Privacy Policy
Last updated: 12/07/2026
This Privacy Policy explains how Vaulex Group Ltd (“Vaulex”, “we”, “us”, “our”) collects, uses, shares and protects your personal data, and how we use cookies. We handle your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Vaulex Group Ltd is the data controller responsible for your personal data.
- Company: Vaulex Group Ltd, registered in England & Wales, Company No. 17004770
- Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
- Data protection contact: dpo@vaulex.co.uk
- ICO registration number: ZC087196
Vaulex is an introducer (reseller) for YouLend Limited. Vaulex is not a lender. We help UK businesses apply for YouLend’s business funding and pass your application to YouLend for a decision.
2. The personal data we collect
- Identity data: your name, date of birth, and (for company directors/owners) residential address.
- Contact data: email address, telephone number, business address.
- Business data: business name, company registration number, trading details, website, the funding amount requested, information about your card and online sales/turnover, and details of any existing business funding or applications you tell us about.
- Financial data: bank statements you upload, Open Banking transaction data (where you choose to connect your bank), and management accounts (for larger applications).
- Verification data: identity documents and the results of identity and credit checks carried out as part of the application.
- Marketing data: your preferences for receiving marketing from us, together with a record of when and how you consented and the exact wording you agreed to.
- Technical data: IP address, device and browser information, and cookie data when you use our website (see section 10).
3. How we collect your data
- Directly from you when you complete our enquiry form or correspond with us.
- From Open Banking, where you choose to securely connect your business bank account so a read-only view of your transaction data can be shared for the funding decision.
- From public sources such as Companies House.
4. How and why we use your data
| What we use it for | Our lawful basis |
|---|---|
| Processing your funding enquiry and introducing you to YouLend | Taking steps at your request prior to entering a contract, and our legitimate interests in providing our introduction service |
| Sharing your application and supporting documents with YouLend so they can assess and offer funding | Legitimate interests (fulfilling the introduction you requested); consent where required |
| Sending you service messages about your application (for example, a secure link to continue, or to send you offers) | Legitimate interests / steps prior to a contract |
| Sending you marketing from Vaulex and the other brands in our group (see section 5A) | Consent (you can withdraw at any time); legitimate interests (the “soft opt-in”) for a company’s own similar services |
| Fraud prevention, anti-money-laundering checks, and keeping records | Legal obligation and legitimate interests |
| Operating, improving and securing our website | Legitimate interests; consent for non-essential cookies |
5. How we are paid (introducer commission)
If your introduction leads to funding, YouLend pays Vaulex an introducer commission calculated as a percentage of YouLend’s margin on that funding. This commission does not increase the amount you repay. By proceeding with an application you acknowledge that we receive a commission on this basis.
5A. Marketing communications and our group of brands
Our websites and brands are operated by three companies under common ownership: Velvet Rose Box Ltd (Rosebox, Spices2Go, RecipeBox), UKBOX Ltd (UKBOX) and Vaulex Group Ltd (Vaulex). If you tick our marketing box, you consent to receive marketing emails from these companies and brands; they share a single marketing database for this purpose, and each company is responsible for the marketing it sends.
Lawful basis
Where you tick the marketing box, we rely on your consent, which covers the named companies above. Where you are an existing customer of one of our companies, that company may instead rely on its legitimate interests to tell you about its own similar products (the “soft opt-in”) — this never extends to the other companies, and you can opt out at the point we collect your details and in every email.
What we hold
Your name, email address, and where relevant your telephone number, business details and application status, together with a record of when and how you consented and the exact wording you agreed to.
Email engagement
Our emails tell us whether they were delivered and opened and which links were clicked. We use this to measure interest and avoid emailing people who no longer engage.
Where your data is stored
Our marketing database is a self-hosted system on managed infrastructure within the EU (Peakford Ltd / PikaPods). Marketing emails are delivered by Sinch Mailgun using its EU region. Both act as our processors.
Opting out
Every marketing email contains an unsubscribe link, and unsubscribing opts you out of marketing from all of the companies above. Unsubscribing does not affect service messages about your application, such as a secure link to continue or your funding offers. ICO registration: Vaulex Group Ltd — ZC087196.
6. Who we share your data with
- YouLend Limited — to assess your application and provide funding. YouLend acts as an independent data controller of the data we pass to them. See youlend.com/privacy-policy.
- Google (Google Drive) — to securely store the documents you upload (acting as our data processor).
- Mailgun / Sinch — to deliver our emails to you (acting as our data processor, processing in the EU).
- Peakford Ltd (PikaPods) — hosts our group marketing database on EU infrastructure (acting as our data processor; see section 5A).
- Google (Analytics & Ads via Site Kit) — for website analytics and advertising measurement, where you consent (see section 10).
- Professional advisers, regulators and law enforcement — where required by law, or to prevent fraud or other crime.
We do not sell your personal data.
7. International transfers
Where any of our providers process data outside the UK, we ensure an appropriate safeguard is in place — such as a UK adequacy decision or the International Data Transfer Agreement / Standard Contractual Clauses — so that your data receives an equivalent level of protection.
8. How long we keep your data
We keep your personal data only for as long as necessary. Where an application proceeds, financial and anti-money-laundering records are typically retained for six (6) years after our relationship ends. Enquiries that do not proceed are kept for 12 months and then securely deleted. Marketing data is kept until you withdraw consent.
9. Your rights
Under data protection law you have the right to: request access to your data; request correction of inaccurate data; request erasure in certain circumstances; object to or restrict our processing; request transfer of your data (portability); and withdraw consent at any time where we rely on consent (for example, marketing). To exercise any of these, contact us at dpo@vaulex.co.uk. You can unsubscribe from marketing at any time using the link in any email.
10. Cookies (Cookie Policy)
Cookies are small text files placed on your device when you visit our website. We use them to make the site work, to understand how it is used, and — only with your consent — for analytics and advertising.
When you first visit, a consent banner lets you accept or reject non-essential cookies. We use Google Consent Mode, which means analytics and advertising cookies are not set unless you agree. You can change your choice at any time via the “Cookie settings” option, or by clearing cookies in your browser.
| Category | Purpose | Set without consent? |
|---|---|---|
| Strictly necessary | Make the website and application form work (e.g. security, saving your progress). | Yes — required for the site to function |
| Analytics | Google Analytics 4 (via Site Kit) — helps us understand how visitors use the site so we can improve it. | No — only with consent |
| Advertising | Google Ads — measures the performance of our adverts and helps us reach relevant businesses. | No — only with consent |
A full, up-to-date list of the specific cookies used is available in our cookie banner’s settings. Most browsers let you block or delete cookies through their settings; blocking strictly necessary cookies may stop parts of the site working.
11. Complaints
If you have a concern about how we handle your data, please contact us first at complaints@vaulex.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
12. Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised “last updated” date.