Privacy policy

PRIVACY POLICY

Last updated: 26 August 2026

1. GENERAL INFORMATION

This Privacy Policy describes how VAULTS IBERICA S.L. (hereinafter “VAULTS1”, “we”, “us” or the “Data Controller”) collects, uses, stores and protects the personal data of users, customers and visitors of www.cajasdeseguridad.es, as well as individuals who use our safe deposit box rental services.

We are committed to processing personal data lawfully, fairly, transparently and securely in accordance with:

  • Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR);

  • Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD);

  • Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE);

  • and any other applicable Spanish and European legislation.

This Policy applies, among other circumstances, when you:

  • visit www.cajasdeseguridad.es;

  • request information about our services;

  • reserve or rent a safe deposit box;

  • create or use a customer account;

  • access our vault facilities;

  • purchase additional services;

  • use a promotional code or participate in the Referral Programme;

  • make a payment;

  • communicate with us by telephone, email or any other channel;

  • agree to receive commercial communications;

  • interact with our advertising campaigns or analytics technologies.

2. DATA CONTROLLER

Data Controller: VAULTS IBERICA S.L.
CIF: B56804255
Registered address: Gran Vía Marqués del Turia, No. 4, Ground Floor, 46005 Valencia, Spain
Business activity: safe deposit box rental
Website: www.cajasdeseguridad.es

General contact and data protection

Valencia:
Email: informacion@cajasdeseguridad.es
Telephone: +34 646 555 871

Madrid:
Email: madrid@cajasdeseguridad.es
Telephone: +34 679 592 232

Requests relating to data protection may be sent to:

informacion@cajasdeseguridad.es

Please indicate “Data Protection” in the subject line.

3. PRINCIPLES APPLIED TO DATA PROCESSING

VAULTS1 processes personal data in accordance with the following principles:

  • lawfulness, fairness and transparency;

  • purpose limitation;

  • data minimisation;

  • accuracy;

  • storage limitation;

  • integrity and confidentiality;

  • data protection by design and by default;

  • accountability.

We only collect data that is adequate, relevant and necessary for each specific purpose.

4. DATA WE MAY PROCESS

Depending on your relationship with VAULTS1, we may process the following categories of personal data.

Identification data

  • first and last name;

  • DNI, NIE, passport or other identification document where necessary;

  • tax identification number;

  • date of birth;

  • details of representatives or authorised persons, where applicable.

Contact data

  • postal address;

  • email address;

  • telephone number.

Contractual and service data

  • selected vault facility;

  • location;

  • number or internal identifier of the safe deposit box;

  • safe deposit box size;

  • rental period;

  • start and end dates;

  • additional services purchased;

  • contracts and related documentation;

  • contract status;

  • administrative service history.

Access and security data

  • access code or identifier;

  • date and time of access to the premises;

  • entry and exit logs;

  • access incidents;

  • records generated by security and access control systems;

  • CCTV images.

Payment and billing data

  • identity of the payer;

  • amount;

  • payment date;

  • transaction status;

  • billing information;

  • bank details visible in bank transfers;

  • payment references.

When payment is made by card, PayPal or another external payment gateway, certain data is processed directly by the relevant payment service provider.

VAULTS1 does not need to store full bank card details where those details are managed directly by the relevant bank or payment gateway.

Browsing data

  • IP address;

  • device used;

  • browser;

  • operating system;

  • date and time of access;

  • pages visited;

  • duration of the visit;

  • actions performed on the website;

  • traffic source;

  • cookie identifiers;

  • advertising identifiers;

  • conversion-related information.

Communication data

  • content of enquiries;

  • emails;

  • messages;

  • customer service history;

  • information voluntarily provided during a communication.

5. RESERVATION AND RENTAL OF SAFE DEPOSIT BOXES

When you request, reserve or rent a safe deposit box, we may process the data necessary to:

  • process the request;

  • check availability;

  • identify the customer;

  • prepare and enter into the contract;

  • assign the safe deposit box;

  • provide the corresponding key;

  • provide the access code or access system;

  • administer the rental;

  • issue invoices;

  • manage payments;

  • renew or terminate the contract;

  • deal with service-related incidents;

  • manage return of the key and termination of the rental.

Legal basis

The processing is primarily based on:

Article 6(1)(b) GDPR: performance of a contract or taking pre-contractual steps requested by the data subject;

and, where applicable:

Article 6(1)(c) GDPR: compliance with legal obligations;

Article 6(1)(f) GDPR: legitimate interests of VAULTS1 relating to management, security and the defence of its rights.

Providing certain data is necessary in order to formalise the rental. If the customer does not provide the required data, we may be unable to enter into or perform the contract.

6. CORPORATE CUSTOMERS

Safe deposit boxes may be rented by both individuals and legal entities.

Where the customer is a company or other entity, we may process:

  • company name;

  • CIF/NIF;

  • registered address;

  • billing information;

  • identity of directors, representatives or authorised persons;

  • professional contact information;

  • documentation proving authority to act, where necessary.

The processing of the representative’s personal data will be based on the contractual relationship and, where applicable, on the legitimate interests of the parties in properly managing their professional relationship.

7. CUSTOMER ACCOUNT

When you create or use an account on www.cajasdeseguridad.es, we may process:

  • first and last name;

  • email address;

  • password stored using appropriate technical security mechanisms;

  • profile information;

  • contract and order information;

  • data relating to the Referral Programme;

  • account activity;

  • information necessary to restore access to the account.

This data is used to:

  • create and maintain the account;

  • authenticate the user;

  • facilitate management of the user’s services;

  • display information relating to contracts, discounts or transactions;

  • protect the account from unauthorised access.

Legal basis

Performance of the contract and the legitimate interest of VAULTS1 in providing a secure platform to its customers.

8. 24/7 ACCESS AND ACCESS CONTROL TO VAULT FACILITIES

VAULTS1 facilities allow authorised customers to access their safe deposit boxes in accordance with the terms of the service.

To ensure the security of the facilities, we may record:

  • identity of the customer or authorised user;

  • access identifier or access code;

  • date and time of entry;

  • date and time of exit;

  • access attempts;

  • rejected access attempts;

  • events generated by security systems;

  • access-related incidents.

The purposes are to:

  • prevent unauthorised access;

  • protect customers and employees;

  • protect premises and property;

  • prevent and detect security incidents;

  • investigate suspicious access or activity;

  • establish relevant facts in the event of an incident.

Legal basis

Article 6(1)(f) GDPR: the legitimate interest of VAULTS1 and its customers in ensuring a high level of security.

Where processing is necessary for the proper provision of the service, it may also be based on Article 6(1)(b) GDPR.

9. CCTV SURVEILLANCE

VAULTS1 facilities are equipped with CCTV systems to protect individuals, premises and property.

The cameras may capture:

  • images of individuals;

  • date and time;

  • location within CCTV-monitored areas;

  • actions taking place within the cameras’ field of view.

The images are processed for the following purposes:

  • security of the premises;

  • protection of persons and property;

  • prevention and detection of unauthorised access;

  • prevention and investigation of incidents;

  • prevention of unlawful acts;

  • defence against claims.

Legal basis

Article 6(1)(f) GDPR: legitimate interest in ensuring the security of persons, premises and property.

CCTV-monitored areas will display appropriate visible information regarding the processing.

Images will be retained only for the period strictly necessary for security purposes and, as a general rule, for a maximum period of one month from the date of capture.

Where a recording documents an incident, offence, damage to persons or property, or another event requiring investigation, it may be retained for the period necessary to make it available to the competent authorities and manage the relevant proceedings.

Access to recordings is restricted to duly authorised personnel and, where applicable, security service providers acting in accordance with our instructions.

10. RECOGNITION TECHNOLOGIES AND BIOMETRIC DATA

Technical security systems may incorporate functions for detecting or recognising persons, objects or events.

Where such technologies are limited to detecting the presence of persons or objects without uniquely identifying an individual using biometric data, the information will be processed within the general security and CCTV systems.

If VAULTS1 uses a biometric identification or authentication system at any facility, such as facial recognition intended to uniquely identify an individual, such processing will be considered particularly sensitive.

Before implementing such a system, VAULTS1 must:

  • identify a valid legal basis under Articles 6 and 9 GDPR;

  • assess its suitability, necessity and proportionality;

  • carry out a Data Protection Impact Assessment where required;

  • implement enhanced security measures;

  • provide the data subject with specific information about such processing.

This Policy does not in itself convert general consent to our services into authorisation for the processing of biometric data.

11. PRIVACY OF SAFE DEPOSIT BOX CONTENTS

VAULTS1 provides a private safe deposit box rental service.

As a general rule, VAULTS1 does not systematically inventory the contents of safe deposit boxes and does not need to know what assets the customer stores in them.

Information about deposited items may only be processed where necessary, for example:

  • to manage an insurance claim;

  • to arrange insurance coverage;

  • to comply with a legal obligation;

  • to investigate an incident;

  • where the customer voluntarily provides such information for a specific purpose.

In such cases, only the information necessary for that specific purpose will be processed.

12. ADDITIONAL SERVICES AND PERSONAL ASSISTANT

When you request an additional service, including a personal assistant service, we may process:

  • customer identity;

  • location of the vault facility;

  • requested date and time;

  • contact details;

  • information relating to the service purchased.

Purpose

To organise and provide the requested service.

Legal basis

Article 6(1)(b) GDPR: performance of the contract or measures requested by the customer.

13. PAYMENTS AND BILLING

Depending on the available options, services may be paid for by:

  • online banking;

  • bank transfer;

  • card;

  • PayPal;

  • cash;

  • other enabled payment methods.

To manage payments and comply with our administrative, tax and accounting obligations, we may process:

  • name of the payer;

  • amount;

  • date;

  • transaction reference;

  • billing data;

  • bank account details where applicable;

  • information relating to payment status.

Legal basis

  • performance of the contract;

  • compliance with tax, accounting and commercial legal obligations.

Full card details may be processed directly by banks, acquiring entities or payment service providers, which apply their own policies and legal obligations.

14. REFERRAL PROGRAMME

Customers with an active contract may participate in the VAULTS1 Referral Programme.

In connection with this programme, we may process:

  • identification of the participating customer;

  • assigned referral code;

  • use of the code;

  • number of valid referrals;

  • discounts generated;

  • discounts used.

This information is used exclusively to manage the programme and apply the relevant benefits.

We will not disclose the personal data of the referred person to the participant beyond the information strictly necessary to determine that a valid referral has occurred.

Legal basis

Performance of the Referral Programme terms and of the existing contract with the customer.

15. ENQUIRIES AND CUSTOMER SERVICE

When you contact VAULTS1 through:

  • email;

  • telephone;

  • web forms;

  • in person;

  • other enabled channels,

we may process your contact information and the content of the communication.

Purpose

  • respond to enquiries;

  • provide information;

  • prepare offers;

  • resolve incidents;

  • manage requests;

  • retain a reasonable customer service history.

Legal basis

Depending on the circumstances:

  • taking pre-contractual measures;

  • performance of the contract;

  • legitimate interest in providing appropriate customer service;

  • consent, where specifically required.

16. REMINDERS AND APPOINTMENTS

If you arrange a visit or appointment with VAULTS1, we may use your contact details to:

  • confirm the appointment;

  • send reminders;

  • inform you of changes relating to the appointment;

  • facilitate provision of the requested service.

Legal basis

Performance of pre-contractual or contractual measures and our legitimate interest in properly managing requested appointments.

17. BROWSING, ANALYTICS AND ADVERTISING DATA

When you visit www.cajasdeseguridad.es, we may process technical information such as:

  • IP address;

  • browser type;

  • operating system;

  • device;

  • pages visited;

  • session duration;

  • source of the visit;

  • interactions with the website;

  • online identifiers;

  • campaign information;

  • conversions.

The website uses tag management technologies such as Google Tag Manager and may use analytics and digital advertising services.

Depending on the configuration in force and only where the necessary legal basis exists, the technologies used may include:

  • Google Analytics;

  • Google Ads;

  • Meta Ads / Meta Pixel;

  • other advertising and measurement platforms.

Non-essential analytics or advertising technologies that require consent will only be activated once the user has provided consent through the cookie management system.

Detailed information about cookies, providers, purposes and duration is available in the Cookie Policy and the Cookie Settings panel.

18. ADVERTISING, REMARKETING AND PROFILING

Where you have provided the relevant consent, advertising platforms may use certain identifiers to:

  • measure conversions;

  • attribute a booking to a campaign;

  • generate advertising statistics;

  • create audiences;

  • carry out remarketing;

  • limit the frequency of advertisements;

  • display more relevant advertising.

This may involve a limited form of advertising profiling, for example by including a user who visited the pricing page in an audience interested in safe deposit box rental.

VAULTS1 does not make automated decisions based solely on such advertising profiling that produce legal effects or similarly significantly affect the user.

19. COMMERCIAL COMMUNICATIONS

We may send information relating to:

  • VAULTS1 services;

  • promotions;

  • offers;

  • news;

  • events;

  • new products or locations,

where there is a lawful basis permitting us to do so.

Users without a prior contractual relationship

Electronic commercial communications will be sent where the data subject has provided consent.

Existing customers

Where a prior contractual relationship exists, we may inform the customer about our own products or services similar to those previously purchased, within the limits permitted by applicable law.

In all cases, a simple and free method of objecting or unsubscribing will be provided.

You may withdraw your consent or object to marketing at any time:

20. SOCIAL MEDIA

VAULTS1 may maintain profiles on social media platforms.

When you interact with these profiles, we may process information that the relevant social network makes available to us in accordance with:

  • your privacy settings;

  • the platform’s terms;

  • the interaction carried out by the user.

This processing may include, for example:

  • profile name;

  • username;

  • comments;

  • messages;

  • reactions or public interactions.

Social media platforms also carry out their own processing of personal data as independent data controllers in accordance with their respective privacy policies.

21. SPECIAL CATEGORIES OF DATA

As a general rule, VAULTS1 does not need to collect data revealing:

  • racial or ethnic origin;

  • political opinions;

  • religious or philosophical beliefs;

  • trade union membership;

  • health information;

  • sex life or sexual orientation;

  • genetic data;

  • biometric data used to uniquely identify an individual.

Please do not enter this type of information into free-text fields or send it to us unless it is strictly necessary for a specific purpose.

If it becomes exceptionally necessary to process a special category of data, the relevant legal basis under Article 9 GDPR and the required enhanced safeguards will apply.

22. SOURCE OF DATA

Personal data may be obtained:

  • directly from the data subject;

  • from the data subject’s representative or authorised person;

  • from the company represented by the data subject;

  • from VAULTS1 access and security systems;

  • through use of the website;

  • from payment service providers;

  • from advertising and analytics platforms where the user has consented to their use;

  • from public sources where a legal basis exists;

  • from other entities where the transfer is legally permitted.

23. RECIPIENTS OF DATA

We may disclose or provide access to personal data to third parties where necessary.

Such recipients or data processors may include:

  • hosting and server providers;

  • IT maintenance companies;

  • web developers and administrators;

  • software providers;

  • CRM and customer service providers;

  • access and security system providers;

  • private security companies;

  • CCTV service providers;

  • banks and financial institutions;

  • payment service providers and payment gateways;

  • PayPal or other providers used by the customer;

  • tax, employment, accounting or legal advisers;

  • auditors;

  • insurance companies where necessary for the service or a claim;

  • marketing and advertising providers;

  • analytics providers;

  • Google;

  • Meta, where its services are used;

  • VAULTS1 group companies where necessary for administrative functions or service provision and where a legal basis exists;

  • public bodies;

  • the Spanish Tax Agency;

  • law enforcement authorities;

  • courts and tribunals;

  • other competent authorities.

Where a provider processes data on behalf of VAULTS1, the appropriate data processing arrangement will be formalised in accordance with Article 28 GDPR where required.

24. INTERNATIONAL DATA TRANSFERS

Some technology, advertising, analytics, social media or digital service providers form part of international corporate groups.

As a result, certain data may be accessible or processed outside the European Economic Area.

Where an international transfer takes place, the mechanisms provided for in Chapter V GDPR will be applied, such as:

  • adequacy decisions adopted by the European Commission;

  • the EU-U.S. Data Privacy Framework, where applicable to the recipient;

  • Standard Contractual Clauses approved by the European Commission;

  • other legally recognised safeguards.

Where necessary, additional measures will be adopted to ensure an adequate level of protection.

25. RETENTION PERIODS

We will retain data only for as long as necessary to fulfil the purposes for which it was collected and thereafter for the periods necessary to address possible legal liabilities.

As a general rule:

Information requests

For the time necessary to manage the enquiry and subsequently for a reasonable period to demonstrate the assistance provided.

User account

For as long as the account remains active and subsequently for the period necessary to address possible liabilities.

Contracts and customer data

For the duration of the contract and subsequently for the applicable statutory limitation periods.

Commercial, contractual, tax and accounting documentation will be retained for the periods required by the applicable legislation.

Billing and accounting data

For the statutory periods established by the applicable commercial, tax and accounting regulations.

CCTV surveillance

As a general rule, for a maximum of one month from capture, unless the recording is necessary to investigate an incident or make it available to the authorities.

Access control

For the period strictly necessary to ensure security, manage possible incidents and defend rights or claims.

Marketing

Until consent is withdrawn or the data subject objects to the processing, without prejudice to retaining minimal evidence of the withdrawal or objection for as long as necessary to ensure that unwanted communications are not sent again.

Cookies and similar technologies

For the periods specified in the relevant Cookie Policy and settings panel.

Once the applicable retention periods have expired, the data will be deleted, anonymised or, where legally required, duly blocked.

26. DATA SECURITY

VAULTS1 applies technical and organisational measures appropriate to the risk in order to protect personal data against:

  • unauthorised access;

  • loss;

  • destruction;

  • alteration;

  • improper disclosure;

  • unlawful use.

These measures may include:

  • access controls;

  • permissions management;

  • authentication;

  • system protection;

  • security event logging;

  • backups;

  • confidentiality measures;

  • incident management procedures;

  • staff training and confidentiality obligations.

Access to the data is limited to those persons who need it in order to perform their duties.

27. AUTOMATED DECISION-MAKING

As a general rule, VAULTS1 does not make decisions based solely on automated processing of data that produce legal effects on the customer or similarly significantly affect them.

Security systems may automatically generate alerts in response to certain events, but these functions are intended to enhance the security of the premises.

Advertising technologies may carry out limited profiling for segmentation and measurement purposes where the user has provided the corresponding consent.

28. MINORS

The safe deposit box rental service is intended for persons who have sufficient legal capacity to enter into the relevant contract.

Minors should not directly purchase VAULTS1 services where they do not legally have the capacity to do so.

VAULTS1 does not intentionally use minors’ personal data for advertising purposes.

29. RIGHTS OF THE DATA SUBJECT

Under applicable data protection law, you may exercise the following rights:

Right of access

To find out whether we process your data and obtain information about the processing and a copy of the data.

Right to rectification

To request correction of inaccurate data or completion of incomplete data.

Right to erasure

To request deletion of your data where one of the legally established grounds applies.

The right to erasure is not absolute; we may retain certain data where there is a legal obligation or other lawful basis for doing so.

Right to restriction of processing

To request restriction of the use of your data in the circumstances provided for by the GDPR.

Right to object

To object to processing based on our legitimate interests taking into account your particular situation.

Right to object to direct marketing

You may object at any time to the processing of your data for direct marketing purposes, including profiling related to such marketing.

Right to withdraw consent

Where processing is based on your consent, you may withdraw it at any time.

Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

Right to data portability

Where legally applicable, you may receive the data you have provided to us in a structured, commonly used and machine-readable format and transmit it to another controller.

Rights relating to automated decision-making

In the circumstances provided for by Article 22 GDPR, you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you.

30. HOW TO EXERCISE YOUR RIGHTS

You may exercise your rights free of charge by writing to:

VAULTS IBERICA S.L.
Gran Vía Marqués del Turia, No. 4, Ground Floor
46005 Valencia
Spain

or by email:

informacion@cajasdeseguridad.es

Recommended subject line:

“Data protection – exercise of rights”

The request should contain sufficient information regarding:

  • the identity of the applicant;

  • the right they wish to exercise;

  • the information necessary to locate the data related to their request.

It will not be necessary to systematically attach a copy of your DNI.

Only where there are reasonable doubts regarding the identity of the applicant may we request additional information strictly necessary to verify their identity.

We will respond without undue delay and, as a general rule, within a maximum period of one month from receipt of the request.

Where necessary due to the complexity or number of requests, this period may be extended by a further two months, with the data subject being informed in accordance with the GDPR.

31. RIGHT TO LODGE A COMPLAINT

If you believe that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with:

Spanish Data Protection Agency (AEPD)
C/ Jorge Juan, 6
28001 Madrid
Spain

www.aepd.es

You may also contact VAULTS1 beforehand at informacion@cajasdeseguridad.es so that we can review and, where appropriate, resolve your request.

32. COOKIES AND SIMILAR TECHNOLOGIES

The website uses cookies and other similar technologies.

Strictly necessary cookies may be used without consent where they are essential for providing a function requested by the user.

Cookies that require consent, including:

  • analytics cookies;

  • advertising cookies;

  • personalisation cookies;

  • remarketing cookies;

  • other non-essential cookies,

will not be activated before the user has validly indicated their choice.

The user may:

  • accept cookies;

  • reject non-essential cookies;

  • configure categories individually;

  • subsequently withdraw consent.

Full information is available in the Cookie Policy of www.cajasdeseguridad.es.

33. THIRD-PARTY LINKS AND SERVICES

The website may contain links to pages or services managed by third parties.

VAULTS1 does not control the privacy practices of such third parties.

When leaving our website or using an external service, we recommend reviewing the relevant privacy policy.

34. CHANGES TO THIS POLICY

We may update this Privacy Policy when:

  • our services change;

  • we open new locations;

  • we introduce new technologies;

  • our providers change;

  • our data processing activities change;

  • applicable law or the criteria of competent authorities change.

The updated version will always be available at www.cajasdeseguridad.es.

The date of the latest update will appear at the beginning of the document.

Where changes materially affect the processing of personal data, data subjects will be informed through appropriate means.

CONTACT

VAULTS IBERICA S.L.
CIF: B56804255

Registered address:
Gran Vía Marqués del Turia, No. 4, Ground Floor
46005 Valencia, Spain

VAULTS1 facilities in Spain:

Valencia
Gran Vía Marqués del Turia, 4 Bajo
46005 Valencia
informacion@cajasdeseguridad.es
+34 646 555 871

Madrid
Calle de Zurbano, 65
Chamberí, 28010 Madrid
madrid@cajasdeseguridad.es
+34 679 592 232

www.cajasdeseguridad.es

To index