Privacy Policy

1. Introduction

MyPetVault ("MyPetVault", "we", "us", or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you acquire a Technology Certificate, create a Vault, upload information, or otherwise use our Services.

MyPetVault provides secure artificial intelligence infrastructure, encrypted Vault technology, Technology Certificates and related software services.

This Privacy Policy applies to all personal data processed by MyPetVault in connection with the provision of its Services.

This Privacy Policy applies under both the EU General Data Protection Regulation (EU GDPR) and the UK General Data Protection Regulation (UK GDPR) read with the Data Protection Act 2018. Where this Policy refers to GDPR, this should be read as referring to both EU GDPR and UK GDPR unless the context specifies otherwise.

2. Data Protection Roles

2.1 MyPetVault as Data Controller

MyPetVault acts as a data controller in relation to:

• User account administration;
• Technology Certificate issuance and verification;
• Vault administration;
• Authentication and security monitoring;
• Service operation and maintenance;
• Customer support;
• Compliance with legal obligations;
• Fraud prevention and platform security.

2.2 Business Customers

Where MyPetVault provides Services to business customers, MyPetVault may act as a data processor under separate contractual arrangements where required by applicable law.

2.3 Relationship with Glacio Ltd

MyPetVault uses Technology Certificate infrastructure provided by Glacio Ltd (Company Registration No. 677497, Larnaca, Cyprus). In connection with the issuance and verification of Technology Certificates, limited certificate metadata may be shared with Glacio solely for certificate issuance, registration and validation purposes.

3. Categories of Personal Data Processed

MyPetVault may process the following categories of personal data.

3.1 Account Information

• Name
• Username
• Email address
• Contact details
• Account credentials.

3.2 Authentication Data

• Technology Certificate identifiers;
• Authentication records;
• Two-factor authentication information;
• Login activity.

3.3 Technical Data

• IP address
• Device identifiers
• Browser type and version
• Operating system
• Session timestamps
• Usage logs
• Error reports

3.4 Vault Content

• Documents uploaded by users
• Identity documents
• Financial records
• Medical information
• Legal documents
• Personal notes
• Files and data stored within a Vault.

3.5 Pet Health Data

• Pet profile details you register (name, species, breed, date of birth)
• Medical records and attachments you add to a pet’s vault
• Share links you create and their access timestamps.

3.6 Communications

• Customer support requests
• Correspondence
• Service-related communications.

3.7 Payment and Transaction Data

• Token pack purchase records
• Transaction reference identifiers
• Payment method type (card or bank transfer)
• Purchase amount and date
• Technology Certificate issuance records linked to payment.

4. Purposes of Processing

MyPetVault processes personal data for the following purposes:

1. Issuing and validating Technology Certificates
2. Creating and maintaining Vaults
3. Providing access to the Services
4. Personalising your experience based on Vault content
5. Authenticating users
6. Maintaining system security
7. Detecting fraud and abuse
8. Providing customer support
9. Monitoring and improving Service performance
10. Complying with legal obligations
11. Enforcing contractual rights
12. Responding to lawful requests from authorities
13. Processing token pack purchases and managing token balances
14. Issuing, recording and verifying Technology Certificates in the Certificate Registry
15. Account recovery via Technology Certificate.

MyPetVault does not sell personal data.

MyPetVault does not use personal data for behavioural advertising.

MyPetVault does not provide personal data to third parties for marketing purposes.

5. Legal Bases for Processing

Where required under applicable law, MyPetVault relies on one or more of the following legal bases:

5.1 Contractual Necessity

Processing necessary for:

• Providing Services
• Managing accounts
• Operating Vaults
• Delivering the Services
• Processing token pack purchases
• Issuing Technology Certificates.

5.2 Legitimate Interests

Processing necessary for:

• Security monitoring
• Fraud prevention
• Service improvement
• Infrastructure protection
• Business administration
• Maintaining the integrity of the Certificate Registry.

5.3 Legal Obligations

Processing necessary for compliance with:

• Applicable laws
• Regulatory requirements
• Court orders
• Law enforcement requests.

5.4 Consent

Where required by law, MyPetVault will obtain consent before processing personal data.

5.5 Explicit Consent for Special Category Data

Where users voluntarily upload special category personal data (including health information or identity documents) to their Vault, MyPetVault relies on explicit consent under Article 9(2)(a) EU GDPR and, for UK users, Article 9(2)(a) UK GDPR read with Schedule 1 of the Data Protection Act 2018. Users may withdraw this consent at any time by deleting the relevant content from their Vault or submitting a deletion request to MyPetVault.

6. Pet Vault Content

Users may upload information and documents to their Vault.

Such information is processed solely for the purpose of providing the Services.

Users remain solely responsible for:

• The legality of uploaded content;
• The accuracy of uploaded information;
• Ensuring they have the right to upload such information.

MyPetVault does not claim ownership of user-uploaded content.

Users grant MyPetVault a limited licence to process such content solely for the purpose of providing the Services.

Vault content is retained for the duration of the user's account and is deleted following account closure or permanent token depletion, as described in section 9.

Pet medical records are entered by users and may be incomplete or inaccurate.

This content is provided for informational purposes only and does not constitute:

• Legal advice
• Financial advice
• Medical advice
• Tax advice
• Professional advice of any kind.

Users and veterinarians should independently verify records before relying on them for treatment decisions.

7. Data Sharing

MyPetVault may share personal data with:

• Glacio Ltd (Company Registration No. 677497, Larnaca, Cyprus), solely for Technology Certificate issuance, registration and verification purposes
• Cloud hosting providers
• Infrastructure providers
• Cybersecurity service providers
• Technical support providers
• Professional advisers
• Auditors
• Regulators
• Government authorities where legally required.

MyPetVault does not sell personal data.

MyPetVault does not disclose personal data for advertising purposes.

All third-party service providers are required to implement appropriate security measures.

8. International Transfers

Personal data may be transferred outside the European Economic Area (EEA) and the United Kingdom where necessary for hosting, support or operational purposes.

Where such transfers occur, MyPetVault implements appropriate safeguards, including:

• Standard Contractual Clauses;
• Adequacy decisions;
• Encryption measures;
• Technical and organisational safeguards.

For transfers of personal data of UK users outside the United Kingdom, MyPetVault relies on the applicable UK transfer mechanism, which may include the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. EU Standard Contractual Clauses alone are not relied upon for transfers of UK personal data.

9. Data Retention

Personal data is retained only for as long as necessary to:

• Provide the Services
• Maintain Vault functionality
• Fulfil contractual obligations
• Comply with legal requirements
• Resolve disputes
• Protect legal rights.

Retention periods for the main categories of personal data are as follows:

• Account data: for the duration of the account and for a limited period after closure;
• Vault content: deleted after account closure or permanent token depletion;
• Assistant conversation history (where applicable): retained for a limited period;
• Technology Certificate records: permanent (public registry function);
• Payment and transaction records: up to 7 years (accounting and tax obligations);
• Security and audit logs: retained for a limited period.

When personal data is no longer required, it is securely deleted or anonymised.

10. Security Measures

MyPetVault implements appropriate technical and organisational measures designed to protect personal data.

Such measures include:

• Encryption in transit
• Encryption at rest
• Multi-factor authentication
• Access controls
• Network security controls
• Monitoring systems
• Audit logging
• Vulnerability testing
• Incident response procedures
• AES-256 encryption of Vault content
• Technology Certificate-bound access controls ensuring only the certificate holder can access their Vault.

While MyPetVault takes reasonable steps to protect personal data, no method of transmission or storage can be guaranteed to be completely secure.

11. Your Rights

Subject to applicable law, you may have the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw consent
• Right not to be subject to solely automated decision-making with significant effects (Article 22 EU GDPR / UK GDPR).

Requests may be submitted by contacting MyPetVault at privacy@mypetvault.tech. MyPetVault will respond within one month of receipt of a valid request.

MyPetVault may require verification of identity before responding to requests.

12. Automated Processing

MyPetVault uses artificial intelligence systems to generate responses based on:

• User prompts
• Uploaded Vault content
• Available contextual information.

Where AI features are provided, this personalisation constitutes profiling under GDPR Article 4(4) in so far as it analyses personal information to generate personalised responses. It does not produce legal or similarly significant effects.

MyPetVault does not engage in automated decision-making that produces legal or similarly significant effects without appropriate safeguards.

You have the right to object to profiling under GDPR Article 21 by contacting MyPetVault at privacy@mypetvault.tech.

13. Children's Privacy

The Services are not intended for individuals under the age of 18.

MyPetVault does not knowingly collect personal data from children.

If we become aware that personal data has been collected from a child without appropriate authorisation, such data will be deleted promptly. If you are a parent or guardian and believe your child has provided personal data to MyPetVault, please contact us at privacy@mypetvault.tech.

14. Cookies and Similar Technologies

MyPetVault may use cookies and similar technologies for:

• Authentication;
• Session management;
• Security monitoring;
• Service functionality;
• Performance analysis.

Additional information may be provided in our Cookie Policy.

15. Complaints

If you believe your personal data has been processed unlawfully, you may:

• Contact MyPetVault;
• Lodge a complaint with the relevant supervisory authority;
• Contact your local data protection authority;
• If you are based in the United Kingdom: lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF | Tel: 0303 123 1113 | www.ico.org.uk;
• If you are based in the European Union: lodge a complaint with the supervisory authority of the EU member state in which you reside or work.

16. Changes to this Privacy Policy

MyPetVault may amend this Privacy Policy from time to time.

Updated versions will be published on our website and Platform.

Where changes materially affect how your personal data is processed or your rights, MyPetVault will notify you by email or in-Platform notification before the changes take effect. Where consent was the legal basis for processing, fresh consent will be sought.

17. Contact Information

For privacy-related enquiries, requests or complaints, please contact MyPetVault using the contact details published on our website, or email privacy@mypetvault.tech.

18. Clarification of Service Nature

For the avoidance of doubt, MyPetVault:

• Provides software services
• Provides encrypted Vault technology
• Provides access to the Services
• Issues Technology Certificates
• Operates secure digital infrastructure.

MyPetVault does not:

• Provide banking services
• Provide payment services
• Provide investment services
• Issue e-money
• Provide legal advice
• Provide medical advice
• Provide financial advice
• Act as a regulated financial intermediary.

Personal data processing by MyPetVault is limited to the operation and provision of its software services.