Who we are

secuveri GmbH ("secuveri", "we"), Baarerstrasse 135, 6300 Zug, Switzerland, UID CHE-216.700.481, provides identity verification services to businesses. Privacy contact: privacy@secuveri.com. This policy explains how we process personal data:

• when you complete an identity verification for one of our business customers;
• when you use our dashboard or API as a business customer;
• when you visit secuveri.com or contact us.

We comply with the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

Identity verifications

When an organisation asks you to verify your identity with secuveri, the organisation is the controller and secuveri processes your data on its behalf. What we process (including biometric data), why, for how long, and your rights are explained in our Verification Privacy Notice. The End User Terms apply to the verification itself.

In short: verification data stays in Switzerland, is used for the verification, fraud prevention and security, and is deleted automatically after the period the organisation sets. In pseudonymised form, it may be used to improve our fraud-detection models (not face recognition), which you can object to. It is never sold.

Business customers (dashboard and API)

For people who use our dashboard or API, we process:

• account data (name, business email, organisation, role);
• login and security data (password hash, two-factor settings, IP address, logs);
• billing and contract data;
• communications with us.

We use this to provide and secure the service, manage the contract, and contact you about it, based on the contract with your organisation and our legitimate interest in running a secure service.

Account emails, such as sign-in links and invitations, are sent through an email delivery provider in the USA under standard contractual clauses. These emails contain your name and email address, never verification data.

We keep account data for the duration of the contract and afterwards as required by Swiss law, for example 10 years for accounting records.

Website: who receives information

For our website, we share personal information only where necessary, with:

• service providers that help us run the website, listed on our Subprocessors page;
• professional advisers, such as auditors and legal counsel;
• authorities, where required by applicable law.

Contacting us

When you use the contact form on our website, we collect your name, email address, company, and optionally your phone number, industry and message. We use this only to answer your inquiry and, if you wish, to discuss working together.

Your inquiry is delivered to our team by email. You receive a confirmation email; it does not repeat your message.

Together with your inquiry, we note how you found our website, such as the referring website, the first page you visited or the ad campaign link you followed. We use this only to understand which channels lead to inquiries.

To protect the form from spam, Cloudflare Turnstile checks whether the request comes from a person. This processes technical information such as your IP address and browser characteristics.

Applying for a job

When you apply through our careers page, we collect your name, email address, optionally your phone number and a link to your profile, your message and your CV. We use this only to assess your application and contact you about it.

Your application is delivered to our team by email; the CV is attached to that email and not stored on our website. We delete applications once the process is over, unless you agree that we keep them for future roles.

Cookies and analytics

We only use analytics and advertising cookies if you accept cookies in the banner on our website. If you decline, none of these cookies are set and no usage data is collected.

If you accept, we use PostHog (PostHog Inc., with data hosted in the European Union) to understand how our website is used, such as which pages are visited and which features are used. PostHog sets a cookie to recognise repeat visits. What you enter in our contact form is never sent to PostHog.

If you accept, we also use Leadfeeder (provided by Dealfront, with data hosted in the European Union) to identify which company a visit comes from, based on the IP address of the network you use. This tells us which organisations are interested in our services; we do not use it to identify you as a person.

If you accept, we also use the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) to measure whether our ads on LinkedIn lead to inquiries and to show our ads on LinkedIn to people who have visited our website. LinkedIn may link this to your LinkedIn account if you have one.

If you accept, we also use the Google Ads tag (Google Ireland Limited), the Microsoft Advertising tag (Microsoft Ireland Operations Limited) and the Meta Pixel (Meta Platforms Ireland Limited) to measure whether our ads on Google, Bing, Facebook and Instagram lead to inquiries, and to show our ads to people who have visited our website. These providers may link this to your account with them if you have one.

With your consent, we may also record anonymised sessions (mouse movements, clicks and scrolling) to improve the website. Anything you type into forms is masked and never recorded.

You can change or withdraw your choice at any time via "Cookie settings" in the footer of our website.

Booking a call

When you book a call with us, we collect your name, email address and any notes you add, and use them only to schedule and hold the meeting.

Bookings are handled by our own self-hosted instance of Cal.com at cal.secuveri.com. Cal.com is open-source software licensed under the GNU AGPLv3; the source code of our modifications is published at github.com/secuveri/calcom.

Data security

We use technical and organisational measures designed to protect personal information against unauthorised access, loss and misuse.

A high-level overview of our approach is available on our Security page.

Data retention

We keep personal information only for as long as it is needed for the purposes described in this policy, or as required by law. Inquiries and booking details are deleted once they are no longer needed to respond to you or follow up, and analytics data is deleted automatically after a limited period.

Retention for verification data is set out in the Verification Privacy Notice.

International transfers

Verification data stays in Switzerland. Where other data is transferred to a country without adequate data protection, such as the USA, we rely on the Swiss-US and EU-US Data Privacy Framework or on standard contractual clauses. The providers for our website are listed on our Subprocessors page.

Your rights

Subject to the law, you can ask to:

• access your data and receive information about how it is processed;
• correct inaccurate data;
• delete your data, or restrict its processing;
• object to processing;
• receive your data in a portable format;
• withdraw consent;
• have an automated decision about a verification reviewed by a person (see the Verification Privacy Notice).

For verifications, contact the organisation first; we will support it. You can also write to privacy@secuveri.com. We may need to confirm your identity before acting on a request.

You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, in the EU, to your local data protection authority.

Children

Our website and dashboard are not intended for children. For verifications, see the Verification Privacy Notice.

Changes to this policy

We may update this policy. The current version is always published on this page, with the date of the last change at the top. We will inform business customers of material changes in advance.