Privacy policy

1. Who we are

The controller responsible for the processing of personal data on this website is VERIDEX.

For questions about data protection, please contact us through the contact form on the Contact page.

2. What this policy covers

This policy applies to the website VERIDEX, including the company register, company profiles, Fraud Radar reports, user accounts, voting and the contact form. It concerns visitors, account holders, people who contact us and persons whose data appears in company profiles and reports.

3. Data we process

Visitors: you can search the register and read company profiles and Fraud Radar reports without an account. We do not ask you for any personal data for this; only the technical data described below is processed.

Account holders: to create an account you choose a login and a password. We do not ask for your name or e-mail address and send no confirmation e-mails. You may choose a login that does not reveal your identity. We store the login, the password as a hash, the date of creation and the status of the account (for example blocked or deleted).

Votes: with an account you can vote “True” or “False” on whether a company profile or report is accurate. We store the card you voted on, your vote and when you cast or changed it. Your account page shows your own votes; other visitors see only the totals.

Contact messages: when you use the contact form, we receive your name (optional), your e-mail address, the subject, a company registration number if you provide one, your message and the page from which you sent it.

Technical data: when you visit the site, your browser transmits your IP address and technical details such as the browser type and the page requested. We use the IP address briefly to limit the number of requests and prevent abuse, and we keep server logs for security. Cookies are described in our Cookie notice.

Persons named in company profiles and reports: company profiles contain business information which may include personal data of directors, signatories, shareholders and beneficial owners, such as their name, function and connection with the company as shown in the public source. Fraud Radar reports name websites, companies and sometimes persons, together with the evidence on which the report is based.

4. Sources of company data

We collect company information from public sources: public business registers, published annual accounts, court and insolvency notices, licence registers and the companies’ own websites. Fraud Radar reports are based on our own review of publicly available information; each report lists what was checked and the evidence relied on. We also take into account corrections sent to us by the companies and persons concerned.

5. Purposes and legal bases

Publication of business information from public sources and of editorial Fraud Radar reports: our legitimate interest and the public interest in transparency about companies and in protection against fraud (Art. 6(1)(f) GDPR).

User accounts and voting: performance of the contract for the use of the account (Art. 6(1)(b) GDPR).

Replying to contact messages: our legitimate interest in answering your request (Art. 6(1)(f) GDPR) or, where the request concerns your account, Art. 6(1)(b) GDPR.

Security, rate limiting, prevention of abuse and vote manipulation, moderation: our legitimate interest in a secure and reliable service (Art. 6(1)(f) GDPR).

Where we ask for your consent, the legal basis is your consent (Art. 6(1)(a) GDPR); you may withdraw it at any time with effect for the future. We do not use your data for advertising and do not sell it.

6. Right of reply and corrections

Companies and persons named in a company profile or a Fraud Radar report may ask us to correct inaccurate data, to publish their statement (right of reply) or to remove data. Each report gives its subject a right of reply.

You may object to the processing of your personal data in a profile or report and request its correction or erasure. We assess each request against the public interest in business information and freedom of expression and inform you of the outcome. Inaccurate data is corrected without undue delay.

Please send such requests through the contact form on the Contact page, stating the company name or registration number and the page concerned.

7. Recipients

The website runs on servers of a hosting provider in the EU/EEA, which processes data on our behalf under a data processing agreement (Art. 28 GDPR).

We disclose data to authorities or courts only where we are legally obliged to do so. We do not sell personal data and do not share it with advertisers. Company profiles and Fraud Radar reports are public and can be read by anyone.

8. International transfers

We do not plan to transfer personal data to countries outside the EU/EEA. Should this ever become necessary, we will do so only with the safeguards required by the GDPR, such as an adequacy decision or standard contractual clauses.

9. Retention

Account data and votes: as long as the account exists. A deleted account is kept for 14 days, during which it can be restored on request; it is then erased together with its votes. A withdrawn vote is deleted.

Contact messages: up to 24 months. IP addresses used for rate limiting: at most a few days. Server logs: up to 12 months, for security.

Company profiles and reports: as long as the information remains relevant to the public interest; outdated or corrected information is updated or removed.

10. Security

Passwords are stored only as hashes, never in plain text. All connections to the site are encrypted (HTTPS). Access to the admin area is restricted to authorised staff and protected by a separate sign-in. We review our technical and organisational measures regularly.

11. Your rights

Under the GDPR you have the right of access, rectification and erasure, the right to restriction of processing, the right to object to processing based on legitimate interest, the right to data portability and the right to withdraw your consent at any time.

You can change your login and password and delete your account yourself on your account page.

To exercise your rights, please contact us through the contact form on the Contact page. We reply within one month; in complex cases this period may be extended as permitted by the GDPR. We may ask for information to confirm your identity, for an account for example proof that you can sign in to it.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA country where you live or work or where the alleged infringement took place.

12. Changes to this policy

We may update this policy when our service or the law changes. The current version is always published on this page.