Company
Privacy policy
How VAULT 33|27 collects, uses, protects and deletes personal data, in plain language. Your rights under UK, EU and Serbian data protection law, and how to use them.
VAULT 33|27 · Updated 12 November 2026 · 5 min read
Privacy in one minute
- We collect only what we need to answer you and to do the work you ask for.
- We never sell your data, and we never use it to train AI models.
- We use a small number of trusted providers, under data processing agreements.
- We delete data when we no longer need it.
- You can ask to see, correct or delete your data at any time by writing to office@vault3327.com.
Who we are
This website, vault3327.com, is operated by VAULT 33|27 ("we", "us"), working from London, United Kingdom, and Belgrade, Serbia. We are the controller of the personal data described in this policy.
Contact for anything about privacy: office@vault3327.com or +44 7760 505030.
What we collect, why, and on what legal basis
| What | Where it comes from | Why we use it | Legal basis |
|---|---|---|---|
| Name, business name, email, phone, website, industry and your message | The free audit form | To review your business, reply and prepare a proposal | Steps you asked for before a contract; our legitimate interest in answering enquiries |
| Emails, calls and WhatsApp messages you send us | You contact us directly | To reply and keep a record of what was agreed | Legitimate interests; contract |
| Client project data | When you become a client | To deliver the work in our agreement | Contract |
| Invoicing details | When you become a client | Billing, accounting and tax | Legal obligation |
| Technical data such as IP address, browser and pages requested | Our hosting provider's server logs | Security, preventing abuse and keeping the site working | Legitimate interests |
We do not knowingly collect special category data (such as health information) through this website. Please do not include it in the audit form.
Cookies and analytics
This website sets no advertising or tracking cookies. To understand which pages are useful and to keep the site fast, we use Vercel Web Analytics and Vercel Speed Insights. Both are cookieless: they do not store anything on your device and do not keep personal information. Visits are counted in aggregate (page, referring site, country, device type and browser) and page-speed measurements are anonymous. Our legal basis is our legitimate interest in running and improving the website.
If we ever add non-essential cookies, they will only run after you agree through a consent banner. Our cookie policy lists everything this site stores.
Marketing
We do not add you to a mailing list because you asked for an audit. We send marketing only if you have clearly agreed, and every message includes a way to unsubscribe.
AI and automated decisions
We use AI tools to help us work faster, for example to summarise an audit or draft a reply. A person reviews everything before it reaches you. We do not make decisions with legal or similarly significant effects about you by automated means alone, and we do not use your data to train AI models.
Who we share data with
Only with providers who help us run our business, and only what they need:
| Provider | Purpose |
|---|---|
| Vercel | Website hosting, cookieless visit statistics and speed measurement |
| Resend | Delivering audit requests and emails |
| Email, calendar and CRM providers | Managing enquiries and client work |
| Accountants and professional advisers | Legal, tax and accounting obligations |
We may also disclose data where the law requires it. We never sell personal data.
International transfers
Some providers may process data outside the UK, the EEA or Serbia. When that happens we rely on recognised safeguards, such as adequacy decisions, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses.
How long we keep data
| Data | How long |
|---|---|
| Audit requests that do not become projects | Up to 24 months, then deleted |
| Client project data | For the length of our agreement, then up to 6 years for legal claims |
| Invoices and accounting records | As long as tax law requires, typically 6 years in the UK and up to 10 years in Serbia |
| Server logs | A short period set by our hosting provider |
How we protect data
Encrypted connections (HTTPS) everywhere, access limited to the people who need it, strong authentication on every account, and providers chosen for their security standards. No system is perfectly secure, so if a breach affecting your data ever occurs, we will act quickly and tell you and the authorities where the law requires it.
Your rights
Depending on where you live, UK GDPR, the EU GDPR and the Serbian Law on Personal Data Protection give you the right to:
- access the data we hold about you;
- correct data that is wrong;
- delete data we no longer need;
- restrict or object to how we use it, including for marketing at any time;
- move your data to another provider;
- withdraw consent where we rely on it.
Write to office@vault3327.com. We reply within one month and do not charge for reasonable requests. We may ask you to confirm your identity first.
Complaints
Please tell us first so we can put it right. You can also complain to your data protection authority: the Information Commissioner's Office (ICO) in the UK, the Commissioner for Information of Public Importance and Personal Data Protection in Serbia, or the supervisory authority in your EU country.
Children
Our services are for businesses. We do not knowingly collect data from children.
Changes to this policy
When we change this policy, we update the date at the top of the page. Significant changes will be made clear on this page.
Sources
Open your vault.
A free systems audit of your business: where enquiries leak and exactly what we would build.
Book your free audit