Privacy policy

Last updated: 2 October 2026

Who is responsible for your information

The data controller for VAULT SOP Systems is Luke Steven Datson trading as VAULT SOP Systems. This notice covers our website, digital-document sales, enquiries and related marketing.

Contact vaultsopsystems@gmail.com or write to 135 Dolgwenith, Llanidloes, Powys, SY18 6YT, United Kingdom for privacy questions or to exercise your rights. Reading this notice or buying a product is not consent to optional marketing or cookies.

Information we use and where it comes from

• Information you provide: your name, email address, billing and business details, order selections, account details where you create an account, marketing preferences, and the contents of enquiries or other correspondence. A telephone number is used if you choose or need to provide one.
• Order and delivery records: purchased products, amounts, payment status, order identifiers, download access and related support or cancellation information. Payment credentials are processed through the payment provider you use at checkout; do not send card details to our support email.
• Website information: device and browser information, IP address, pages and products viewed, cart activity, security events and cookie preferences. Optional uses of cookies and similar technologies are subject to your choices where consent is required.
• Information from service providers: payment confirmations, delivery and service events, and security or fraud-related information needed to operate the store.

The information marked as required during checkout is needed to process your order and supply access. Without it we may be unable to fulfil the purchase. Marketing sign-up is optional. Please avoid including medical information, identification documents or other sensitive personal information in ordinary product enquiries.

Why we use information and our UK lawful bases

• Orders, licences, download access and requested services: to take steps you request before a contract and to perform that contract.
• Tax, accounting and legal records: to meet our legal obligations.
• Enquiries, support, security, fraud prevention and disputes: to perform a contract where applicable, or for our legitimate interests in responding to requests, running a secure business and protecting legal rights. We balance those interests against your rights.
• Marketing emails: consent where required. Any permitted customer-marketing exception is used only when its legal conditions are met, including the required opt-out opportunities. A purchase alone does not amount to general marketing consent.
• Analytics, personalisation and advertising technologies: consent where required for storage or access on your device and the associated processing. Essential functions operate as necessary to provide the service, comply with law or support our legitimate interests in security and reliable operation.

You can object to direct marketing at any time through an unsubscribe link or by emailing us. You may also object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time; this does not affect processing already lawfully undertaken. Order and service messages remain separate from marketing.

Cookies and your choices

Essential cookies and similar storage support security, your cart, checkout and remembering privacy choices. Our Shopify cookie banner offers acceptance, refusal and preferences in the regions where it is configured to apply. Where consent is required, optional analytics, personalisation and advertising technologies must wait for your choice.

Use Cookie preferences in the website footer to review or change available choices. Refusing optional cookies does not remove your ordinary ability to shop. You can also control cookies in your browser, although blocking essential cookies may prevent parts of checkout from working. See Shopify's cookie policy for information about its technologies.

Shopify and other recipients

Shopify hosts this store and provides checkout, store administration and related services. We use Shopify Digital Products for digital-file delivery, and Shopify services for communications and workflow administration. Shopify receives information needed for those services. Our email correspondence is handled through our Gmail service.

Shopify Network Intelligence is enabled. Shopify can use information from interactions with this store alongside information from other Shopify services to improve products, advertising and personalisation as described in its own notice, subject to applicable privacy choices. Shopify acts independently for some of this processing. Read the Shopify Consumer Privacy Policy or use the Shopify Privacy Portal to learn about Shopify's processing and exercise relevant rights directly with it.

We also share information as needed with the payment service selected at checkout, authorised providers supporting store operations and communications, professional advisers, and authorities where required by law. Payment providers may process information under their own privacy notices. We do not publish your order or enquiry information as public website content.

International processing

Shopify identifies the store's data hosting location as the European Union. This does not mean every processing activity takes place only there: Shopify, email, payment and other service providers can process information in other countries. Where UK data-protection law restricts a transfer, the applicable provider arrangements must use an appropriate mechanism, such as an adequacy decision or approved contractual safeguards. Contact us for information about the safeguards applicable to your information and how to obtain a copy.

How long information is kept

Order, licence and payment-confirmation records are kept for the period needed to supply the purchase, support its licence and meet applicable tax, accounting and legal-claim requirements. Enquiries and support records are kept while needed for the request and any related complaint or claim. These purposes and the applicable legal retention duties determine the period.

Marketing records are kept while relevant to your subscription. A minimal suppression record can be kept after an opt-out so we can respect your choice. Where you enter a giveaway, its published rules explain the specific administration and retention arrangements. Information is deleted or anonymised when it is no longer needed, subject to required legal holds and normal backup cycles.

Your rights and complaints

Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your personal information, object to processing, and withdraw consent. Contact us using the details above. We may need proportionate information to confirm your identity. We respond within the applicable legal time limit, normally one month, and explain any lawful extension or restriction.

You may complain to the Information Commissioner's Office (ICO) about our handling of your information. You do not have to wait for our complaints process before contacting the ICO. People outside the UK may also have rights through their local data-protection authority.

Other points

The store's professional documentation is aimed at adults. We do not seek children's personal information through our sales or marketing. If a child has supplied information, please contact us so we can assess and address it.

Links to other websites are subject to those services' privacy practices. We take appropriate steps to protect information, but no online service can promise perfect security. We may update this notice when services or practices change and will provide any additional notice required by law.