PRIVACY NOTICE
V2.02 (Effective: 2026-08-18)
This notice explains how VaultN B.V. processes personal data in connection with the VaultN Platform and the vaultn.com website. VaultN operates exclusively as a business-to-business platform. This notice is addressed to business users and website visitors, not to individual consumers.
1. Who We Are
VaultN B.V. is a private company with limited liability, incorporated under the laws of the Netherlands (KvK: 80101704), with its registered office at Kon. Wilhelminaplein 13, Tower 1, Floor 14, 1062 HH Amsterdam, the Netherlands.
VaultN operates a cloud-based B2B digital distribution platform (the “VaultN Platform”) that enables publishers, distributors, and retailers to manage and transact digital inventory. The VaultN Platform is exclusively for business users. All users access the platform on behalf of a legal entity (their Organization) pursuant to a commercial agreement with VaultN.
For questions about this notice or to exercise your data protection rights, contact: [email protected].
VaultN does not process personal data of individual consumers as a data controller. If you are a consumer seeking to exercise data protection rights in connection with a digital product purchase, contact the publisher or retailer from whom you made that purchase. VaultN cannot fulfill consumer data subject requests.
Where personal data is incidentally submitted by a consumer through a VaultN public website enquiry or contact form, VaultN will process that data solely to respond to the enquiry. Any data protection request relating to such incidentally received data should be directed to [email protected] and VaultN will handle it in accordance with applicable data protection law.
2. Scope of This Notice
This notice covers personal data processed by VaultN in its capacity as an independent data controller. It applies to:
- vaultn.com — the public-facing VaultN website, including all pages, blog content, demo request forms, and contact forms.
- my.vaultn.com and sandbox.vaultn.com — the VaultN Platform and test environment, accessible only to registered business users.
This notice does not cover processing carried out by VaultN as a data processor on behalf of its clients. That processing is governed exclusively by the VaultN Data Processing Agreement (DPA), which forms part of the Agreement between VaultN and the relevant client. The DPA sets out the categories of data processed, processing purposes, retention periods, sub-processor arrangements, and data subject rights procedures applicable to processor-capacity processing.
This notice does not apply to third-party websites or services linked from the VaultN Platform or vaultn.com.
3. Personal Data We Process
In its capacity as an independent data controller, VaultN processes the following categories of personal data.
| Category | Data types | Where collected |
|---|---|---|
| Account and user data | Name, work email address, job title, Organization name, account credentials | Provided by you or your Organization on registration |
| Technical and session data | IP address, country code derived from geolocation, device type, browser type, login timestamps, session identifiers, API usage logs, and website performance measurement events (transiently including IP address and retained only in aggregated form) | Automatically collected on use of the Platform or website |
| Transaction data | Records of activity on the Platform including orders, distributions, billing events, and vault activity. Transaction Data is owned by VaultN per the Agreement, including derivative data generated from platform usage. | Generated through use of the Platform |
| Communications data | Content of emails, support tickets, demo requests, contact form submissions, and other correspondence with VaultN | Provided by you when contacting VaultN |
| Website and platform analytics data | Pseudonymous data on website and platform usage including pages visited, session duration, referral sources, and interaction events, collected via Google Analytics and Microsoft Clarity subject to your cookie consent. | Automatically collected on vaultn.com, my.vaultn.com, and sandbox.vaultn.com, subject to consent via vaultn.com/cookie-settings/ |
VaultN does not process special categories of personal data (Article 9 GDPR), children’s data, or consumer identity data. Platform processing is limited to authorized business-user data and pseudonymous technical identifiers.
4. Purposes and Legal Basis
| Purpose | Legal basis | Detail |
|---|---|---|
| Account registration and platform access | Art. 6(1)(b) — performance of contract | Processing account and user data is necessary to provide access to the VaultN Platform under the Agreement. |
| Service delivery and platform operations | Art. 6(1)(b) — performance of contract | Processing usage and transaction data is necessary to deliver the Services and Add-Ons under the Agreement. |
| Security, fraud prevention, and access control | Art. 6(1)(f) — legitimate interests | VaultN processes IP addresses, device identifiers, and country codes to detect fraud, enforce Sanctions and Restricted Market controls, and protect platform integrity. These interests are not overridden by your interests given the strictly B2B and contractual context. |
| Billing and financial administration | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation | Necessary to administer Charges under the Agreement and to comply with applicable accounting, tax, and anti-money laundering obligations (Wwft, BW Book 2). |
| Legal and regulatory compliance | Art. 6(1)(c) — legal obligation | VaultN processes personal data where required by applicable law including Dutch law (BW, Wft, Wwft), EU law, Sanctions obligations, and specific client contractual compliance requirements including Microsoft SSPA. |
| Platform improvement and analytics | Art. 6(1)(f) — legitimate interests; Art. 6(1)(a) — consent for analytics cookies | VaultN uses aggregated and pseudonymous data to improve the Platform and develop features. No individual profiling. Analytics cookies used only where consent given via vaultn.com/cookie-settings/. Cookie-free website performance measurement is carried out on the basis of legitimate interests, without placing cookies or storing data on your device. |
| Communications, support, and relationship management | Art. 6(1)(b) — contract; Art. 6(1)(f) — legitimate interests | Processing communications data is necessary to respond to queries, deliver support, and manage the commercial relationship. |
| Marketing and partner identification | Art. 6(1)(f) — legitimate interests | Subject to Section 9.1 of the Agreement, VaultN may identify your Organization as a user of the Services in marketing materials. You may opt out at any time by written notice. |
Where VaultN relies on legitimate interests, you have the right to object to that processing. See Section 8. Processing under a legal obligation or contract cannot be objected to on legitimate interest grounds.
5. Recipients and Sub-Processors
VaultN does not sell personal data to any third party.
Sub-processors
VaultN engages a limited set of sub-processors to support the provision of the Platform and Services. All sub-processors are subject to appropriate technical and organizational security measures, contractual data protection obligations, and Standard Contractual Clauses where required. The current sub-processor list is published at https://vaultn.com/subprocessor-list/ and is kept up to date. VaultN provides advance notice of material changes in accordance with the DPA and the Agreement. For the vaultn.com website, VaultN additionally uses Netlify, Inc. (United States) as website hosting provider and processor, including for aggregated website performance measurement, under a data processing agreement incorporating Standard Contractual Clauses.
Independent third-party controllers
Certain analytics services operate as independent data controllers under their own privacy terms and are not sub-processors of VaultN. These parties are disclosed at https://vaultn.com/subprocessor-list/ for transparency purposes only. They currently include Google Ireland Limited (Google Analytics) and Microsoft Corporation (Microsoft Clarity). VaultN is not responsible for how these parties process data under their own terms. VaultN receives only aggregated, pseudonymous reports from these services and does not receive individual-level personal data from either provider. For details of how Google Ireland Limited processes personal data as an independent controller, see https://policies.google.com/privacy. For details of how Microsoft Corporation processes personal data as an independent controller, see https://privacy.microsoft.com. Both parties are also listed at https://vaultn.com/subprocessor-list/ for reference.
Legal and regulatory disclosure
VaultN may disclose personal data to competent authorities (including the Autoriteit Persoonsgegevens), courts, or law enforcement where required by applicable law or binding order. Where legally permissible, VaultN will notify the relevant party before making such a disclosure.
Business transfers
In the event of a merger, acquisition, or transfer of all or part of VaultN’s business, personal data may be transferred to the relevant successor entity, subject to equivalent data protection obligations.
6. International Data Transfers
VaultN’s primary infrastructure is hosted on Microsoft Azure within the EEA. Certain sub-processors are located outside the EEA, including in the United States. Where personal data is transferred outside the EEA, VaultN ensures appropriate safeguards are in place, including:
- Standard Contractual Clauses (EU Commission Decision 2021/914); or
- an adequacy decision by the European Commission for the relevant country.
For transfers subject to UK GDPR, VaultN relies on the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, as applicable. The governing jurisdiction for SCC purposes is Ireland, consistent with VaultN’s principal data processing contractual arrangements.
Details of transfer mechanisms by sub-processor are available on request at [email protected].
7. Retention
VaultN retains personal data for no longer than necessary for the purpose for which it was collected, subject to any longer period required by law or contract.
| Category | Retention period | Basis |
|---|---|---|
| Account and user data | Duration of the Agreement plus 3 years, or longer if required by law | Contractual necessity; legal obligation (BW Art. 2:10 — 7-year accounting records) |
| Transaction data | 7 years from the date of the transaction, or up to 10 years for invoicing records where longer statutory retention obligations apply in the relevant jurisdiction | Legal obligation (Dutch tax and accounting law); for invoicing records, longer statutory retention obligations under applicable EU Member State law (including Article L123-22 of the French Code de commerce) |
| Communications data | 3 years from the date of the communication, or longer if related to an active dispute | Legitimate interests (dispute resolution, audit trail) |
| Technical and session data | Up to 12 months from collection, unless retained longer for active security or fraud investigation | Legitimate interests (security, fraud prevention) |
| Analytics data | As configured in the relevant analytics tool, subject to consent withdrawal | Consent |
| Processor-capacity data (DPA) | Duration of the Agreement plus up to 3 years for internal audit purposes, unless longer period required by law (DPA Clause 11.2) | DPA obligation |
At the end of the applicable retention period, personal data is securely deleted in accordance with VaultN’s Information Security Policy, using methods aligned with NIST SP 800-88.
8. Your Rights
Where VaultN processes your personal data as an independent data controller, you have the following rights under GDPR and the Uitvoeringswet AVG (UAVG).
| Right | What it means | Applicable conditions |
|---|---|---|
| Access (Art. 15) | Request a copy of personal data held about you as controller | Applies to controller-capacity data only. Data processed under the DPA must be requested through your Organization. |
| Rectification (Art. 16) | Request correction of inaccurate or incomplete data | Account data can be updated directly in the Platform. Other corrections via [email protected]. |
| Erasure (Art. 17) | Request deletion where data is no longer necessary or consent is withdrawn | Subject to mandatory retention obligations. Transaction and billing records cannot be erased during applicable retention periods. |
| Restriction (Art. 18) | Request that processing is restricted in certain circumstances | Applies where accuracy is contested, processing is unlawful, or an objection is pending. |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format | Applies only to data processed on the basis of consent or contract performance, and only to data you have provided directly. |
| Objection (Art. 21) | Object to processing based on legitimate interests | VaultN will assess objections against operational necessity and contractual obligations. Processing under a legal obligation or contract cannot be objected to on this basis. |
| Withdraw consent (Art. 7(3)) | Withdraw consent for analytics cookies at any time | Withdrawal does not affect prior processing. Manage preferences at vaultn.com/cookie-settings/. |
Submit requests in writing to [email protected]. VaultN will respond within one calendar month. VaultN may request identity verification before processing any request.
You have the right to lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or, where applicable, the UK Information Commissioner’s Office (ico.org.uk).
VaultN’s Platform is a B2B service. Data subject rights relating to platform account data should in the first instance be directed through your Organization’s Main User or account administrator.
9. Cookies
VaultN uses cookies and similar technologies on vaultn.com and on the VaultN Platform (my.vaultn.com and sandbox.vaultn.com). A unified cookie consent mechanism governs all cookies requiring consent across these domains. Preferences are managed at https://vaultn.com/cookie-settings/.
For full detail on the cookies used, their purposes, the parties that set them, retention periods, and how to manage your preferences, see the VaultN Cookie Notice at https://vaultn.com/cookie-notice/.
10. Security
VaultN implements technical and organizational security measures to protect personal data against unauthorized access, loss, destruction, alteration, or disclosure. These measures include AES-256 encryption at rest, TLS 1.2+ in transit, role-based access controls, multi-factor authentication, regular penetration testing, and controls aligned with ISO/IEC 27001:2022. Full details are set out in VaultN’s Information Security Policy, available upon request at [email protected].
In the event of a personal data breach for which VaultN acts as a controller, VaultN will notify the Autoriteit Persoonsgegevens in accordance with Article 33 GDPR and, where required, will notify affected individuals under Article 34 GDPR.
11. Changes to This Notice
12. Governing Law
VaultN B.V. — Kon. Wilhelminaplein 13, Tower 1, Floor 14, 1062 HH Amsterdam — KvK 80101704 — [email protected]