Privacy Policy

Scope

This notice explains how personal data is processed on the Veregis website (veregis.com) and platform, operated by Badex Yazılım ve Dijital Hizmetler Ltd. Şti..

Controller: Badex Yazılım ve Dijital Hizmetler Ltd. Şti., İbn-i Sina Mah. 190003 Nolu Sk., Bahçeli Evler Sitesi J Blok No: 3J, İç Kapı No: 20, Şahinbey / Gaziantep, Türkiye. Registration: Gaziantep Ticaret Sicili No 73558 · MERSİS 0129106382400001.

For personal data inside the product documents our customers upload, we act as a processor; that relationship is governed by a separate data processing agreement.

Data we process

Demo and programme requests: first name, last name, work e-mail, company name, and — if you choose to give them — country, job title, number of products, target market and your message. If you arrived from an advertisement, the campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, fbclid) and the page you landed on.

Contact form: name, e-mail, company and your message.

Platform accounts: name, work e-mail, a hashed password, role, workspace and organisation details, two-factor settings and session records.

Product documents: safety data sheets, labels, certificates, test reports and similar files uploaded by a customer, and the fields extracted from them. These are mostly company data, but they can contain a person's name or contact details.

Usage and security records: an audit log of actions in the platform (who changed what and when), open and download events on share links together with a country code, and hashed IP addresses in server logs for rate limiting.

We do not store your IP address in clear text; public product passport pages keep only a daily view count and a country.

Why we process it

• To answer your demo, programme and contact requests and get back to you
• To provide the service and run your account and workspace
• To give support and resolve problems
• To keep the service secure: prevent abuse, apply rate limits, keep an audit trail
• To meet our legal obligations, such as bookkeeping and record retention
• With your consent, to measure how the website is used and how our advertising performs

Legal basis

Performance of a contract: opening your account and delivering the service (GDPR Art. 6(1)(b), KVKK Art. 5/2-c).

Legitimate interests: replying to your request and keeping the service secure and available (GDPR Art. 6(1)(f), KVKK Art. 5/2-f).

Consent: analytics and advertising cookies and marketing messages (GDPR Art. 6(1)(a), KVKK Art. 5/1). You can withdraw consent at any time; withdrawal does not affect processing that already took place.

Legal obligation: retention and reporting duties under applicable law (GDPR Art. 6(1)(c), KVKK Art. 5/2-ç).

Who we share it with

We do not sell personal data and we do not pass it to third parties for their own advertising. We share it only with the providers that run the service, and with authorities where the law requires it:

• Hosting, database and file storage: a Hostinger International Ltd. server in Frankfurt, Germany (EU)
• E-mail: our own mail server on the same host, Frankfurt, Germany (EU)
• Measurement and advertising (only if you accepted cookies): Google Analytics 4 and Google Ads (Google Ireland Limited), the Meta pixel (Meta Platforms Ireland Limited)
• Document extraction: when this feature is enabled for your organisation, the document is sent to the Anthropic API so that fields can be read; the data is not used to train models (United States)

Where a lawful request is made, we disclose only what the law requires.

Where it is stored

The database and the files are hosted in Germany; data is kept in Frankfurt (EU). Using the measurement and document extraction services named above can involve a transfer outside the EU; such transfers rely on the European Commission's standard contractual clauses and, for Türkiye, on KVKK Art. 9.

How long we keep it

Demo and contact requests: up to 24 months after the request is closed.

Platform accounts and customer data: for as long as the account is open; after the contract ends, data is deleted or returned within the period set in the data processing agreement.

Audit and security records: kept in append-only form for the period the law requires.

When a retention period ends, data is deleted or irreversibly anonymised.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to receive it in a portable format, and to lodge a complaint with a supervisory authority in the country where you live or work.

Under the KVKK (Art. 11) you may ask whether your data is processed and for what purpose, ask for correction or erasure, ask that these steps be notified to third parties, object to a decision produced solely by automated analysis, and claim compensation for damage caused by unlawful processing.

Write to info@veregis.com; we answer within 30 days at the latest.

Cookies

Strictly necessary cookies: the session cookie that keeps you signed in and the cookie that remembers your language. The site does not work without them and they need no consent.

Measurement and advertising cookies: loaded only if you accept them in the cookie bar. Your choice is stored in your browser and can be changed at any time.

You can also delete or block cookies in your browser settings. The details are in our cookie policy.

Contact and changes

Questions and requests: info@veregis.com · +90 342 606 06 11 · İbn-i Sina Mah. 190003 Nolu Sk., Bahçeli Evler Sitesi J Blok No: 3J, İç Kapı No: 20, Şahinbey / Gaziantep, Türkiye.

We update this notice as the service or the law changes; the date at the top shows the last update. Platform users are notified separately about material changes.