Privacy Policy

1. Who we are

The controller for personal data processed through verachek.com and the Verachek service is Substantia Regulatory, Augsburg, Germany. Contact for data-protection matters: privacy@verachek.com.

2. What we collect

We keep personal data to a minimum. The service processes mainly business data: Safety Data Sheets, substance names, identifiers and concentrations, product names and categories. The personal data we collect are your name, work email address, company, and, for paid plans, billing details handled by our payment provider. We also record technical data needed to run and secure the service (IP address, browser type, timestamps, log events).

3. Why we process it and on what basis

• Delivering the service. running screenings, generating and delivering reports, human review, maintaining your workspace: performance of a contract (Art. 6(1)(b) GDPR).
• Billing and accounts. legal obligation and contract (Art. 6(1)(b) and (c)).
• Regulatory-update notifications you sign up to: consent (Art. 6(1)(a)); you can withdraw at any time.
• Security, abuse prevention and service improvement. our legitimate interests (Art. 6(1)(f)), balanced against yours.

4. Sub-processors

We use a small number of providers to run the service: a website hosting and content delivery provider, a document-processing provider, an automation platform, a database and file-storage provider, a portal/application provider, a payment processor and an email provider. The regulatory updates list on the Resources page is loaded through our own domain from our workflow provider (EU region); your browser sends a standard request, which includes your IP address, and no cookies are set. Each is bound by a data-processing agreement. Where a provider processes data outside the EU/EEA we rely on an adequacy decision or the EU Standard Contractual Clauses. The current sub-processor list is available on request and is attached to our DPA.

5. Retention

SDS files and screening data are retained for the life of your account so that your report history and re-screening work, and are deleted within 30 days of account closure or on request. Free-check submissions are retained for 90 days unless you create an account. Billing records are kept for the period required by tax law. Log data is kept for up to 12 months.

6. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent. Write to privacy@verachek.com. You may also lodge a complaint with a supervisory authority; ours is the Bavarian State Office for Data Protection Supervision (BayLDA).

7. Cookies

The marketing site uses only strictly necessary cookies and privacy-preserving, cookieless analytics. The application uses session cookies required for login. We do not use advertising trackers.

8. Security

Data is encrypted in transit; workspaces are isolated per account; credentials and API keys are held in secure stores; access is limited to the people who need it for review and support. We will notify affected customers and, where required, the supervisory authority of any personal-data breach without undue delay.

9. Changes

We will post changes here and, for material changes, notify account holders by email.