Privacy Policy

Vaulted acts as data controller for information collected through this website, our correspondence channels and our client onboarding files. Where a licensed partner (bank, electronic money institution, card programme manager, payment service provider) becomes the counterparty of record, that partner acts as an independent controller under its own privacy notice, which we make available on request.

Requests may be sent to compliance@vaulted.ae. We respond within thirty (30) calendar days.

Depending on the service, we may collect and process:

• Identification data (full legal name, date and place of birth, nationality, residential address, identity document number and expiry).
• Contact data (email and messaging handles).
• Corporate data (registered office, directors, shareholders, ultimate beneficial owners, group structure).
• Financial data (source of funds, source of wealth, expected activity, banking references, historic statements).
• Screening data (sanctions, PEP and adverse media results returned by our screening vendors).
• Technical data (IP address, browser fingerprint, session logs) collected automatically for security and fraud prevention.

• Performing our engagement with you (contract).
• Complying with anti-money-laundering, counter-terrorist-financing, sanctions and tax-reporting obligations (legal obligation).
• Preventing fraud and protecting the integrity of the services (legitimate interest).
• Communicating with you about your engagement and about relevant service updates (legitimate interest).
• Responding to lawful requests by public authorities (legal obligation).

We share information strictly on a need-to-know basis with regulated partners underwriting your account (banks, EMIs, payment processors, card programmes), professional advisers (auditors, lawyers, tax counsel), corporate service providers executing formations, and technology processors (secure document storage, screening databases). Every processor is bound by written data-processing terms and confidentiality.

Vaulted operates from the United Arab Emirates and Hong Kong SAR and works with partners globally. When we transfer personal data outside the EEA or the UK, we rely on Standard Contractual Clauses, adequacy decisions or equivalent legal mechanisms. Copies of the safeguards in place for a specific engagement are available on written request.

Onboarding and transactional records are retained for a minimum of five (5) years after the end of the business relationship or the date of the occasional transaction, extended where a longer period is required by applicable law or by a partner institution. After the retention period expires records are securely destroyed or anonymised.

Subject to applicable law, you have the right to access your personal data, request rectification of inaccurate data, request erasure where processing is no longer necessary, object to processing based on legitimate interest, request restriction of processing, and, where relevant, receive your data in a portable format. To exercise a right, contact compliance@vaulted.ae. If you are not satisfied with our response you may lodge a complaint with your local supervisory authority.

We apply access controls, encryption in transit and at rest for stored documents, dual-approval for outbound transmissions of sensitive files, and physical safeguards at our offices. Notwithstanding these measures, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

We may update this policy from time to time. Material changes will be brought to the attention of active clients. The date at the top of this page indicates when the policy was last revised.