally signed the respective contract document, each with a timestamp. Our legitimate interest is an efficient and swift digital handling of the contract signing process, as well as the associated recording of the signing process for evidentiary purposes.
Service usage, audit and security logs are retained only for as long as necessary for the purposes described above, including security monitoring, troubleshooting, compliance and audit purposes. Retention periods may vary depending on the nature of the log and applicable legal or contractual requirements.
When Virtual Vaults receives email or other communication from you with any questions or requests addressed to Virtual Vaults, these messages will be used as long as needed to: a. process your questions/respond to your requests (user communications), and b. on the basis of our justified interest to be able to show that and how your request was responded to. Should you have a complaint about how your request was handled, Virtual Vaults may ask the Personal Data Authority to show how these requests were handled.
The personal data in request from you as per the previous subparagraph and the response to this is stored for up to 5 years after which the personal data will be deleted. If the data has been anonymised, the data may be retained by Virtual Vaults for a longer period of time. Anonymised means that the data has been cleaned of elements that allow the data to be traced back to you.
Newsletters, white papers and other data sheets
If you wish to download whitepapers or other information from the Websites, Virtual Vaults may ask for your name and email address to send you the respective information. To also inquire about information about relevant products and services of Virtual Vaults by phone or email, some additional information, such as your phone number, gender, organization and job title, may be asked. If you have given your consent to Virtual Vaults to receive a newsletter, your name and email address will be used to send it. Each newsletter that you receive gives you the opportunity to unsubscribe from the newsletter.
If you have successfully unsubscribed from a newsletter, Virtual Vaults will remove your personal data (name and email address) collected for sending the newsletter. If the data has been anonymised, the data may be retained by Virtual Vaults for a longer period.
Market research and marketing
Virtual Vaults performs (desktop) research and, in this context, may gather (additional) information about you that can be found about your business identity and is industry related. For example, information can be found about you via public online sources. These include social media channels such as LinkedIn, Twitter and mena.nl (deal information), but also public lists of, for example, fast-growing companies or guest lists of events attended by Virtual Vaults. Virtual Vaults may also use the information it receives from you when you become a user of one of the Services. Virtual Vaults collects all this data on the basis of its legitimate interest to develop direct marketing activities.
The data will be updated periodically, and the obsolete data will be removed. Virtual Vaults stores this data no longer than five years after the last contact.
Personal data in content of Virtual Vaults customers
The content that Virtual Vaults customers upload to the Services sometimes includes personal data. Virtual Vaults do not see or verify this. If you have questions about this, please contact the customer.
Within sixty days after the termination of a Service, the content will be deleted from the active systems. Within ninety days after the termination of a Service, the Content will be deleted from the backup systems.
Cookies
In order to enable you as a user of the Websites to use the full functionality of the Websites and to analyse the use of and navigation within the Websites and to display relevant advertisements, Virtual Vaults installs small amounts of information (cookies or similar technologies) on the peripheral devices used by its users (such as a laptop, tablet, phone) or Virtual Vaults reads the information as located in the browser settings on the peripheral devices of its users.
Recipients of personal data
Within Virtual Vaults, only those departments or individuals have access to your personal data who require it to fulfill our contractual and legal obligations. Your data is only shared with recipients outside of Virtual Vaults when it is legally permissible or required, when sharing personal data is necessary to fulfill the contract, or when you provide us with your consent. Categories of recipients in this case include:
• IT sector providers
• Customer management system providers
• Email marketing providers
Virtual Vaults shares personal data with third parties in the following cases:
• When processors of Virtual Vaults perform (part of) the services assigned to them. These third parties may only process the data at Virtual Vaults request and process such data according to instructions of Virtual Vaults. The processors of Virtual Vaults can be found here.
• When Virtual Vaults in good faith believes that the granting of access, processing, use, or provision to competent courts, regulators, or other regulatory agencies of the data requested by them is necessary to comply with applicable laws and regulations, is necessary for the context of judicial proceedings or to comply with an enforceable request from the respective regulatory authority;
• When Virtual Vaults believes in good faith that accessing, processing, using or providing to external IT experts and/or security agencies the data requested by them is necessary for the legitimate interest of detecting, preventing or otherwise dealing with fraud, technical or security problems;
• When Virtual Vaults has received your prior express consent.
Transmission of personal data to a recipient from a third country or to an international organization
Your personal data may be transferred by Virtual Vaults to countries outside of the EU/EEA. Appropriate safeguards are considered with processors to which this applies. Virtual Vaults has often concluded Standard Contractual Clauses with them. The impact of processing outside the EEA is also considered.
You can receive more information regarding the aforementioned security measure taken by contacting Virtual Vaults. See below in this Privacy Statement for the relevant contact details.
Security
Virtual Vaults will handle your personal data with the utmost care. Virtual Vaults takes appropriate security measures as protection against unauthorized access to or unauthorized modification, disclosure or destruction of data. This includes internal monitoring of the policies and security measures with respect to the collection, storing and processing of data, as well as physical security measures to protect against unauthorized access to systems on which Virtual Vaults stores personal data. Virtual Vaults processes personal data for the purposes for which it is collected and in accordance with this Privacy Statement.
Virtual Vaults is ISO 27001:2013 certified (information security management system). You can find out more about the security here.
Your rights
As a data subject, you have certain rights concerning your personal data that we process. These rights include:
1. Right to Access: You have the right to know which personal data we process about you and to request a copy of this data.
2. Right to Rectification: If your personal data is incorrect or incomplete, you have the right to request corrections.
3. Right to Erasure: You can request the deletion of your personal data if there is no legal reason for us to retain it.
4. Right to Restriction of Processing: In some cases, you can request that we limit the processing of your data, for instance, if you dispute the accuracy of the data.
5. Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transfer this data to another data controller.
6. Right to Object: If we process your data based on legitimate interests or for direct marketing, you can object to this processing.
7. Right to Withdraw Consent: If the processing is based on your consent, you can withdraw that consent at any time.
To exercise these rights or for any questions concerning your personal data, you can contact us using the contact information provided in this policy. Please note that there may be certain legal exceptions and conditions regarding these rights. We will make reasonable and good faith efforts to comply with your requests in accordance with applicable data protection legislation.
Handling of the request
If Virtual Vaults receives a request from you, Virtual Vaults may ask you to identify yourself before Virtual Vaults will answer and process the request. Virtual Vaults does this to prevent someone pretending to be you from accessing your personal data or having it changed. Virtual Vaults will process your request within the time limits set out in the GDPR.
You can submit a request as described here above, in writing by email or by post. Contact information of Virtual Vaults can be found under the header “Questions and complaints procedure”.
Virtual Vaults will not charge you for answering your requests under the GDPR. Nor for further processing thereof.
Questions and complaints procedure
Should you have any questions or have a complaint regarding the processing of your personal data by Virtual Vaults, you can report these at no charge and easily to Virtual Vaults, in the following manner:
• By email: security@virtualvaults.com
• By post: Virtual Vaults Nederland B.V., K.P. van der Mandelelaan 60, 3062 MB, Rotterdam, The Netherlands
If you do not agree with Virtual Vaults response, then you may submit a complaint to the competent Personal Data Authority of the Member State in which you live. In the Netherlands, this is the Data Protection Authority. You can submit a complaint on the website of the Data Protection Authority in Dutch only. You can reach the Data Protection Authority via phone number in English: (+31) - (0) 70 - 888 85 00.
New developments and changes to the Privacy Statement
This Privacy Statement may be updated from time to time, for example to bring it in line with the laws and regulations that are applicable at that time. This Privacy Statement is dated October 2026.
