Privacy notice

Veryfy di RM, with registered office at Via Angelo Brofferio 181, Asti (AT), VAT number (P.IVA) 01627330051 — contactable at info@veryfy.eu.

The controller (RM) has chosen to act as its own point of contact for data protection. Contactable at the same address as the controller.

Veryfy is a company verification service: upon a user's request about a specific company or VAT number, we collect and process public data — the company's registry and chamber of commerce details, filed financial statements, information on shareholders and directors, credit risk indicators, protests and insolvency proceedings — to produce a summary report.

The data comes from official public sources (Registro Imprese, Camere di Commercio (Chambers of Commerce), filed financial statements, protest registers) through the technical provider OpenAPI.com, which aggregates and structures these sources. The source and date of each piece of data shown in the report are always indicated, as required by the Code of Conduct for the processing of personal data in the context of business information, adopted pursuant to art. 20, paragraph 4, of the Privacy Code (art. 2-quater D.Lgs. 196/2003).

With every product on a company we offer an anti-fraud check: after purchase, the user may indicate the email or website from which the company contacted them and the IBAN they were asked to pay, in order to verify that they really belong to that company. The purpose is fraud prevention, a legitimate interest recognised by recital 47 of the GDPR (art. 6, para. 1, lett. f).

Data minimisation. From the email we use and retain only the domain (the part after the @), never the full address; from the IBAN we calculate formal correctness ourselves, without sending it to anyone, and retain only the country and the last 4 digits. All checks concern the company and its domain: we read data that the company itself makes public (DNS records, the home page of the website) and public registers (VIES, domain name registries, of which we use only the registration date). We do not verify on which sites an email address is registered and we do not search for personal profiles.

With the Over-indebtedness Report the user entrusts us with a questionnaire on their debt situation: causes of the indebtedness, list of creditors and amounts, income and expenses of the household, assets, acts carried out in the last five years, and certain declarations on circumstances relevant to merit (meritevolezza). The data is what the user writes about themselves and their dependent family members; the legal basis is the contract with the data subject (art. 6, para. 1, lett. b, GDPR), and their tax code is used to query the public sources described in §4 for the purpose "verification on myself". Until payment, the questionnaire remains in the user's browser; upon payment it is saved with the order and the report, in order to produce the document, make it downloadable and regenerate it in the event of a technical error.

The questionnaire may contain data concerning health (for example medical expenses, or illness among the causes of indebtedness): this is processed only if the user enters it, on the basis of their explicit consent (art. 9, para. 2, lett. a, GDPR), which they may withdraw by writing to info@veryfy.eu, also requesting the deletion of the data. We do not access credit information systems or the Centrale dei Rischi (Bank of Italy central credit register), we do not disclose the document to creditors or third parties, and we do not file it with the court: we deliver it only to the user, who shares it with their lawyer and with the OCC.

The processing is based on the legitimate interest of the controller and its users (art. 6, para. 1, lett. f, GDPR) in assessing the reliability of a commercial counterparty before invoicing, signing a contract or granting credit — the same legal basis on which the other business information providers authorised in Italy operate (e.g. CRIBIS, Cerved). The consent of the company or of the verified persons is not required.

Where the natural person holds a corporate office, an administrative role or a significant shareholding in the verified company, the processing falls within the above-mentioned Code of Conduct for business information, with the same scope already described.

We also offer a verification on the natural person as the main subject, independent of a corporate role (e.g. a professional before entrusting them with an engagement, a guarantor or surety, a partner or director in due diligence, a tenant before letting them a property). In this case the Code of Conduct for business information does not apply directly: the legal basis remains legitimate interest (art. 6, para. 1, lett. f, GDPR), limited however to four purposes that are declared and verifiable vis-à-vis a third party, which are the only ones for which the service is offered: verification of an existing or prospective professional or contractual relationship; verification of a guarantor or surety; due diligence on a partner or director in the context of a corporate or commercial transaction; verification of a tenant before entering into a lease. Excluded, and not permitted by the service, are the verification of third parties out of personal curiosity, the verification of a partner or former partner, private disputes and any form of surveillance.

Verification of one's own data. When the user declares that they are verifying themselves ("Verification on myself" purpose on their own tax code, or "My company" on their own VAT number), the processing of the data concerning them is based on the performance of the contract concluded with the data subject themselves (art. 6, para. 1, lett. b, GDPR). The declaration that the tax code or VAT number is their own is made by the user under their responsibility: we do not verify the identity of the person making it. In this case too, the data processed is exclusively from public sources: we do not access credit information systems or the Centrale dei Rischi.

Before each verification we ask the user to declare the purpose of the request (for a company: invoicing, contract, debt recovery, assessment of a stake, or verification of their own company; for a natural person: one of the four purposes above or verification of themselves). This declaration is necessary to document the legal basis, but responsibility for the processing remains ours: the user's responsibility is added to ours, not substituted for it.

• Generating the verification report requested by the user
• Managing the purchase and invoicing (data of the paying user, not of the verified party)
• If activated by the user, monitoring over time an already verified company (the "Sentinella" feature) and alerting the user to significant changes
• At the user's request, performing the anti-fraud check on an already verified company (see §3 bis)
• If the user accesses the restricted area, managing the account and the referral programme (see §10)
• Complying with legal obligations (tax, accounting, anti-money laundering where applicable)

Generated reports are kept for as long as necessary to make them available to the user who purchased them and for legal tax obligations. Data collected for a single report is not reused for verifications requested by other users beyond the technical cache window (7 days), which exists to avoid double charges for the same request, not to build an archive of our own.

The outcome of the anti-fraud check is kept together with the report or purchase to which it refers, for the same period, in the reduced form described in §3 bis.

To provide the service we rely on third-party providers who process data on our behalf:

• OpenAPI.com (Italy) — source of company registry, financial statement and risk data
• Supabase — database infrastructure, project hosted in the European Union
• Stripe — payment management
• Resend — sending of transactional emails (report delivery, Sentinella notifications, restricted-area access links)

For the anti-fraud check we also query public services, sending only the VAT number or the domain name of the company: VIES of the European Commission; Cloudflare's public DNS resolvers and, as a fallback, Google's; domain name registries (RDAP and, for .it domains, the WHOIS of the Registro .it); the public catalogue of data breaches of Have I Been Pwned (Australia); the website of the indicated domain. These are not processors acting on our behalf: they respond to public queries.

With each provider that processes data on our behalf there is an agreement governing the processing (appointment as processor under art. 28 GDPR, where applicable) and the safeguards for any transfers outside the EU.

Anyone appearing in a report generated by Veryfy as a shareholder, director or beneficial owner may exercise, against the controller, the rights of access, rectification, erasure, restriction and objection to processing provided for in arts. 15-22 GDPR, by writing to info@veryfy.eu. We respond within 30 days.

Without prejudice to any other administrative or judicial remedy, a complaint may be lodged with the Garante per la protezione dei dati personali (Italian Data Protection Authority), in the manner indicated on the website www.gpdp.it.

Access. To enter the restricted area, the user enters their email address and receives a single-use link valid for 30 minutes. We process the email, the date of access and a cryptographic hash (hash) of the IP address, never the IP address in clear. Legal basis: performance of the service requested by the user (art. 6, para. 1, lett. b, GDPR). The session cookie "vf_sessione" (30 days) is a technical cookie, necessary to stay logged in: it does not require consent.

Referrers. To manage the referral programme we process the referral code, successful referrals, the credit earned and the credit used. Legal basis: performance of the rules of the referral programme to which the user adheres (art. 6, para. 1, lett. b, GDPR).

Invitees. If the invited person clicks "Accept the invitation", we save in their browser the cookie "vf_invito" (30 days), containing the referral code, the acceptance date and the hash of the IP address: the cookie is set only with that click, and anyone who does not want it may proceed with "Continue without invitation" or delete it from the browser. When the invitee makes a purchase, we record the product purchased and a normalised form of their email, to verify that it is a new customer and that it is not a self-referral. Legal basis: consent expressed by the click for the cookie (art. 122 Privacy Code, Codice Privacy) and the controller's legitimate interest in preventing abuse of the programme (art. 6, para. 1, lett. f, GDPR). We do not disclose to the referrer the name or email of the invitee: they see only the product purchased and the status of the credit.

Retention. Access links are deleted 30 days after issue. Referral programme data is kept for as long as the account is active and the credit is usable; data linked to a payment follows the timelines of tax and accounting obligations. The user may request the closure of their account at any time by writing to info@veryfy.eu.