Verivexa Privacy Policy

Draft for review — 2 October 2026

1. Who We Are

Verivexa is operated by Jamie Kimberley trading as Verivexa, referred to in this policy as “Verivexa”, “we”, “us” or “our”.

This policy covers our website at verivexa.co.uk, purchases of downloadable products, the online platform at app.verivexa.co.uk, and communications with us.

For privacy enquiries or requests, contact:

support@verivexa.co.uk

2. Our Data Protection Roles

We act as a data controller where we decide why and how personal information is used for our own business purposes. This includes order administration, billing, customer communications, account administration and service security.

When a customer organisation uploads personal information to its platform workspace for its own management system, we generally act as a data processor on that organisation’s behalf.

The customer organisation determines the purposes of that processing and remains responsible for its lawful basis, privacy notices, authorised users and instructions to us.

Processing of customer workspace information is also governed by the applicable customer data processing agreement. This privacy policy does not replace that agreement.

3. Information We Collect

Depending on how you interact with Verivexa, we may process:

• Contact information: names, email addresses, organisation names, addresses and other details supplied to us.

• Order and subscription information: purchased products, order references, payment status, subscription status, renewal and cancellation information.

• Account information: user identifiers, account email addresses, authentication information, organisation membership, roles and preferences.

• Support information: enquiries, correspondence and information supplied when requesting assistance.

• Technical information: IP addresses, browser and device information, service logs and security events.

• Website usage information: page visits and interactions collected through cookies or similar technologies, subject to applicable consent requirements.

• Customer workspace information: information entered or uploaded by an organisation, including policies, documents, evidence, people records, training records, risks, actions, incidents, audits and management reviews.

Payment providers process payment credentials through their systems. Our platform uses payment and subscription information to verify entitlement; it does not require customers to upload payment card details.

4. Where Information Comes From

We receive information:

• Directly from you when you purchase, register, use the platform or contact us.

• From your organisation when it invites you or records information about you in its workspace.

• From Shopify and subscription services in connection with purchases and billing.

• From authentication, email and other service providers supporting delivery of our services.

• Automatically through website and platform operation, including technical logs and permitted cookies.

If someone invites you to an organisation workspace, we may receive your email address and proposed access role before you create an account.

5. Purposes and Lawful Bases

For processing where Verivexa acts as controller, our purposes and lawful bases include:

Purchases and subscriptions

We use order, contact and subscription information to process purchases, supply products, activate access and administer billing.

We rely on performance of a contract where you are personally a party to that contract. Where you represent a customer organisation, we generally rely on our legitimate interests in administering that business relationship.

Account administration and support

We use account and communication information to manage access, respond to enquiries and resolve problems.

Our bases are performance of a contract where applicable, or legitimate interests in delivering and supporting our services.

Security and fraud prevention

We use technical, account and transaction information to protect accounts, investigate misuse, verify access and maintain service security.

We rely on our legitimate interests in protecting customers, our services and our business, and on legal obligations where applicable.

Legal and financial administration

We retain relevant records to meet accounting, tax and other legal requirements, and to establish or defend legal claims.

We rely on legal obligations or legitimate interests, as appropriate.

Marketing and optional website analytics

We use consent where required for marketing communications and non-essential cookies or similar technologies.

Where another lawful basis is permitted, we assess it separately and provide appropriate choices. You can unsubscribe from marketing emails without stopping essential account, order or security messages.

For customer workspace information processed on an organisation’s behalf, the organisation determines the appropriate lawful basis.

6. Customer Workspace Information

Organisations control the information they choose to enter or upload and the users they authorise to access it.

Workspace records may contain personal information about employees, contractors, suppliers or other individuals.

Organisations should upload only information necessary for their management system and ensure they have authority to use it.

Do not upload passwords, private keys or other authentication secrets. Avoid unnecessary sensitive personal information.

If your request concerns information held in your employer’s or another organisation’s workspace, contact that organisation first. We will assist the organisation with relevant requests in accordance with our processing obligations.

7. Service Providers and Information Sharing

We use external providers to operate the website, platform, billing, communications and backups. These include:

• Shopify: online store, checkout and order administration.

• Seal Subscriptions: subscription administration and associated customer communications.

• WeWeb: platform frontend and hosting services.

• Supabase: platform database, authentication and private file storage.

• Resend: transactional email delivery.

• Microsoft 365 and OneDrive: business communications and encrypted backup storage.

Website analytics providers may also process website usage information where those services are enabled and applicable consent has been obtained.

The information available to each provider depends on its service. Listing a provider does not mean that it receives every category of customer information.

We may also disclose information to professional advisers, regulators or authorities where necessary and lawful, or in connection with a business transfer subject to appropriate safeguards.

Authorised users within your organisation may access workspace information according to their permissions.

8. Shopify and Payment Services

Shopify and payment services may process information for their own purposes as well as providing services to Verivexa.

Their privacy notices explain those activities and any rights available directly through them.

You can review Shopify’s privacy information at:

https://www.shopify.com/legal/privacy

This policy does not replace the privacy notices of independent payment or commerce providers.

9. Cookies and Similar Technologies

The website and platform may use cookies or local storage for essential functions such as authentication, security and remembering preferences.

Where non-essential analytics or advertising technologies are used, we obtain consent where required and provide appropriate controls.

Use the website’s cookie preferences to review available choices. Browser settings may provide additional controls, although blocking essential storage can prevent sign-in or other functions from working.

Consent to marketing or optional cookies is separate from accepting our service terms.

10. Where Information Is Processed

The platform’s primary Supabase database and storage project is hosted in Ireland.

Other providers may process information in additional countries. The location of the primary database does not mean all processing, support, email delivery or backups take place there.

Where personal information is transferred internationally, applicable transfer requirements must be met, including appropriate adequacy arrangements or contractual safeguards where required.

Contact us for information about the safeguards applicable to your personal information.

11. Security

We use measures intended to protect personal information, including authenticated access, organisation permissions, private file storage and encrypted backup archives.

Access to customer information is limited to authorised purposes.

No system can guarantee absolute security. Keep account credentials confidential, give users appropriate permissions and remove access when no longer required.

Contact support promptly if you suspect unauthorised access. Do not include passwords or other authentication secrets in your message.

12. Retention

We retain personal information only for as long as necessary for the relevant purpose, taking account of legal obligations, security needs and legitimate requirements to resolve disputes.

Different categories of information have different retention requirements:

• Order and financial records: retained for applicable accounting, tax and legal requirements.

• Account information: retained while needed to administer the account or service, and afterwards where justified by legal or security requirements.

• Support correspondence: retained for as long as reasonably needed to resolve enquiries, maintain relevant support history or address disputes.

• Technical and security logs: retained for periods justified by their operational and security purposes.

Customer workspace records after subscription expiry

Draft provision — implementation and verification pending

The proposed arrangement is to retain customer workspace records for 90 days after the paid subscription period ends, allowing an authorised organisation representative to request their return.

This period does not extend paid platform access.

At the end of that period, workspace records will be deleted from active systems unless the customer renews, a different lawful arrangement is agreed, or retention is required by law.

Earlier return or deletion requests will be handled in accordance with the customer data processing agreement and applicable law.

Backups

Draft provision — backup retention schedule and deletion procedure pending

Encrypted backups may contain copies of information removed from active systems. Backup retention and expiry must follow an established schedule.

Where information awaits removal from a backup, it must be restricted from ordinary use. If a backup is restored, applicable deletions must be reapplied before the restored information returns to normal service.

Deleting workspace records does not necessarily require deletion of separate financial records that must lawfully be retained.

13. Your Rights

Depending on the circumstances and applicable law, you may have rights to:

• Access your personal information.

• Correct inaccurate information.

• Request erasure.

• Restrict processing.

• Object to processing, including certain processing based on legitimate interests.

• Receive or transfer information where the right to portability applies.

• Withdraw consent where processing relies on consent.

These rights are subject to applicable conditions and exceptions. Withdrawal of consent does not affect processing that was lawful before withdrawal.

Contact support@verivexa.co.uk to make a request.

We may need to verify your identity proportionately before disclosing or changing information. We will respond within the applicable legal timeframe.

For information controlled by a customer organisation, we may direct your request to that organisation and assist it in responding.

14. Complaints

Please contact us if you have concerns about how personal information is handled.

You also have the right to complain to the UK Information Commissioner’s Office:

Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

If you are located elsewhere, you may also have the right to contact your local data protection authority.

15. Children

Verivexa’s store and platform are intended for adult business users.

Customer organisations should not upload personal information about children unless necessary, lawful and appropriate for the agreed service.

If you believe a child has supplied information directly to us inappropriately, contact support.

16. Third-Party Links

Our services may link to external websites. Those websites operate under their own privacy notices and security arrangements.

Review their policies before submitting personal information.

17. Changes to This Policy

We may update this policy to reflect changes in our services, providers or legal requirements.

We will update the date and provide additional notice where required.

18. Contact

Jamie Kimberley trading as Verivexa

Email: support@verivexa.co.uk

Please do not send passwords, payment card details or unnecessary sensitive information.