Vault2Trust Privacy and Security Policy

This Privacy and Security Policy explains how Vault2Trust collects, uses, stores, protects and transfers personal data of users, Clients, company representatives and other persons whose data is entered into or managed through the Vault2Trust Platform (https://vault2trust.com).

By creating an account, accessing the Platform, inviting users, uploading data or purchasing a subscription, you confirm that you have read and understood this Policy.

1. Controller and Applicable Law

Controller: "Zei Code AI" LLC, hereinafter "Vault2Trust", "we" or "us",
Office: str. Mihai Viteazul 4, mun. Chișinău, Republic of Moldova
Web: https://vault2trust.com
Privacy contact: [email protected]
Data Protection Officer (if appointed): Anatolie. [email protected]

This Policy is governed by:

a) Law No. 195 of 25 July 2024 on Personal Data Protection of the Republic of Moldova ("Law 195/2024"), in force since 23 August 2026, which transposes Regulation (EU) 2016/679 and replaced Law No. 133 of 8 July 2011;

b) Regulation (EU) 2016/679 (GDPR), to the extent it applies to us, in particular under Art. 3(2) GDPR where we offer services to Clients or monitor persons in the European Union or the European Economic Area;

c) the UK GDPR and the Data Protection Act 2018, and the Swiss Federal Act on Data Protection (FADP), where applicable;

d) Law No. 284 of 22 July 2004 on Information Society Services and Directive 2002/58/EC (ePrivacy) as regards cookies and electronic communications;

e) the Council of Europe Convention 108 and, to the extent applicable to Clients and users in other countries, local data protection laws (including Brazil's LGPD, California's CCPA/CPRA and the Russian Federal Law No. 152-FZ). The Client is responsible for compliance with the laws applicable to its own activity.

Article references in this Policy ("Art.") refer to Law 195/2024 and to the corresponding GDPR article, which carries the same number in Arts. 5–50.

2. Our Roles: Controller and Processor

2.1. Vault2Trust as controller (Art. 4, 24). We determine the purposes and means of processing for: account creation and administration; user identification and authentication; subscription, invoicing and payments; Platform security and fraud prevention; operational communications; technical support; legal, accounting and tax compliance; and defence of legal claims.

2.2. Vault2Trust as processor (Art. 28). For personal data that the Client or its Authorised Users enter, upload or generate about the Client's own clients, employees, collaborators, suppliers or other persons ("Client Personal Data"), the Client is the controller and Vault2Trust is the processor. We process such data only on the Client's documented instructions, as set out in the Terms and Conditions, this Policy and Section 8 below (Processor Terms).

2.3. The Client is responsible for the lawful basis for processing (Art. 6), for informing data subjects (Arts. 13–14), for obtaining consents (Art. 7), and for ensuring that data entered into the Platform is lawful, accurate and limited to what is necessary (Art. 5).

3. Categories of Personal Data

3.1. Identification data: first and last name, company name, position or capacity, IDNO (legal entities), IDNP or other national identification number where necessary (Art. 4, "national identification number"), data contained in uploaded documents.

3.2. Contact data: email, telephone, postal address, country, city, postal code.

3.3. Authentication data: email, password (stored only as a cryptographic hash, never in plain text), session tokens.

3.4. Platform activity data: logins, access date and time, actions performed, documents uploaded or generated, tasks, notes, comments, statuses, change history, roles and permissions.

3.5. Payment data: order number, bank transaction identifier, amount, currency, date and time, payment status and, where provided by the processor, the last four digits of the card. We do not store the full card number or CVV. Card data is processed exclusively by VictoriaBank or the payment processor used, on its own PCI DSS-compliant infrastructure.

3.6. Technical data: IP address, browser user agent, device type, operating system, preferred language, technically necessary cookies, session information, security logs.

3.7. Client Personal Data (as processor): any data about third parties that the Client enters, such as names, contact details, identification data, accounting, tax, legal or commercial documents, tasks, deadlines and operational history.

4. Purposes and Legal Bases (Art. 6 / Art. 6 GDPR)

a) Providing the Platform, creating and managing accounts, authentication, roles, support — performance of a contract or pre-contractual steps (Art. 6(1)(b)).

b) Payments, invoices, accounting, tax and archiving — legal obligation (Art. 6(1)(c)) and performance of a contract (Art. 6(1)(b)).

c) Platform security, fraud and abuse prevention, incident investigation, backups, service improvement, defence of rights — our legitimate interests (Art. 6(1)(f)), after balancing them against your rights and freedoms.

d) Operational notices (security, subscription, invoicing, changes to terms) — performance of a contract and legitimate interests.

e) Commercial communications — your consent (Art. 6(1)(a), Art. 7), which you can withdraw at any time as easily as it was given, or, where permitted by law, our legitimate interest in communications about similar services.

f) Client Personal Data — on the Client's instructions, under the legal basis determined by the Client as controller.

Where we rely on legitimate interests, you may object under Art. 21.

5. Special-Category and Criminal-Conviction Data

The Platform is not designed for special categories of data (Art. 9: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation) or for data on criminal convictions and offences (Art. 10). The Client must not enter such data unless a condition under Art. 9(2) or a legal authorisation under Art. 10 applies and appropriate safeguards are in place. The Client remains solely responsible for that assessment and must inform us if additional contractual or technical measures are needed. We may suspend or limit processing where there is a legal, technical or security risk.

6. Recipients and Sub-processors

6.1. We may disclose personal data, only as necessary, to: authorised Vault2Trust personnel bound by confidentiality (Art. 28(3)(b), Art. 29, Art. 32(4)); VictoriaBank or the payment processor used; hosting, cloud, email, backup, security, monitoring and support providers; professional advisers (lawyers, accountants, auditors); and public authorities, courts, tax and supervisory authorities where required by law or a valid request.

6.2. Sub-processors. We engage sub-processors only under a written contract imposing the same data protection obligations (Art. 28(2), (4)) and remain fully liable to the Client for their performance. The list of principal sub-processors is available at [LINK] or upon request. We give Clients at least 30 days' notice of the addition or replacement of a sub-processor; the Client may object in writing on reasonable data protection grounds, and the parties will seek a solution in good faith, failing which the Client may terminate the affected service.

6.3. We do not sell personal data, we do not "share" it for cross-context behavioural advertising (within the meaning of the CCPA/CPRA), and we do not use Client Personal Data for our own marketing, profiling or advertising.

7. International Data Transfers (Arts. 44–49)

7.1. Vault2Trust is established in the Republic of Moldova. Infrastructure, cloud, email, payment and support services may involve processing in, or access from, other countries.

7.2. Transfers of personal data are made only under Chapter V of Law 195/2024 and, where applicable, Chapter V of the GDPR (and the UK GDPR and the FADP), namely on the basis of:

a) transfers to EEA Member States, which under Art. 44(2) of Law 195/2024 require no special authorisation;

b) an adequacy decision (Art. 45);

c) appropriate safeguards (Art. 46), in particular the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) or approved by the Centre, and, for the United Kingdom and Switzerland, the UK International Data Transfer Addendum and the Swiss addendum, together with supplementary technical and organisational measures (encryption, access control, minimisation);

d) the derogations of Art. 49 only in exceptional cases.

7.3. For Clients in the EEA, the United Kingdom or Switzerland, the standard contractual clauses (Module Two: controller to processor) and the applicable addenda are incorporated by reference into the agreement between the Client and Vault2Trust, with the information in this Policy serving as their annexes. A copy is available on request.

7.4. Foreign authorities' requests for data are handled under Art. 48: we disclose data only where required by an international treaty or applicable law, after assessing the request.

8. Processor Terms (Art. 28)

For Client Personal Data, Vault2Trust undertakes to:

a) process data only on the Client's documented instructions, including for transfers, unless required by law (in which case we inform the Client, unless prohibited);

b) ensure that persons authorised to process the data are bound by confidentiality;

c) implement the security measures in Section 12 (Art. 32);

d) respect the conditions for engaging sub-processors in Section 6.2;

e) assist the Client, by appropriate technical and organisational measures, in responding to data subject requests (Chapter III, Arts. 12–22);

f) assist the Client with security, breach notification, impact assessments and prior consultation (Arts. 32–36);

g) at the Client's choice, return or delete all Client Personal Data after the end of the services, subject to Section 9;

h) make available the information necessary to demonstrate compliance and allow audits by the Client or an auditor it mandates, on reasonable notice, once per year (or following a breach), during business hours and subject to confidentiality;

i) immediately inform the Client if, in our opinion, an instruction infringes data protection law;

j) maintain records of processing activities carried out on behalf of Clients (Art. 30(2)).

The subject matter, duration, nature and purpose of processing, the types of data and the categories of data subjects are those described in Sections 3, 4 and 9. By accepting the Terms and Conditions the Client accepts these Processor Terms, which constitute the data processing agreement under Art. 28(3). A separately signed agreement may be requested at [email protected].

9. Retention

We keep personal data only as long as necessary for the purposes for which it was collected (Art. 5(1)(e)):

a) account data: for the duration of the account, plus the period required for legal, accounting and tax obligations or the defence of rights;

b) payment data: at least five years or the period required by tax and accounting law;

c) Client Personal Data and documents: for the duration of the subscription; after termination the Client may export them within 30 calendar days, after which they are deleted or anonymised, except where retention is required by law;

d) access and security logs: generally up to 12 months, longer where needed for security, incident investigation or legal claims;

e) session cookies: until the session ends or up to 120 minutes after last activity;

f) backups: until overwritten in the ordinary backup cycle.

After these periods data is deleted, anonymised or retained in restricted form where permitted or required by law.

10. Your Rights (Arts. 12–22)

Under Law 195/2024 and, where applicable, the GDPR, you have the right to:

a) be informed (Arts. 13–14);

b) access your data and obtain a copy (Art. 15);

c) rectification of inaccurate or incomplete data (Art. 16);

d) erasure, "the right to be forgotten" (Art. 17);

e) restriction of processing (Art. 18);

f) data portability, in a structured, commonly used, machine-readable format (Art. 20);

g) object to processing based on legitimate interests or public interest, and at any time to direct marketing (Art. 21);

h) not be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effects (Art. 22);

i) withdraw consent at any time without affecting prior processing (Art. 7(3));

j) lodge a complaint and seek a judicial remedy (Section 11).

How to exercise them. For data we process as controller, write to [email protected]. We may ask for additional information to confirm your identity (Art. 12(6)). We respond free of charge within one month of receipt; this period may be extended by up to two further months for complex or numerous requests, with notice and reasons (Art. 12(3)). If we do not act, we tell you why and how to complain (Art. 12(4)). Manifestly unfounded or excessive requests may be charged or refused (Art. 12(5)).

For Client Personal Data, direct your request to the Client (the controller). If you send it to us, we forward it to the Client and assist as required by Art. 28(3)(e).

11. Complaints and Supervisory Authorities

You may lodge a complaint with the supervisory authority and/or bring a court action (Arts. 72 and 74 of Law 195/2024; Arts. 77–79 GDPR):

• Republic of Moldova: National Centre for Personal Data Protection (NCPDP), https://datepersonale.md
• European Union / EEA: the authority of your habitual residence, place of work or place of the alleged infringement (list: https://www.edpb.europa.eu)
• United Kingdom: Information Commissioner's Office, https://ico.org.uk
• Switzerland: Federal Data Protection and Information Commissioner, https://www.edoeb.admin.ch
• Other jurisdictions: the competent local authority.

We invite you to contact us first so that we can try to resolve your concern.

12. Security Measures and Personal Data Breaches (Arts. 25, 32–34)

12.1. We apply data protection by design and by default (Art. 25) and measures appropriate to the risk (Art. 32), including: HTTPS/TLS encryption in transit; password storage as salted cryptographic hashes; role- and permission-based access control; separation of access between Client accounts; logging of significant actions; periodic backups and restoration procedures; regular security updates; restriction of internal access to what is necessary and training of personnel; technical monitoring for abuse and suspicious activity; and payment processing on the bank's or payment processor's infrastructure. We may update these measures without materially reducing overall protection.

12.2. Breaches. If a personal data breach occurs, we assess it, limit its effects, and: (a) as processor, notify the affected Client without undue delay and, where feasible, within 48 hours after becoming aware (Art. 33(2)); (b) as controller, notify the National Centre for Personal Data Protection without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk (Art. 33(1)); and (c) inform data subjects without undue delay where the breach is likely to result in a high risk (Art. 34). We document all breaches (Art. 33(5)). Where required under the GDPR, we also notify the competent EU authority.

12.3. No system is completely secure. The Client is responsible for the security of its own devices, passwords, email accounts, networks, invited users and permissions, and for notifying data subjects and authorities where it is the controller.

13. Records, Impact Assessments and Representatives

We maintain records of processing (Art. 30) and carry out data protection impact assessments where processing is likely to result in a high risk (Art. 35). Where the GDPR or UK GDPR requires, we appoint a representative in the EU or the UK (Art. 27 GDPR); details are available at [email protected].

14. Children

The Platform is intended for professional use by adults, companies and organisations and is not directed at children. Persons who have not reached the legal age to enter into a contract must not use it. The Client must not enter data of minors without a clear lawful basis; where information society services are offered directly to a child, consent requires the age of 14 under Art. 8 of Law 195/2024 (13–16 under Art. 8 GDPR, depending on the Member State).

15. Cookies

We use only strictly necessary cookies and similar technologies, which do not require consent under Law 284/2004 and Art. 5(3) of Directive 2002/58/EC:

a) a session cookie that maintains the authenticated state;

b) a language-preference cookie;

c) technical tokens necessary for account security (e.g. CSRF protection).

We do not use tracking, marketing or behavioural advertising cookies. If we introduce non-essential cookies in the future, we will first request your consent through the cookie settings. You can control cookies in your browser, but disabling necessary cookies may prevent the Platform from working.

16. Automated Decisions and Profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on individuals (Art. 22). Should this change, we will update this Policy and provide the safeguards required by law.

17. Operational and Commercial Communications

We send operational communications needed for the account (security, subscriptions, invoicing, changes to terms, support, incidents). They cannot be disabled while the account is active. We send commercial communications only with your prior consent, or where otherwise permitted by law, and you may unsubscribe at any time using the link in the message or by writing to [email protected] (Art. 21(2)–(3)).

18. Regional Information

• EU / EEA / UK / Switzerland: the rights and safeguards in this Policy apply; transfers to Moldova are covered by Section 7.
• California (USA): we act as a "service provider" within the meaning of the CCPA/CPRA; we do not sell or share personal information. California residents may request access, deletion and correction by writing to [email protected].
• Brazil: the rights under Art. 18 of the LGPD are available on request.
• Russian Federation and other countries with localisation or notification rules: the Client, as controller, is responsible for assessing and complying with them before entering personal data.

19. Amendments

The current version is published at https://vault2trust.com/privacy. We may amend this Policy to reflect legal, technical, operational or security changes. Material amendments are announced by email or Platform notification at least 30 days before they take effect, except where urgent changes are required by law or security. Continued use after the effective date constitutes acceptance, unless the law requires express consent.

20. Contact

Email: [email protected]
Office: str. Mihai Viteazul 4, mun. Chișinău, Republic of Moldova
Web: https://vault2trust.com