Veryfy

Automatic translation from Italian. In case of doubt, the Italian version prevails, which is also the only valid one for the legal pages.

How we handle data

Last updated: 24 October 2026 (draft)

Can we do this without the company's consent?

Yes. Business information companies operate in Italy under a Code of Conduct approved by the Garante Privacy (the Italian data protection authority) — the same framework on which CRIBIS and Cerved rely. The legal basis is legitimate interest in assessing a counterparty before a commercial transaction, not consent: checking who we are dealing with before invoicing or signing is not an intrusion, it is ordinary commercial prudence.

Do you use only public data?

Yes. Registro Imprese (Business Register), filed financial statements, protest registers, public insolvency proceedings: every piece of data you see in a report has a source and a date stated explicitly, not an opaque origin.

Do you compile files on private individuals?

No. We process data on a natural person only if they hold a corporate office, run the company or hold a significant stake in it — never on a natural person as such, outside a business role.

I appear as a director or shareholder in a report: what can I do?

You can ask to see which data appears, have it corrected if it is wrong, or object to the processing by writing to info@veryfy.eu. The full details of your rights are in the privacy notice.

How does the free anti-fraud check work?

It helps establish whether the person writing to you, or asking you for a payment, really is the company you verified. The most costly frauds between companies steal the identity of a genuine company: correct VAT number, but the fraudster's email, website or IBAN. We use only public and free sources, and each one is indicated next to the check:

  • VIES of the European Commission, for the VAT number and the name under which it is registered. If the VAT number is not in VIES, this does not mean the company is closed: many businesses do not trade with partners abroad.
  • Public DNS (Cloudflare): whether the domain exists and receives mail, whether it is protected against fake emails (SPF and DMARC), whether it is blocked by security filters as a malware or phishing domain, and which company services the company has declared on the domain.
  • Domain name registries (RDAP, and the WHOIS of the .it Registry): only the registration date. Domains created a few days ago are the classic tool of the fake supplier.
  • The company's website: whether the home page shows the VAT number, as the law requires (art. 35 DPR 633/1972).
  • Have I Been Pwned: whether the company's website has suffered known data breaches.
  • Open-source lists on GitHub of disposable email domains (disposable-email-domains, CC0) and our own list of free webmail providers.
  • The IBAN we check ourselves with the standard algorithm (ISO 13616): whether it is correctly written and which country it belongs to. We do not know, and do not state, whose name the account is held in.

What we do not do: we do not test the email on websites to discover where it is registered, we do not search for personal profiles, we do not access confidential databases. Of the email we keep only the domain; of the IBAN only the country and the last 4 digits.

How long do you keep the data?

Reports remain available to those who purchased them for as long as necessary and for the tax obligations required by law. We reuse the same data collected only for 7 days, to avoid charging twice for the same check — not to build an archive of our own.