Privacy Policy
Last updated: 29 September 2026
1. Who is responsible
Appieo, based in the Netherlands, owns and operates VaultPas and MijnPas. Appieo is the controller responsible for personal data processed through the VaultPas website. For privacy questions or requests, contact [email protected].
2. What this policy covers
This policy covers vaultpas.com, the website introducing the VaultPas platform and its products. It does not replace the privacy policy for MijnPas or another product. This website has no user accounts, card uploads or checkout, and does not receive the cards stored in your app. When you follow a product link, consult the privacy policy on that product’s website.
3. Website visits and technical information
Delivering and protecting a website involves processing technical information such as your IP address, requested URL, request time, browser information and response status. Hosting and network providers process this information to deliver pages, diagnose faults and prevent abuse. Appieo relies on its legitimate interests in operating a reliable, secure website for these purposes. We do not use this information to build advertising profiles or make automated decisions with legal or similarly significant effects.
4. Contacting us
If you email us, we process your email address, your name if supplied, the contents of your message and any attachments to respond and follow up. Our legal basis is our legitimate interest in handling enquiries; where your request concerns entering into a contract, we process the necessary information to take those steps at your request. Providing this information is voluntary, but we need a reply address and enough detail to answer. Please do not send card numbers, recovery codes, passwords or other sensitive app data.
5. Cookies and analytics
The VaultPas website does not use advertising trackers or audience analytics. Its application does not set tracking cookies or store a cross-site visitor profile. Infrastructure providers may process technical data or use essential mechanisms to deliver and secure the website. Linked product websites have their own cookie and privacy information.
6. Service providers and disclosure
We use hosting, network and email providers to operate the website and handle correspondence. The website hosting setup uses Google Firebase / Google Cloud and Cloudflare. Providers receive the information needed for their services, subject to applicable data-protection arrangements. We do not sell personal data. We may disclose information where legally required or where necessary to establish, exercise or defend legal claims. If processing involves a country outside the European Economic Area, applicable transfer protections must be in place, such as an adequacy decision or standard contractual clauses. Contact us for information about the safeguards applicable to your data.
7. How long information is kept
We keep enquiry correspondence while needed to answer and resolve your request and for any necessary follow-up. Any longer retention must be justified by a legal obligation or the establishment, exercise or defence of a legal claim. Technical records are retained according to the operational and security needs of the service and the applicable provider settings. Retention is assessed by the purpose of the record, whether the matter remains open and any applicable legal requirement; data should be deleted or anonymised when no longer needed.
8. Your rights
Depending on the circumstances, you can request access to, correction or deletion of your personal data, restriction of processing, and portability where the legal conditions apply. You can object to processing based on legitimate interests. If processing is based on consent, you can withdraw that consent without affecting earlier lawful processing. Send requests to [email protected]. We may ask for proportionate information to verify your identity. We normally respond within one month; if a lawful extension is needed, we will explain why within that month. You can also complain to the Dutch Autoriteit Persoonsgegevens or your local data-protection authority.
9. Changes
We update this policy when the website or its data processing changes. The date above identifies the latest version. Material changes will be explained on this website.