Legal

Privacy Policy

Effective date: 22 October 2026Last updated: 22 October 2026

Privacy policies usually contain enough legal jargon to make a spreadsheet look exciting. We’ve kept ours straightforward: what information VaultHQ handles, why we need it, and how we protect it.

Who we are

VaultHQ is provided by Mullens Ltd, trading as VaultHQ (company number 17109449), whose registered office is at 46 Sparsholt Road, Southampton, England, SO19 9NJ.

For privacy questions or requests, email hello@vaulthq.uk.

VaultHQ’s two roles

  • Mullens Ltd is the controller for information about website visitors, customer contacts, account administration, support, billing and the records needed to keep the platform secure.
  • The customer organisation is the controller for the workforce information it enters into VaultHQ. Mullens Ltd processes that information to provide VaultHQ.

If you are an employee, please contact your employer first about workforce information. We will help your employer where required.

Information we handle

Depending on how an organisation uses VaultHQ, this may include:

  • contact and account information;
  • organisation and employment details;
  • emergency contacts;
  • departments, locations and roles;
  • rotas, shifts and availability;
  • leave and sickness information;
  • attendance and timesheets;
  • qualifications and supporting evidence;
  • cover requests;
  • notifications and preferences;
  • security and audit records;
  • support correspondence; and
  • billing and invoice information, once billing starts.

Health information may be included where an organisation records sickness absence.

VaultHQ does not currently record an employee’s physical location when they clock in or out.

Why we use information

We use information to:

  • provide VaultHQ;
  • create and secure accounts;
  • manage customer organisations;
  • deliver workforce features such as rotas, leave, attendance and shift cover;
  • send necessary service messages;
  • provide support;
  • prevent misuse and keep a record of important changes; and
  • meet accounting, legal and regulatory duties.
  • Contract: administering customer accounts and providing the service.
  • Legitimate interests: security, fraud prevention, support and the necessary running of accounts.
  • Legal obligation: accounting, tax and other legal or regulatory requirements.
  • Consent: only for genuinely optional activities, if we introduce any in future.

Where an organisation records sickness or other health information, the organisation is responsible for identifying its lawful basis and the additional condition required for that kind of information.

Marketing

VaultHQ does not currently send general marketing emails.

We do send service messages that are part of using VaultHQ, such as verification codes, invitations, password and security messages, trial notices, rota and shift information, leave decisions, cover requests, support replies and, once billing starts, billing notices.

If we introduce optional marketing, we will give you a clear choice and an easy way to unsubscribe.

Sharing information

We do not sell personal information. We share it only where needed to run VaultHQ or where the law requires it, with:

  • hosting and infrastructure providers;
  • database, authentication and secure storage providers;
  • transactional email providers;
  • network and security providers;
  • Stripe, for payment processing once billing begins. Stripe will process payment and fraud-prevention information, and we will not receive complete card details;
  • professional advisers, under a duty of confidentiality;
  • regulators, courts or other authorities, where required; and
  • a purchaser or successor, if VaultHQ or relevant business assets are lawfully transferred.

Our providers act on our instructions and must protect the information.

International processing

Some of the providers used to operate VaultHQ may process information outside the United Kingdom. Where that happens, we use an appropriate legal safeguard, such as an adequacy regulation or recognised contractual protection. More information can be requested through hello@vaulthq.uk.

How long we keep information

  • Account and workforce information is normally kept while the organisation uses VaultHQ.
  • After an account closes, the organisation has 30 days to request or download available data.
  • Data is then removed from the live service, unless we need to keep it for legal, accounting, security or legal-claims reasons. Residual copies may remain for a limited time in protected backups.
  • Accounting records may be kept for at least six years.
  • Ordinary support correspondence may be kept for up to 24 months after the enquiry closes.
  • Security and audit records are kept only for as long as reasonably necessary.

How we protect information

VaultHQ uses safeguards such as:

  • encrypted connections;
  • access controls and role-based permissions;
  • separation between customer organisations;
  • secure authentication;
  • protected backups; and
  • audit records of important changes.

Your rights

You can ask to access your personal information, correct it, delete it, restrict or object to how it is used, or receive it in a portable form. Some rights depend on the legal basis and may have exceptions.

For information controlled by Mullens Ltd, email hello@vaulthq.uk. For workforce information, please contact your employer first; we will help them respond.

You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

Children

VaultHQ is supplied to organisations and is not marketed directly to children. The same age rules apply as in our Terms and Conditions:

  • The person who creates an organisation account must be at least 18.
  • Staff users should normally be at least 16.
  • Someone aged 13 to 15 may have a login only if they are lawfully employed, volunteering or otherwise properly engaged by the organisation. The organisation must obtain any parental or guardian consent that is required and provide appropriate safeguarding and supervision.
  • Nobody under 13 may have their own VaultHQ login.
  • The customer organisation is responsible for meeting the employment, safeguarding and data-protection requirements that apply to users under 18.

Automated decisions

VaultHQ does not currently make solely automated decisions that produce legal or similarly significant effects about staff. Smart Cover may help managers identify potentially suitable people, but the customer organisation remains responsible for employment and scheduling decisions.

Changes to this policy

When this policy changes, we will update the dates at the top of this page. We will tell Organisation Admins about material privacy changes where appropriate.