This page explains what personal data VERIPHASE processes and why. We collect only what we need to answer support requests, deliver requested email notifications and, once ordering opens, fulfil orders.
Who we are
The data controller is VERIPHASE, a company in formation being registered in the Netherlands. Its registration number (KvK) and VAT identification number will be published in the imprint upon registration. Privacy contact: privacy@veriphase.eu.
What we collect
For support requests, we store the receipt, name, email, optional organisation, topic, optional product, message, privacy acknowledgement, source page, locale and operational status; raw IP addresses and browser identifiers are not stored with support records. When a non-JavaScript form submission fails validation or cannot be saved, its fields are held behind a random one-time token for no more than 20 minutes so the form can be corrected or recovered without retyping. We also store the email address, notification purpose, consent record and confirmation state for launch or stock alerts and, once ordering opens, the billing, shipping and order-history data needed to fulfil a purchase. Basic technical logs may be processed for site operation, security and abuse prevention.
Lawful basis
Consent (requested email notifications), pre-contractual and contractual necessity (to answer enquiries and perform a sale), legal obligation (e.g. tax and bookkeeping records), and legitimate interests (site security, aggregate service measurement, abuse prevention and operation).
Cookies and aggregate measurement
This site sets strictly necessary cookies for shopping-cart and session functions. We run no advertising or cross-site profiling. When the separately gated analytics service is enabled, Plausible records aggregate page views and named funnel events such as catalogue views, certificate opens and completed purchases. Form contents, email addresses, customer names and order details are not sent as analytics properties; the integration sets no analytics cookies and is disabled in demo environments and for store administrators.
Processors
Hosting is provided within the EU (UpCloud) and email by an EU data centre (Zoho); each processes data on our behalf under a data-processing agreement. The analytics service and hosting region must be approved before its feature gate is enabled. We do not sell personal data.
Your rights
Under the GDPR you may access, rectify, export, restrict or erase your personal data, withdraw notification consent and lodge a complaint with a supervisory authority. Every notification includes an unsubscribe link. Contact privacy@veriphase.eu.
Retention
Resolved and closed support requests are removed 180 days after resolution. Still-open support requests with no update are removed after 365 days. A bounded daily job drains eligible records and their support-scoped audit history. Unconfirmed notification requests expire after 48 hours; notified and unsubscribed lead records are removed under the documented retention job, while active per-product alerts expire after one year. Order and certificate records are retained for the applicable bookkeeping period. Technical logs are kept only as long as needed for security and operations unless required for abuse investigation.