Privacy notice
This notice describes how the Veridyn product passport service (the Service) processes personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and Act CXII of 2011 (the Hungarian Info Act).
1. The data controller
Name: being finalised
Registered seat: being finalised
Company registration / registry number: being finalised
Tax number: being finalised
Representative: being finalised
Email: [email protected]
Phone: being finalised
Appointing a data protection officer is not mandatory; you can reach us at the email address above with any data protection questions.
2. Scope and roles
This notice applies to visitors of the veridyn.eu website, registered users and those who contact us.
Roles: the Provider is the data controller for account and billing data. As regards the data users upload into product passports – to the extent it contains personal data – the user is the data controller, while the Service acts as a data processor under the separate Data Processing Agreement (DPA) (see also the Terms of Service).
Where the Provider acts as a processor — processing data on the User’s instruction (product data, uploaded documents, supplier contacts, team members, outbound notifications, access links) — the obligations are detailed in the separate Data processing agreement: subject matter, sub-processors, security measures, breach handling and audit rights.
3. Data processed, purposes and legal bases
| Data category | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data: name / company name, email, password (in "hash" form) | Account, login, providing the Service | Contract – Art. 6(1)(b) | For the account's lifetime + 30 days |
| Product passport data (entered by the user) | Producing public, multilingual passports and QR codes | Contract – Art. 6(1)(b) | Until the product / account is deleted (or statutory retention) |
| Contact form: name, email, company, message | Responding to the enquiry | Legitimate interest – Art. 6(1)(f) | 24 months (automatic deletion) |
| Password reset token | Securely resetting the password | Contract / legitimate interest | 1 hour (single use) |
| Scan log (timestamp, IP hash) | Analytics, operation, abuse prevention | Legitimate interest – Art. 6(1)(f) | 24 months (automatic deletion) |
| Invited team members: name, email, role and permission list | Managing several users within one account; who may see and change what | Performance of contract – Art. 6(1)(b). The data is provided by the account owner, who is the controller towards the team member. | Until access is revoked, then together with the account (closure + 30 days) |
| Supplier data request: the supplier’s name and email address, the requested fields, a message, and a single-use access token | On the user’s instruction we request data from their supplier through a token-based form so that missing product data can enter the passport. We send the request on the user’s instruction. | The user’s (controller’s) legitimate interest or contract — we act as a processor. The user warrants that they are entitled to give us the supplier’s contact details. | Until the request is closed (merged or cancelled), then together with the account. The token is valid until its expiry. |
| Outbound notifications (webhooks): the configured HTTPS endpoint, the event body and the delivery log (attempts, HTTP status, error message) | At the user’s request we notify their own system when a passport changes. This is a transfer initiated by us to an address the user specifies. | The user’s instruction — we act as a processor. The user is responsible for the endpoint’s security and for what happens to the data once delivered. | Closed delivery rows (delivered or permanently failed): 90 days. At most 6 retries with increasing back-off. |
| Provider access log: which of our staff, which account, when in and when out, IP fingerprint | For support and troubleshooting our staff may enter an account. We record this in an append-only log, and the user can see it themselves in Settings. Every version saved this way is marked in the change history. | Legitimate interest – Art. 6(1)(f): providing the service and accountability. The balancing test concluded that the fact of access must also be visible to the customer. | Not deleted automatically — this log is the evidence of accountability. It can be thinned on request after individual assessment. |
| DPP-readiness test: email address and the submitted answers (including from non-registered prospects) | Sending the test result and — if you consented — contacting you about getting prepared | Consent – Art. 6(1)(a). Consent may be withdrawn at any time without consequence. | Until consent is withdrawn, but at most 24 months from the last contact |
| Sign-in attempts: email, IP address, timestamp, success or failure | Preventing password guessing and abuse (attempt throttling) | Legitimate interest – Art. 6(1)(f): protecting accounts | 7 days (automatic deletion). The throttling window is hourly, so longer retention would serve no purpose. |
| Developer API: the key’s irreversible fingerprint (the plain key is shown once, at creation), call counters, and responses cached for replay protection | Authenticating machine integrations, enforcing the rate limit, and making sure a repeated request does not create the same thing twice | Performance of contract – Art. 6(1)(b) | The key until revoked; the replay-protection cache 48 hours |
| Test account (sandbox) data and the shared demo account | Trying out an integration without touching live data. The sandbox sends no outbound calls (email, webhooks). The demo account is read-only: anything typed there is not saved. | Performance of contract – Art. 6(1)(b) | Sandbox contents can be emptied at any time and the reset date is visible; it is deleted when the account ends |
| Uploaded documents (PDF, image) and their visibility tier | Attaching certificates, declarations of conformity and test reports to a passport. Files are stored outside the web-accessible area; they are served only after an access check. | The user’s instruction — we act as a processor. The user is responsible for the document’s contents (trade secrets, third-party data). | Until the user deletes it, or together with the account (closure + 30 days) |
| Access links: token, visibility tier, label, expiry, use count and last use time | The user can open a narrower data tier to an authority or a party with legitimate interest, without sign-in. Use tracking exists so that a leaked link becomes detectable. | The user’s instruction — we act as a processor | The link is valid until expiry or revocation; the log row remains afterwards for traceability. Without an expiry the link never expires — the system warns about this at creation. |
The retention periods shown in italics are finalised by the data controller in line with its actual practice.
4. DPP-specific processing
- Public product passport: product passports are PUBLICLY accessible (anyone can view them via the QR code or a link). If the user (data controller) enters personal data into the passport (e.g. the name or email of the economic operator's contact), it appears on the public passport; the user ensures its legal basis and necessity.
- Scan analytics: we log passport views in aggregate; the IP address is stored not in identifiable form but as an irreversible hash (the visitor cannot be identified), and bot traffic is filtered. Legal basis: legitimate interest.
- Layered access: the user may issue an expiring link to an authority or a party with legitimate interest to view the non-public fields.
- EU DPP registry: on the user's behalf, we may transmit the product passport identifiers to the central EU registry once it becomes available.
5. Data processors
We use the following data processors to operate the Service:
- Hosting provider / server: Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany – EU) – hosting of the website and the database within the European Union; no transfer to a third country.
- CDN, proxy, DNS and security: Cloudflare, Inc. (USA) – caching of website traffic, DDoS protection, DNS and security filtering; processes IP addresses and technical traffic metadata. Transfer safeguard: EU Standard Contractual Clauses (SCC) and the EU–US Data Privacy Framework (DPF).
- Email delivery: smtp2go (Help Monkey Limited; EU delivery server: mail-eu.smtp2go.com) – transactional emails (welcome, password reset, notifications).
- Payment provider: Stripe (Stripe Payments Europe, Ltd., Ireland; parent: Stripe, Inc., USA) – processing subscription fees and subscriptions. Transfer safeguard: SCC and DPF.
6. Data transfers, third countries
We transfer personal data to third parties only through the data processors listed above, for the stated purposes. Where a data processor processes data outside the EEA, the transfer takes place with appropriate safeguards (e.g. the European Commission's Standard Contractual Clauses, SCC – and/or the EU–US Data Privacy Framework, DPF). We do not disclose or sell data for marketing purposes.
7. Rights of the data subject
The data subject has the right of access (Art. 15), rectification (16), erasure ("right to be forgotten", 17), restriction of processing (18), data portability (20), and the right to object (21) to processing based on legitimate interest. Where processing is based on consent, it may be withdrawn at any time (this does not affect the lawfulness of processing before withdrawal).
You can exercise your rights at [email protected]; we fulfil your request without undue delay, and no later than within 1 month.
8. Cookies
The website uses cookies necessary for its operation. Details in the Cookie Policy.
9. Data security
We store passwords solely in a secure, one-way "hash" form; API keys are also hashed; communication is encrypted over HTTPS; the interface is protected by CSRF and session safeguards. We access the data only to the extent necessary to perform the task.
10. Children
The Service is aimed at businesses, not children. We do not knowingly collect data from persons under the age of 16.
11. Legal remedies
You may lodge a complaint about data processing with the supervisory authority:
National Authority for Data Protection and Freedom of Information (NAIH)
1055 Budapest, Falk Miksa utca 9–11. · naih.hu · [email protected]
If your rights are infringed, you may also turn to a court.
12. Amendment of this notice
We may amend this notice as needed; the version in force at any given time is available on this page, with the date of the update.