Privacy notice
Draft
Draft. not yet reviewed by a lawyer
This text is a working scaffold. It sets out the points Verita must cover, but it has not been settled by a qualified adviser and must not be relied on as it stands.
What we collect
From an applying business: registered name, trading name, registration number, tax identifier, registered address, contact details, and the documents required for its country. About beneficial owners and the applying representative: name, date of birth, nationality, country of residence, an identity document, and a proof of address. We also record every action taken on an application, including who viewed a document and when.
Why we collect it
To carry out the verification a business has asked us for, and to be able to justify a published verification if it is ever challenged. Identity documents are collected because a verification that does not establish who controls a business is not worth publishing.
What we publish
Only the following is public: registered and trading name, country, registration number, city, website, verification status, and the dates of verification, expiry or withdrawal. Uploaded documents, beneficial owner identities, applicant contact details and reviewer notes are never published.
Where it is stored
Documents are held in private storage, encrypted at rest, and reachable only through short-lived links issued to an authorised reviewer or to the business that uploaded them. [TO BE CONFIRMED: hosting region. If any beneficial owner is resident in the EU or UK, storage region and any transfer outside it must be stated here and lawfully justified.]
How long we keep it
[TO BE DECIDED WITH LEGAL ADVICE. Two obligations pull against each other: identity documents should not be held longer than necessary, but the evidence behind a published verification may need to be produced years later if that verification is disputed. The retention period must reconcile them and then be stated here plainly.]
Your rights
Depending on where you live, you may have the right to see the personal data we hold about you, correct it, ask for it to be deleted, object to how we use it, or complain to a supervisory authority. [TO BE COMPLETED: contact address for such requests, response time, identity of the data controller, and the relevant supervisory authority.]