Privacy Policy

We at Vault America respect the privacy and confidentiality of personal data in our possession or under our control. We have implemented policies and practices to safeguard the collection, use, disclosure, storage and other processing of personal data provided to us as a controller.¹

We will not process personal data provided to us as a controller unless:

• we process it for a lawful purpose directly related to our business activity and the processing is necessary for, or directly related to, that purpose and
• the personal data is adequate but not excessive in relation to that purpose

(An end user of our data backup service might provide personal data to us when we provide that backup service to them. If so, the end user provides it to us under a processing contract within the meaning of the General Data Protection Regulation (GDPR). Any such personal data is outside the scope of this Data Privacy Notice. For information about how it is processed by the controller, please refer to the Data Privacy Notice published by the relevant controller.)

We collect and use the following personal data about you in the following circumstances:

1. if you sign up for our data backup service:
   • we collect your IP Address, domain name, email address, business name, user-name, passwords, account access and name
   • use that personal data for the purpose of enabling you to log into your account with us and manage the purchased service
   • we do not disclose that personal data to anyone
2. if we meet you (for example, at a trade show) or you disclose it in a business, industry or similar publication:
   • we collect your name, job title, business address, business contact numbers and any other personal data on your business name card and
   • use that personal data to contact you when we market our business services to you and, if you or the business you represent becomes a Vault America partner, to contact you for ongoing business purposes and
   • we do not disclose that personal data to anyone
3. if you visit one of our websites and register with us:
   • we collect the above information together with your user-name, passwords and accounts access
   • use that personal data for the purpose of enabling you to log into your account with us
   • we do not disclose that personal data to anyone
4. if you contact us by telephone or email:
   • we collect your telephone number or email address, respectively, and the information about you that you voluntarily provide to us during that conversation or email exchange and
   • use that personal data only to respond to your specific inquiry, except where you decide subsequently to become one of our partners and we continue to use such information for ongoing business purposes and
   • do not disclose that personal data to anyone, except to the extent that it is reasonably necessary for us to do so if you decide subsequently to become one of our partners
5. if you apply for a job with us, information about how we collect is located in this document, use and disclose personal data that you provide to us and if you are an employee or an ex employee for such information is located in this document

If you apply for a job with us, we collect your:

• name, address and contact details
• professional experience and qualifications
• work/job history
• current and past remunerations

We use such personal data only for the purposes of making a decision about whether to hire you or not. We may disclose it to a related corporation, but we do not otherwise disclose it to anyone unless we hire you and disclose it for employment purposes as set out here.

If we offer you a job and you accept it, we collect:

• bank account details
• marital status
• spouse’s name and identification number
• children’s name and identification number

We use such personal data, together with the personal data you provide to us during the recruitment process, for the purpose of managing (and, where relevant, terminating) your employment relationship with us.

We disclose such personal data to our:

• outsourced payroll services provider
• our external auditors and
• our insurance company for corporate insurance coverage

We may process personal data about you if the processing is necessary:

• for the performance of a contract between you and us
• for taking steps at your request with a view to entering into a contract
• for compliance with any legal obligation to which we are subject (other than an obligation imposed by contract)
• to protect your vital interests (which means matters relating to your life, death or security)
• for the administration of justice and for the exercise of functions conferred on any person or under any law

Otherwise, we will obtain your consent prior to collection or processing.

Personal data about you that we process may or may not be sensitive personal data, such as information your race, ethnic original, political opinions, your religious beliefs or other beliefs of a similar nature, about your physical or mental health or condition, the commission or alleged commission by you of any offence as well as any government issued identification such as social security numbers, licenses, etc.

We will not process any sensitive personal data about you unless we get your express consent to do so and the processing is necessary for a purpose permitted by law. Please contact us if you would like information about these purposes.

Where we obtain consent from you, whether or not the personal data is sensitive personal data, we will tell you whether it is obligatory or voluntary for you to supply the personal data, and where it is obligatory, the consequences for you if you fail to supply the personal data.

If you have given us consent to collect, use, disclose, store and otherwise process personal data about you, you may withdraw that consent at any time. This includes any circumstances where we have relied on you being deemed to have given us such consent.

You should give us reasonable advance notice of your withdrawal of consent. We will inform you of the likely consequences of withdrawing your consent. For example, if we need your consent so that we can provide a service to you and you decide to withdraw your consent we may not be able to continue to provide that service to you.

Your request for the withdrawal of consent can take the form of an email or letter to us, or online by submiting a support request at the following link: https://www.vaultamerica.com/support/. Where relevant, we may need you to provide proof of your identity.

You may give us notice in writing at any time telling us to restrict the processing of your personal data:

• for a period enabling us to verify the accuracy of personal data where you contest the accuracy of that personal data
• if the processing is unlawful and you oppose the erasure of the personal data and requests the restriction of their use instead
• if we no longer need the personal data for the purposes of the processing, but the personal data are required by you for establishing, exercising or defending legal claims
• you have objected to us processing the personal data based on our legitimate grounds overriding your legitimate interests

Do note that where you restrict processing in such circumstances we will still be able to store the personal data, but with some exceptions will only be able to otherwise process it with your consent. Please contact us if you would like to know about the exceptions.

Your request to restrict any processing of your personal data can take the form of an email or letter to us. We may need you to provide proof of your identity.

You may ask us (in writing) to inform you what personal data we hold and information about how we may have used and/or disclosed it in the previous one year.

You may ask us (in writing) for details about what is being processed by us or by a service provider on our behalf for a particular purpose and, if you say that you would like to receive it, to give you a copy of that personal data in an intelligible form and in a form that is easily portable.

You need to ask us separately for such access to personal data that we hold for each different purpose. We may charge you a reasonable fee for each access request you make to us if there is a cost involved.

We will respond to your request for access to personal data about you as soon as reasonably possible and, in any event, within 30 days after we receive the request from you. If we are not able to fulfil your request fully within 30 days, we will let you know the reasons, comply with the access request to the extent that we are able to do so within that period and comply with it fully as soon as we are able to do so.

When you make such a request, we may need to verify your identity

We will take reasonable steps to ensure that the personal data we collect about you is accurate, complete, not misleading and kept up-to-date by having regard to the purpose, including any indirectly related purpose, for which we collect the personal data and further process it.

You may ask us to correct personal data about you where the personal data is inaccurate, incomplete, misleading or not up-to-date. Where we are satisfied that the correction should be made, we will make it within a reasonable time framework from the date we receive your request and give you a copy of the corrected personal data.

From time to time, we may do a verification exercise for you to update us on us on any changes to the personal data we hold about you. If we are in an ongoing relationship with you, it is important that you update us if there are any changes in the personal data we hold about you (such as a change in your personal address).

We have implemented an Information Security Policy that governs how we protect personal data.
We take practical steps to protect personal data from any loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction having regard to:

• the nature of the personal data and the harm that would result from any such thing happening
• the place or location where we store the personal data
• any security measures incorporated into any equipment in which the personal data is stored
• the measures taken for ensuring the reliability, integrity and competence of the personnel having access to the personal data and
• the measures taken for ensuring the secure transfer of the personal data

Entities that provide services to us to process personal data on our behalf will be bound by contracts with us that require them to provide sufficient guarantees in respect of the technical and organizational security measures governing the processing to be carried out and to take reasonable steps to ensure compliance with those measures.

We have a Storage Limitation Policy / Document Retention Policy that spells out when we must cease to retain personal data and that requires documents and personal data to be destroyed (paper documents) or deleted (electronic documents and data stored in databases) securely. Certain retention periods are based on statutory or regulatory requirements.

If you are located in the Americas we keep your personal data in servers located in the United States.

We may use cookies on our site (www.vaultamerica.com) because they help us to provide you with a good experience when you browse our website and they enable us to improve our site by giving us information about how you use it. By continuing to browse our website, you are agreeing to our use of cookies.
A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive.

We may use cookies for the following purposes:

• operating our website
• recognizing and counting the number of visitors to our website and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users find what they are looking for easily
• recognizing you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region) and
• recording your visit to our website, the pages you have visited and the links you have followed

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our site.

Where required to do so by law, we will disclose personal data about you to the relevant authorities or to law enforcement agencies.

Our website may contain links to other websites that are not operated by us. If you click on a third party link, you will be directed to that third party’s website. It is important that you review the Privacy Policy of every site you visit. We have no control over, and are unable to assume any responsibility for, the content, privacy policies or practices of any third party sites or services.

We may update the Data Privacy Notice from time to time. We will notify you of any changes by posting the policy on this page. Please revisit this page periodically for any changes.

Changes to this Policy are effective when they are posted on this page.

If you have any questions about our collection, use, and/or disclosure of personal data about you; feedback regarding this Data Privacy Notice, or any complaint you have relating to how we collect, use, disclose and store personal data about you, you may contact us as follows:

• zkarsan@vaultamerica.com
• 1-888-523-3282 x810
• One Boston Place, Suite 2600, Boston Massachusetts 02108

Any query or complaint should include, at least, the following details:

• Your full name and contact information
• A brief description of your query or complaint

If you are a gmail user or your email is hosted by Google Suite and you have subscribed to our solution to backup your emails. We will use Google’s APIs to access all your mailbox, emails, contacts and calendar details. Pull them to our backup solution and store them encrypted in our cloud storage.

If you are to use the restore function, we will retrieve emails backed up and push it to your mailbox through Google’s APIs. Your data will not be shared with any third party unless there is a legal requirement to do so.

For more information about OAuth consent please visit https://console.developers.google.com/getting-started

¹ ‘Controller’ means the person (which includes a company, for example) that determines the purposes and means of the processing of personal data.