Privacy Policy Notice

Tanzco Ltd

The Coach House
Greys Green Business Centre
Henley-On-Thames RG9 4QG

Introduction

PRIVACY NOTICE

This privacy notice sets out how Tanzco Limited uses and protects your personal data as described in Section 4 - The types of personal data we collect about you of this privacy notice. This privacy notice is provided in a layered format so you can click through to the specific areas set out below. Alternatively, you can download a copy of the policy here. 

1. Summary of this Privacy Notice

2. Important information and who we are

3. Overview of Tanzco’s support to a VS

4. The types of personal data we collect about you

5. How is your personal data collected

6. How we use your personal data

7. Purposes for which we will use your personal data

8. Direct marketing

9. Disclosures of your personal data

10. International transfers

11. Data management and third-parties

12. Data security

13. Data retention

14. Situations where a VS lacks capacity

15. Your legal rights

16. Contact details

17. Complaints

18. Changes to the privacy notice and your duty to inform us of changes

19. Third-party links

1. Summary of this Privacy Notice

This is a summary of our Privacy Notice to help you understand how we collect, use and protect your personal information when you use our app in compliance with the UK GDPR. We strongly encourage you to read the entirety of this notice but have provided a summary of key and relevant points for your attention. 

• For the purposes of this Privacy Notice, Tanzco is the Data Controller as referenced in the UK GDPR, the UK Data Protection Act 2018, the Data (Use and Access) Act 2025 and the EU GDPR (EU) 2016/679 and is responsible for your personal data.

• Any data that is uploaded to TrustVault does not automatically alert the police or any relevant authorities. If you are in imminent danger, please use and contact emergency services immediately. 

• The collection of your personal data begins from the point of a user registers a user account in the App, Platform or Website. Any user interactions within the App may also be recorded for the purposes of distinguishing between genuine and fraudulent accounts and rating the credibility of information and data stored within the App. 

• In the instance an alleged criminal offence has been committed, your personal data may be collected, processed, shared and retained to fulfil any legal obligations we may hold as a Data Controller and to perform any activities mandated as a required public task. This is further detailed in Section 5 – How is your personal data collected in this privacy notice. 

• When you “register” to use the App, you create a user account to access its features and services. Registration involves providing certain personal information. By registering, you agree that we may process this information to provide you with the App’s functionality and ensure your user account is secure, all in accordance with this privacy notice and applicable UK legislation. 

• Tanzco does not hold or store any personal data within the company itself, except your usernames and phone number necessary to provide the App’s functionality and services. All data is stored on encrypted back-end servers. These servers are inaccessible to anyone and cannot be accessed by the staff of Tanzco without an encryption key. 

• The following types of personal data (which are defined in this privacy notice) may be collected, used, stored and transferred: Identity Data; Contact Data; Financial Data; Transaction Data; Technical Data; Profile Data; Appearance Data; Usage Data; Employment Data; Family Data; and Child and Dependant Data. 

• To protect the vital interests of an individual, we may disclose data that suggests a serious and imminent risk to life that we become aware of with a court, emergency services and any relevant authorities where lawful and necessary, even without your consent. 

• We cannot act on data that has been uploaded to TrustVault, but that we are not aware and have no knowledge of. 

• Any personal data that we collect about you will be for the purposes as set out in Section 7 – Purposes for which we will use your data. 

• The following legal bases are what we rely on for the purposes of collecting and using your personal data: performance of a contract with you; legitimate interests; legal obligation; and consent. 

• If as a user you fall under a “special category” as listed in Section 6 - How we use your personal data, we may continue to collect and process personal data using the following bases: the protection of the vital interests of an individual (in relation to your health and safety); explicit consent; a substantial public interest exists; or the collection and processing is required for the establishment, exercise or defence of legal claims. 

• There may be instances where we share your personal data with third-parties whose details can be found here: https://www.trustvault.uk/suppliers. Any third-parties that receive such data will do so under our instructions and will be for specified purposes.

• In the instance a user of the App, Platform or Website is deemed to be lacking capacity, pursuant to the Mental Capacity Act 2005, we may be required to take certain measures with regards any personal data that is shared. Such measures are set out in the table as in Section 14 – Situations where a VS lacks capacity. 

• Access to your personal data is limited to those employees, agents, contractors and other third-parties who have a contractual requirement to receive it. All parties will process personal data on our instructions and are subject to a duty of confidentiality. 

• Personal data may be transferred to international service providers that carry out specific functions on our behalf. All providers will be compliant with any relevant international data and privacy law regulations. 

• Personal data will be held only for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. 

You have a number of rights as a data subject under the UK GDPR as a user of our services in relation to your personal data. These rights have been set out in Section 15 – Your legal rights. They include: (1) the ability to request access to your personal data; (2) request any correction of your personal data; (3) request the erasure of your personal data; (4) object to the processing of your personal data; (5) request the transfer of your personal data; (6) restrict any processing of your personal data; and (7) to withdraw consent with regards processing your personal data.

2. Important information and who we are

We are Tanzco Limited (collectively referred to as "Tanzco", "we", "us" or "our" in this privacy notice). We are a limited company registered in England and Wales under registration number 14952228 and our registered office is at The Coach House, Greys Green Business Centre, Henley-On-Thames, Oxfordshire, England, RG9 4QG. 

Privacy notice

This privacy notice gives you information about the types of personal data gathered by Tanzco and how it is processed through use of a mobile application known as “TrustVault”. This privacy notice also explains your rights in relation to your personal data. We are committed to handling your personal data in accordance with all applicable UK legislation and we shall ensure to keep this privacy notice up to date and reflective of new or amended legal requirements and further regulatory guidance. This privacy notice applies to “you” or “your” personal data that you may share within TrustVault:

• a victim survivor/s of domestic abuse as defined by the Domestic Abuse Act 2021 (“VS”) who use the TrustVault mobile application (“App”);

• friends or family of a VS (“Friend/s”) wishing to use the services associated with TrustVault can do so through our web platforms (“Platform”);

• individuals as part of the police force (“Police”) using our portal (“Portal”) to support a VS; 

• individuals using the Platform to share information and personal data with a school or education centre (whom are independently and collectively referred to as “School/s”) supporting a child or dependant of a VS; 

• individuals using the Platform to share information and personal data as an employer, charity, health services provider and legal services provider (whom are independently and collectively referred to as “Organisational User/s”) to support a VS; and

• anyone who accesses the TrustVault website and any relevant social media platforms or channels (“Website”).

This website, the App, Platform and Website are not intended for the use of children but there may be instances where we collect information and personal data relating to children. When a child views or witnesses domestic abuse, they are classified as a victim of such domestic abuse. Schools may collect information and personal data relating to a child in connection with a case of domestic abuse and input this into the Platform. 

However, Schools would have no obligation to notify the VS that the case of domestic abuse relates to of the nature of such information and personal data, unless required to do so as part of any legal proceedings. In such instances, our handling, processing, transferring and any disclosure of such personal data shall be strictly compliant with all relevant data protection laws.

Platform comprises two URL’s which are: (1) for employers - https://employers.trustvaultplatform.com; and (2) for services - https://supportservices.trustvaultplatform.com.

Controller

Unless stated otherwise, Tanzco is the “Data Controller” as referenced in the UK GDPR, the UK Data Protection Act 2018 and EU GDPR (EU) 2016/679 and is responsible for your personal data.

This privacy notice is issued on behalf of Tanzco. Our “Group” of companies may from time to time, be made up of different legal entities so when we mention "Company", "we", "us" or "our" in this privacy notice, we are referring to the relevant company in the Group responsible for processing your data. Tanzco is the Data Controller and responsible for this website.

We have appointed a data protection officer (“DPO”) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights (Section 15 - Your legal rights), please contact us using the information set out in the contact details section (Section 16 - Contact details). 

Processor 

Certain parties referenced throughout this privacy notice will act as a “Data Processor” as referenced in the UK GDPR, the UK Data Protection Act 2018 and EU GDPR (EU) 2016/679.

3. Overview of Tanzco’s support to a VS

We have created the App to provide VS a secure place to store evidence of domestic abuse they may be suffering, communicate with Organisational Users and Friends, access support and plan for life beyond the domestic abuse they are suffering through a “Your Plan” function. 

VS user accounts are secured with a password. VS can choose to allow the Police to generate an incident report and access specific evidence stored within their user account by providing them with a “Victim Code” which the Police can use on the Portal. Further information regarding the Victim Code is provided in Section 11 - Data Management and Third-Parties of this privacy notice.

A VS is also provided with a “safety password” to use when under duress or pressured circumstances. The safety password, once entered, will cause the App to display an account suspension screen. 

With our support and through a partnership with Visa, VS can obtain a “Visa e-wallet” which allows them to deposit funds and make transactions through a bank account which is separate from any other bank accounts they operate. 

VS can also apply to the Tanya Vlok Foundation (charity number 1196444 - https://www.thetanyavlokfoundation.org/privacy-policy) (“Foundation”) for financial support grants. The VS can access the application form (which is held in the Foundation’s website) for such grants via a link in the App. The Foundation is the Data Controller of all personal data submitted during this application process and is governed by its own data privacy framework.

The handling, processing, transferring and any disclosure of personal data in connection with the activities described above will always be carried out in strict compliance with this privacy notice at all times. 

4. The types of personal data we collect about you

Personal data means any information about an individual from which that person can be identified.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data including but not limited to first name, last name, any previous names, username or similar identifier, marital status, title, date of birth and gender.

• Contact Data including but not limited to correspondence address, residential address, email address, social media handles and telephone numbers.

• Financial Data including but not limited to any Visa e-wallet (as described in Section 3 - Overview of Tanzco’s support to a VS of this privacy notice) details.

• Transaction Data including but not limited to details about deposits and purchases (via merchant transactions) you make into your Visa e-wallet and grants (the application process for obtaining such grants is described in Section 3 - Overview of Tanzco’s support to a VS of this privacy notice) paid into your Visa e-wallet by the Foundation.

• Technical Data including but not limited to internet protocol (IP) addresses, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website, the App, Portal, Platform and Website.

• Profile Data including but not limited to your username, password and safety password. 

• Appearance Data including but not limited to images and any likeness of an individual that you may upload to the App.

• Usage Data including but not limited to information about how you interact with and use this website, the App, Platform and Website.

• Employment Data including but not limited to the name of your employer and your job title.

• Family Data including but not limited to information relating to (1) any individual who you refer to the Platform; or (2) anyone who is a risk to you.

• Child and Dependant Data including but not limited to information relating to children, your child or children, or any other dependants.

We also collect, use and share aggregated data such as statistical or demographic data. This is not personal data. An example of such use would be to aggregate an individuals' App Usage Data to calculate the percentage of users accessing a specific website feature to analyse general trends in how users are interacting with our website to help improve and optimise the website and our service.

5. How is your personal data collected

Note that the “Evidence Vault” is an isolated repository with no third-party access – information is shared by a VS, via the App or the Website. All information and personal data we collect is securely transferred and stored on this internal back-end server. No third-parties can access the Evidence Vault including external parties, third-party service providers, or the general public.

When registering a user account with TrustVault, you will create a username and provide to us your mobile phone number. Once a user account is created, we will generate a unique identifier code associated to these details and the user account.     

Upon receiving a query from the Police, Evidence Vault compiles the data to be transferred in manner that is compatible with Police systems and shares it with them. Access shall never be granted unless we are legally required to do so as an order of the court as per Article 6(1)(c) of the UK GDPR. 

We use different methods to collect data from and about you depending on what type of user you are:

VS

• Your interactions with us. You may share your personal data with us through your use of the App. This includes personal data you provide when you:

• create a user account on the App;

• upload files, information or records of correspondence to the App;

• record information in the Your Plan section of the App;

• seek technical support in using the App; and/or

• engage in transactions through your Visa e-wallet.

• Third-parties or publicly available sources. If you are a VS, we will receive personal data about you from various third-parties as set out below: 

• Identity Data, Contact Data, Financial Data, Appearance Data, Employment Data, Family Data, Special Category Data and Child and Dependant Data from Organisational Users and Friends as a result of your interactions with them, including any evidence you provide to them, being uploaded to the App and Evidence Vault.

• You may also apply financial grants from our charitable partners via the grant contact form within the App (as described in Section 3 - Overview of Tanzco’s support to a VS of this privacy notice). As a result, we will collect some Financial Data and Transaction Data in relation to any applications you make.

Friends

• Through a VS. A VS user of the App may send you a referral link to register to the Platform for the purposes of securely communicating with them. At this stage, we will collect your Contact Data from the VS. Your personal data may also be included in any information or files that the VS uploads to the App.

• Your interactions with us. You share your personal data with us through your use of the Platform. This includes but is not limited to personal data you provide when you:

• create an account on the Platform;

• communicate with the VS who referred you to the Platform; and/or

• communicate with any other users of the App or Platform.

Organisational Users and Schools

• Your interactions with us. You may share your personal data with us through your use of the Platform. This includes but is not limited to personal data you provide when you:

• create an account on the Platform;

• upload files or records of correspondence to the Platform; and/or 

• communicate with any other users of the App or Platform.

Police

• Your interactions with us. You may share your personal data with us through your use of the Portal.

 All users

• Automated technologies or interactions. As you interact with this website, the App, Platform or the Website, will automatically collect Identity Data and Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies.

• Technical Data is collected from the following parties:

• Analytics providers;

• Advertising networks based inside/outside the United Kingdom (UK); and 

• Search information providers based inside/outside the UK.

6. How we use your personal data

Legal basis

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

• Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you.

• Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

• Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.

• Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.

The following special categories of personal data are considered sensitive under the laws of England and Wales and may receive special protection:

• Racial or ethnic origin.

• Political opinions.

• Religious or philosophical beliefs.

• Trade union membership.

• Genetic data.

• Biometric data.

• Data concerning health.

• Data concerning sex life or sexual orientation.

• Data relating to criminal convictions and offences may also receive special protection under the laws of your jurisdiction.

If you are a VS, we may collect and process the above special categories of personal data on the following legal bases:

• Processing is necessary to protect the vital interests of an individual (this means that there might be a danger to a person’s health or safety).

• You explicitly consent to such collection and processing.

• Collection and processing are in the substantial public interest (safeguarding of children and of individuals at risk).

• Collection and processing are necessary for the establishment, exercise or defence of legal claims (bringing criminal cases against anyone who is a risk to you).

We do not anticipate the need to process special category data relating to Organisational Users, Police, Schools or Friends.

In the instance processing is necessary to protect the vital interests of an individual, we may disclose data that suggests a serious and imminent risk to life that we become aware of, for example, via support messages you send to us or organisational users. This data may be shared with a court through written request or warrant, or to the emergency services and relevant authorities where lawful and necessary, even without your consent. 

We cannot act on data that has been uploaded but we are not aware of. 

Biometric Data

Where a VS has enabled use of biometrics to access the App, we will collect biometric data from you, including but not limited to, data about your fingerprints and facial geometry. In such instances, our handling, processing, transferring, storage and any disclosure of such personal data shall be strictly compliant with all relevant data protection laws.

Communications with Organisational Users

Any messages that you may send to Friends, Schools or Organisational Users are processed by us. Disclosing information which suggests a serious and imminent risk to life or safety in these messages, Tanzco may contact emergency services or any relevant safeguarding authorities without your consent where this is deemed lawful and necessary. 

7. Purposes for which we will use your personal data 

We have set out below, in a table format, a description of all the ways we plan to use the various types of your personal data (as outlined in Section 4 - The types of personal data we collect about you of this privacy notice) and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. Where we process special category data, we will set out the additional condition that we rely on in processing such data (pursuant to Article 9 UK GDPR and as outlined in Section 6 - How we use your personal data of this privacy notice). 

In the column named ‘Types of data’, we have listed the types of personal data that we would ordinarily expect to collect in relation to each purpose. However, the types listed in each row are not exhaustive and there may be instances where we may collect data beyond what is listed, where necessary to fulfil each purpose.