Privacy Policy

The controller of your personal data is vinireto s.r.o., IČO 23101717, with its registered office at Školská 660/3, Nové Město, 110 00 Prague 1, Czech Republic, registered at the Municipal Court in Prague, File No. C 421409. Contact for privacy matters: privacy@verdex.trade; data box (datová schránka) yczu4tp. We have not appointed a Data Protection Officer, as we are not required to do so.

• Account and identity data — the name, business e-mail address, role, and the company you represent (company name, country, and business details you provide).
• Verification (KYB) data — information and documents you submit for business verification.
• Transaction and activity data — sourcing requests, quotes, orders, disputes, reviews, and related records that identify the individuals acting for the parties.
• Communications — messages and enquiries you exchange through the Platform, and e-mails we send you.
• Technical data — IP address, device and browser information, log data, and cookie identifiers (see our Cookie Policy).

Please do not submit special categories of personal data through the Platform. The Platform is not intended for consumers and should not be used to process consumer personal data.

We process personal data for the following purposes and on the following legal bases under Article 6(1) GDPR:

• To provide the Platform and perform our contract with you (Art. 6(1)(b)) — creating and managing your account, publishing Listings, enabling requests, quotes, orders, messaging, disputes and reviews.
• Our legitimate interests (Art. 6(1)(f)) — securing the Platform, preventing fraud and abuse, verifying businesses, enforcing our Terms, moderating communications (including detecting and redacting attempts to share off-platform contact details in pre-order messages), maintaining records, and improving and promoting the service. Where we rely on legitimate interests, we balance them against your rights and freedoms.
• Compliance with legal obligations (Art. 6(1)(c)) — meeting accounting, tax, and other legal requirements to which we are subject.
• Consent (Art. 6(1)(a)) — where we ask for it, for example for any optional communications or non-essential cookies. You may withdraw consent at any time.

We do not sell personal data. We share personal data with service providers that process it on our behalf as processors, under written data-processing terms, and only as necessary to operate the Platform:

• Hosting infrastructure — Hostinger International Ltd., which hosts the servers and database on which the Platform runs (EU data centre).
• Cloudflare, Inc. — for DNS, content delivery, security, and object storage (Cloudflare R2) of uploaded files such as certificates and media.
• Mailgun (Sinch) — for delivering transactional e-mails (using our EU sending region).
• Anthropic, PBC — an AI provider we use (a) to help sellers pre-fill listings by reading uploaded certificates, and (b) to assist moderation of pre-order messages for attempts to share off-platform contact details. Relevant document or message content may be transmitted to Anthropic for this processing.

We may also disclose personal data to competent authorities, advisers, or acquirers where required by law or to establish, exercise or defend legal claims.

Some processors (for example Cloudflare and Anthropic) are established outside the European Economic Area or may process data outside it. Where personal data is transferred outside the EEA, we rely on an appropriate transfer mechanism under Chapter V GDPR, such as the European Commission’s Standard Contractual Clauses or an adequacy decision, together with any additional safeguards required.

We keep personal data for as long as your account is active and thereafter for as long as necessary for the purposes set out above — including to comply with legal obligations (for example, accounting records are kept for the statutory period), to resolve disputes, and to enforce our agreements. Records of policy violations may be retained for as long as necessary to protect the integrity of the Platform. When data is no longer required, we delete or anonymise it.

Subject to the conditions in the GDPR, you have the right to:

• access your personal data and obtain a copy;
• rectify inaccurate or incomplete data;
• erase your data (“right to be forgotten”) in certain circumstances;
• restrict or object to processing, including processing based on our legitimate interests;
• data portability for data you provided, where processing is based on consent or contract and carried out by automated means; and
• withdraw any consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, contact us at privacy@verdex.trade. You also have the right to lodge a complaint with a supervisory authority, in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic — www.uoou.cz.

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, hashing of credentials, access controls, and least-privilege handling of secrets. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Platform uses only strictly necessary and functional cookies (such as an authentication session and a language preference). Details are set out in our Cookie Policy.

We may update this Privacy Policy from time to time. We will publish the updated version on the Platform and, where changes are material, notify you. The “Last updated” date above indicates when it was last revised.

For any privacy matter, contact vinireto s.r.o., Školská 660/3, Nové Město, 110 00 Prague 1, Czech Republic, at privacy@verdex.trade or via data box (datová schránka) yczu4tp.