Vernex Privacy Notice
Version 1.0 — in force from 18 August 2026
This notice explains how Vernex handles personal data when you visit our website, register as a manufacturing partner, or work with us as a contact person at a partner company.
We deal with businesses, not consumers, so most of what we hold is company information. But the people we work with are people, and this notice is about their data.
It covers vernex.com, partners.vernex.com and the Partner Cabinet. Where we obtained your details from somewhere other than you — for example from your company’s website or a trade directory — this notice is also how we give you the information Article 14 GDPR requires.
1. Who we are
Vernex, Inc.200 Continental Drive, Suite 401
Newark, Delaware 19713
United States
We are the controller of the personal data described in this notice.
Contact for any privacy question, and for exercising the rights in section 8: hello@vernex.com
2. Our representative in the European Union
Because we are established outside the Union and offer services to people in the Union, we have designated a representative under Article 27 GDPR. You may contact either us or our representative on any matter relating to your personal data, including to exercise the rights in section 8.
Veresque Investment GmbHSchlüterstraße 38
10629 Berlin
Germany
dk@vernex.com
3. What data we hold, and where it comes from
If you visit the website. Your IP address, the pages you request, the time of the request, your browser and operating system, and the page that referred you. This is generated automatically by our servers when you load a page.
If you agree to analytics. We use Google Analytics to understand which pages are used and how people find us. If — and only if — you accept analytics on our cookie banner, it records the pages you view, how you arrived, approximate location derived from your IP address, and general device and browser information. We do not use it to identify you, to advertise to you, or to follow you across other websites. You can decline, and you can change your mind at any time. What is stored on your device, and for how long, is set out in our cookie notice.
If you complete the partner registration form. Your name, business email address, job position, telephone number, preferred language, and the company you represent. You give us this directly.
If your company becomes a partner. Contact details and functional role for the people your company nominates — for quoting, sales, quality and logistics — together with the names and certification identifiers of certified inspection personnel where your company’s qualification depends on them. Some of this comes from your company, and certification identifiers may be verified against the issuing body’s public register.
If we approach your company first. Your name, business email address, job position and employer, obtained from your company’s website, from public professional profiles, from trade directories and industry databases, or from an introduction. We tell you where we found you when we first write to you.
If you use the Partner Cabinet. We record when your account signs in and what is submitted or changed through it, including changes to your company’s declarations and the time of each change. This is how we can show what was declared when, and it is described in clause 4.3 of the Partner Platform Terms.
If you correspond with us. The content of your emails, messages and call notes.
We do not knowingly collect special categories of data under Article 9 GDPR, and you should not send them to us.
4. Why we use it, and on what legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Run the website and keep it secure | To serve pages and to detect and stop attacks and abuse | Legitimate interests (Art. 6(1)(f)) — operating and securing our own service |
| Measure how the website is used | To see which pages are read and how people find us, so we can improve them | Your consent (Art. 6(1)(a)), given on the cookie banner and withdrawable at any time |
| Create and operate your partner account | To give you access to the Partner Cabinet under the Partner Platform Terms | Performance of a contract (Art. 6(1)(b)) |
| Screen and qualify your company | To decide whether to work with you, verify certifications, and assess capability | Steps prior to a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) in vetting counterparties |
| Send and process requests for quotation, and place and manage orders | To conduct the supply relationship | Performance of a contract (Art. 6(1)(b)) |
| Contact you about becoming a partner, where we approached you first | To reach the right person at a company we want to work with | Legitimate interests (Art. 6(1)(f)) — business-to-business outreach to a named professional contact |
| Sanctions and compliance screening | Because we have to, and because we would anyway | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Keep records of what was agreed, declared and accepted | To be able to show what was agreed and when | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) for statutory records |
| Establish, exercise or defend legal claims | To protect our position if something goes wrong | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed those interests against your rights. You can object — see section 8 — and we will stop unless we have compelling grounds that override your objection. For outreach, an objection means we stop contacting you, without argument.
5. What we do not do
- We do not sell personal data, and we do not share it for anyone else’s marketing.
- We do not use personal data for advertising or profiling.
- We do not make decisions about your company by automated means. Every registration and every qualification decision is made by a person. There is no automated decision-making producing legal or similarly significant effects within Article 22 GDPR.
- We do not use personal data to train models. Where we use data to improve our platform and calibrate our pricing, we use aggregated or anonymised data from which individuals cannot be identified.
6. Who else sees it
We share personal data only with:
- Service providers who process it for us — such as website hosting (Vercel), email and office applications (Google Workspace), internal messaging (Slack), and the analytics service below. They act on our instructions under a written contract and may not use the data for their own purposes. You may ask us for the current list at hello@vernex.com.
- Google, if you accept analytics. The service is Google Analytics 4, provided to us by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. See our cookie notice, and section 7 below on transfers.
- Our customers, where a specification, delivery or quality matter requires it — normally a name and a business contact detail, and only what the matter requires.
- Certification bodies, where we verify a certification against the issuing body or its public register.
- Professional advisers — lawyers, accountants, auditors — where they need it.
- Authorities, where the law requires it or where we need to establish or defend a legal claim.
7. Where it goes
We are established in the United States, so personal data you give us is held there, and some of our service providers are also outside the European Economic Area. In particular, information collected by Google Analytics may be transferred to Google LLC in the United States.
Where personal data is transferred out of the EEA by us or on our behalf, we rely on the European Commission’s standard contractual clauses, together with the additional technical and organisational measures our assessment of the destination country shows to be necessary. Where the recipient is certified under the EU–US Data Privacy Framework, we rely on that certification instead.
You may ask us for a copy of the safeguards we rely on, at hello@vernex.com.
8. Your rights
You have the right to:
- know what we hold about you and get a copy of it;
- correct it if it is wrong or incomplete;
- have it deleted, where we no longer have a reason to hold it;
- restrict how we use it while a dispute about it is resolved;
- object to our using it on the basis of legitimate interests — including, at any time and without giving reasons, to outreach;
- portability — receive data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible;
- withdraw consent, where we rely on consent, without affecting what we did before you withdrew it.
Write to hello@vernex.com or to our representative in section 2. We answer within one month, and tell you if we need longer.
You may also complain to a supervisory authority — in the Union, the authority where you live, work, or where you think the problem happened.
9. How long we keep it
| Data | How long |
|---|---|
| Website server logs | Up to 30 days |
| Analytics data | As set by our analytics configuration — see the cookie notice at vernex.com/cookies |
| Registrations that do not proceed | 12 months from our decision, then deleted |
| A record that we decided not to work with a company, and why | 3 years from the decision — longer where the reason concerns fraud, safety or a legal claim |
| A record that you asked us not to contact you | Kept indefinitely, and limited to what is needed to honour that request — otherwise we would have no way of knowing not to write to you again |
| Partner account and profile data | For the life of the account |
| Declarations and their change history | For the life of the account and 3 years afterwards (Partner Platform Terms, clause 4.3) |
| Contract, order and invoice records | For the statutory retention periods that apply to them |
| Correspondence | 3 years from the end of the relationship, unless it belongs to a record above |
| Anything needed for a legal claim | Until the claim is resolved and the limitation period has expired |
10. Do you have to give it to us?
No. But we cannot create a partner account, assess your company or place an order without the contact and company data the registration form marks as required. Everything else is optional and you can leave it out.
11. How we protect it
We use access controls, encryption in transit, and logging of changes to partner declarations. Access is limited to the people who need it. No system is perfectly secure, but we will tell you and the relevant authority about a breach where the law requires it.
12. Cookies
Cookies and similar technologies are dealt with in our cookie notice at vernex.com/cookies, together with the consent choices available to you.
13. Changes to this notice
We may update this notice. We publish the version and its date at the top, keep earlier versions available, and tell registered partners by email where a change materially affects them.