Compliance

We also perform comprehensive security audits, which is done at least annually.Outputs arising from these audit and certification programs, coupled with our internal process outputs, such as vulnerability management, are all fed into a continuous improvement cycle which helps us keep sharpening the overall security program.

GDPR Compliance

We invest significant strategic resources in maintaining compliance with the GDPR and we also aim to help our customers comply with the processes and policies outlined. Where applicable, we institute appropriate international data transfer mechanisms by executing Standard Contractual Clauses through our updated Data Processing Agreements.

We are wholly invested in our customers' success and the protection of customer data. One way that we deliver on this promise is by helping Verified’s customers and users understand, and where applicable, comply with the General Data Protection Regulation (GDPR). The GDPR is the most significant change to European data privacy legislation in the last 20 years and went into effect on May 25, 2018.

Verified does not store any of its customers data outside the EU/EEA region. The latest EU court ruling has validated Verified’s management decision to move all data processing activities into the EU/EEA region.

In case a customer has a specific need for international data transfer, we can support this need by executing Standard Contractual Clauses and our updated Data Processing Agreement.

We offer data portability and data management tools including:

Profile deletion tool: We help customers respond to user requests to delete personal information, such as names and email addresses, from a Verified account and we also help end users delete their personal information.

Import and export tools: Customers may access, import, and export their Customer Data using Verified’s tools.

We have ensured Verified staff that access and process Verified customer personal data have been trained in handling that data and are bound to maintain the confidentiality and security of that data.

We hold any vendors that handle personal data to the same data management, security, and privacy practices and standards to which we hold ourselves.

We have committed to carrying out data impact assessments and consulting with EU regulators where appropriate.

Privacy

We commit to meeting the highest bar for personal data privacy, and support your organization in meeting data privacy obligations around the world. We appreciate our customers’ concerns about privacy – and we understand that these concerns are probably the same concerns we ourselves have when using SaaS-based applications. So, fundamentally, we try to treat your personally identifiable and other sensitive data the same way we would want our service providers to treat our data.

Verified and its subsidiaries comply with the EU GDPR guidelines for the collection, use, and retention of personal information.

Our approach to privacy is laid out in detail in our Privacy Policy.

Privacy Rights Requests

GDPR provides every individual with the right to seek records about themselves that are maintained within a company or organization. In this section we would like to inform you about your privacy rights under GDPR and how you can exercise them with Verified.

What are your privacy rights?

• The right to be informed – we inform you about how we process your personal information in our Privacy Policy.
• The right of access– this is a right to ask us for a copy of the information that we, as a controller, hold about you, along with certain other information.
• The right to data portability – this is a right to ask us to provide you with a copy of your information you have provided in a structured, commonly used, and machine readable form in certain circumstances.
• The right to rectification – this is a right to change or correct any personal information that you believe we are holding about you that is inaccurate or incomplete.
• The right to erasure (deletion) – this is the right to have your personal information deleted if it is no longer required for the purposes for which it was collected or if other certain conditions apply (commonly called “the right to be forgotten”).
• The right to restrict processing – this is a right to request the restriction or suppression of your personal information in limited circumstances. We do not believe that this right will ordinarily apply to our processing of your personal information.
• The right to object – this is a right to object to the processing of your personal information in certain limited circumstances, such as when we are relying on ‘legitimate interests’ to process your personal information.
• The right to make a complaint to your Data Protection Authority – this is a right to complain to a data protection authority about our use of your Personal Information. For more information, please contact your local data protection authority. Contact details for data protection authorities in the EEA are available here.

When can you exercise your privacy rights?

GDPR makes the distinction between those who act as ‘controllers’ and those who act as ‘processors’ of personal information. Put simply, a controller is the organization who determines how and why your personal information is to be used for certain purposes. A processor is an organization who acts as a service provider and only processes personal information on behalf of the controller under the controller’s instruction.

This is important to highlight, as for most of our services, our clients are the data controller and we are acting as their data processor.

Under the law, it is up to the controller to make sure you can exercise your rights over your personal information. If you have questions about how your personal information is handled by our clients (the business or organization contacting you through the service), you will need to review their privacy notices and, if necessary, contact them directly.

How can you exercise your privacy rights?

You can exercise your privacy rights by using this form.