Zenviq privacy policy
Last updated [DATE]
1 Purpose of this privacy policy
This privacy policy explains how Zenviq collects, uses, stores and otherwise processes personal data when you use our website and services, represent a customer or carrier, or your data is used in a company check. It also sets out your rights and how to exercise them.
Zenviq provides identity verification services for companies and their contact persons, and risk assessment services for customers and carriers. Depending on the scope of the service ordered and provided, we assess contact details, documents, operational, reputational or financial risk data and significant changes to them. [CONFIRM THE SCOPE OF SERVICES ACTUALLY PROVIDED.]
This policy applies to the data of natural persons, including company representatives and self-employed individuals. Information relating solely to a legal person, which is not linked to an identifiable natural person, is not personal data.
2 Who is your data controller
| Data controller | Legal entity code | Address | |
|---|---|---|---|
| Zenviq, UAB | 307902593 | V. Šiugždinio g. 10, LT-47239 Kaunas | operations@zenviq.lt |
For questions about data processing and your rights, you may contact us at the email address above: operations@zenviq.lt
When we determine the purposes and essential means of processing ourselves, we act as the data controller. When we process specific data solely on the documented instructions of a customer, the customer is the data controller and Zenviq acts as a processor under a separate agreement. Our legal bases set out below apply when we act as controller.
3 Purposes and legal bases of data processing
3.1 Account and service administration
We process data for registration, user access, ordering services, credit accounting and service-related notifications.
| Legal basis | Categories of data | Is provision mandatory? |
|---|---|---|
| Entering into and performing a contract where a natural person is a party to it (Article 6(1)(b) GDPR). For company representatives’ data: the legitimate interest in providing and administering services (point (f)). | First name, surname, organisation, position, email and, where necessary, telephone number; user identifier, authentication data, access rights, plan, credit transactions and order history. | Yes. Mandatory fields are marked during registration. Without them, we cannot provide the relevant service. |
3.2 Customer identity and risk assessment
We check the connection between the company and the contact person, signs of possible impersonation and, where the relevant service has been ordered, assess the customer’s financial and credit risk.
| Legal basis | Categories of data | Is provision mandatory? |
|---|---|---|
| Our legitimate interest and that of the ordering customer in detecting impersonation and data discrepancies, assessing trade credit risk and preventing losses (Article 6(1)(f) GDPR). We assess the necessity of processing and the balance of interests. | Representatives’ first names, surnames, positions, work contact details and connections to the company; lawfully available domain data; financial, payment or debt information relating to a natural person; sources, time of the check, discrepancies, risk result and recommendations. | Yes. The person ordering the check provides the necessary data. The person being checked has no general obligation to provide it. Where information is missing, the conclusion may be limited. |
3.3 Carrier identity and risk assessment
We check the carrier, its representatives, and the ownership, validity and reliability of the documents provided; we assess the risks of cooperation and provide recommendations.
| Legal basis | Categories of data | Is provision mandatory? |
|---|---|---|
| The legitimate interest in checking the reliability of the carrier and documents, detecting impersonation and reducing transport risk (Article 6(1)(f) GDPR). Contract (point (b)): where a natural person is a party to the service contract and processing is necessary for its performance. | First names, surnames, positions and contact details of representatives and persons submitting documents; necessary licence, insurance and vehicle data relating to a person; verification responses, cooperation history, substantiated risk indicators and the assessment result. | Yes. Necessary for the specific check ordered. If the required data is not provided, some information may remain unverified. |
3.4 Profile maintenance and change monitoring
Where such a service is provided and ordered, we update check information, monitor document validity and significant changes, and send notifications to authorised recipients.
| Legal basis | Categories of data | Is provision mandatory? |
|---|---|---|
| The legitimate interest in keeping partner check information up to date and identifying risks in good time (Article 6(1)(f) GDPR). A contract with a natural person (point (b)), where applicable to the service they have ordered. | Necessary profile and representative data, document validity, check and change history, previous and new values, notification recipients and preferences. | Yes. Necessary for the monitoring or profile ordered. [CONFIRM WHO CAN VIEW THE PROFILE AND TO WHAT EXTENT.] |
Only necessary data should be submitted for a check; unrelated information in documents must be redacted. For standard checks, we do not request health, biometric or other special categories of data. Data relating to natural persons’ criminal convictions and offences is subject to the separate conditions of Article 10 GDPR. The purpose of fraud prevention alone does not replace those conditions.
We mark suspicions and unverified reports as unconfirmed information. We distinguish possible impersonation of a legitimate company from the company’s own actions. Upon receiving substantiated information about an inaccuracy, we check the data and correct it where necessary.
3.5 Payments and debt management
We administer payments for Zenviq services, issue invoices and address cases of non-payment.
| Legal basis | Categories of data | Is provision mandatory |
|---|---|---|
| Contract, where applicable (Article 6(1)(b) GDPR); legal accounting obligations (point (c)); the legitimate interest in obtaining payment and defending claims (point (f)). | Invoice recipient and representative data, invoices, payment transactions, bank account, payment status, services and correspondence. [CONFIRM THE DATA PROVIDED BY THE PAYMENT PROVIDER.] | Mandatory accounting data is necessary to administer invoicing and payments. |
3.6 Enquiries and compliance with legal obligations
We handle enquiries, requests and complaints, comply with legal obligations and establish, exercise or defend legal claims.
| Legal basis | Categories of data | Is provision mandatory |
|---|---|---|
| The legitimate interest in responding and defending rights (Article 6(1)(f) GDPR); legal obligation, including the fulfilment of data subject rights (point (c)). | Contact details, the content of the enquiry, necessary attachments, replies, correspondence, contractual and dispute documents; proportionate identity verification information where necessary. | Provision is not mandatory, but without sufficient information we may be unable to handle the enquiry. |
3.7 Security and service operation
We ensure the operation of the website and platform, protect accounts, detect unlawful access and investigate disruptions. Where possible, we use anonymous data for improvements.
| Legal basis | Categories of data | Is provision mandatory |
|---|---|---|
| The legitimate interest in ensuring security and proper operation (Article 6(1)(f) GDPR). Non-essential tracking technologies are covered by section 9. | IP address, device and browser data, login time, sessions, access and activity logs, error and security records. | Necessary technical data is collected when you use the service. Secure operation may be impossible without it. |
3.8 Marketing and social networks
We provide information about services and communicate through social network accounts. Service notifications are kept separate from advertising.
| Legal basis | Categories of data | Is provision mandatory |
|---|---|---|
| Consent (Article 6(1)(a) GDPR); an assessed legitimate interest (point (f)), where appropriate. Electronic marketing is additionally subject to Article 81 of the Law on Electronic Communications and the rules of the recipient’s country. | Contact details, organisation, communication preferences, evidence of consent and opt-outs; social network messages, comments and reactions. [SPECIFY THE NETWORKS USED.] | No. Opting out does not affect the core service. Every marketing message provides a free opt-out option. |
Electronic marketing to natural persons is carried out with consent or in accordance with the applicable existing-customer exception. Where the subscriber to communications services or the registered recipient is a legal person, we apply the conditions of Article 81 of the Law on Electronic Communications, including the option to opt out. This does not remove the GDPR requirements applicable to employee data. If we receive an objection to direct marketing, we cease the relevant processing. Social network providers also process data under their own policies. [IF APPLICABLE, PROVIDE JOINT CONTROLLERSHIP INFORMATION FOR ACCOUNT STATISTICS.]
4 How long we retain data
We retain data for no longer than necessary for the specific purpose and to meet legal requirements.
| Data group | Retention period or criterion |
|---|---|
| Account and user data | While the account is active; after closure: [PERIOD AND PURPOSE]. |
| Check and assessment reports | [PERIOD FROM THE CHECK]; according to the need for check history, relevance and substantiated evidence. |
| Documents and extracts | Original documents: [PERIOD]; extracts: [PERIOD]. |
| Profiles and monitoring data | While the service is provided; after it ends: [PERIOD]. Relevance is reviewed [FREQUENCY]. |
| Accounting documents | For the period prescribed by law for the document type: [APPLICABLE PERIODS]. |
| Enquiries and complaints | [PERIOD FROM COMPLETION OF HANDLING]. |
| Technical and security logs | Routine logs: [PERIOD]; incident evidence: [PERIOD OR CRITERION]. |
| Marketing and opt-outs | Until withdrawal, objection or [RELEVANCE PERIOD]. Minimal evidence of opt-out: for as long as necessary to comply with it. |
| Evidence for legal claims | During the limitation and procedural periods applicable to the specific claim, with justification for the necessary scope of data. |
At the end of the retention period, data is deleted or irreversibly anonymised. Backups are overwritten within [CYCLE]; until then, access is restricted to recovery and security purposes. Following restoration of backups, current deletion and restriction decisions are applied.
5 Where we obtain data
| Data source | Purpose of use |
|---|---|
| You or the organisation you represent | Account, ordering services, contact details, documents and communication. |
| The customer ordering the check | Customer or carrier check; necessary contact details, documents and lawfully provided cooperation or payment history. |
| Official registers and public professional sources | Cross-checking company, representative and operational information; official websites, domain and technical sources. [CONFIRM THE SOURCES USED.] |
| Document and transport data providers | Checking licences, insurance, vehicles and reputation. [REGISTERS, INSURERS, BROKERS AND FREIGHT EXCHANGES ACTUALLY USED.] |
| Financial and creditworthiness data providers | Assessment of customers’ financial and credit risk. [PROVIDERS ACTUALLY USED.] |
| Authorities and social networks | Lawfully provided information, compliance with legal obligations and communication. |
The public availability of data does not in itself confer an unrestricted right to process it. Where we obtain data from someone other than you, we provide the information required by Article 14 GDPR, including the categories, source and whether that source is publicly accessible, no later than within one month or, where applicable, at the time of first contact or disclosure. We rely on an exception only after assessing its legal conditions; publication of this policy alone does not replace the obligation to provide information individually.
6 To whom we disclose data
| Recipient category | Purpose and scope of disclosure |
|---|---|
| The customer ordering the check and its authorised users | The report, data necessary to understand it and ordered change notifications, in accordance with the access rights granted. |
| Other recipients of the profile or result | [CONFIRM WHETHER DATA IS AVAILABLE TO OTHER CUSTOMERS; IF SO, SPECIFY THE SCOPE, RECIPIENTS AND BASIS.] |
| IT and document processing service providers | Hosting, cloud services, communications, maintenance, document scanning and, where applicable, AI processing. [SPECIFY RECIPIENTS OR A LINK TO THE CURRENT LIST.] |
| Check and administration service providers | Enquiry data necessary for the check; payment, accounting and document administration. |
| Advisers and competent authorities | Legal, audit or other professional services, legal obligations and defence of claims. |
| Business successors and their advisers | Only the scope reasonably necessary for a business transfer, ensuring confidentiality and restricted access. |
We enter into the necessary agreements with processors acting on our instructions. Membership of the same group of companies does not in itself confer a right to receive data. Where data is transferred or made remotely accessible outside the EEA, we apply the conditions of Chapter V GDPR: an adequacy decision or appropriate safeguards and, where necessary, supplementary measures. [SPECIFY COUNTRIES, RECIPIENTS AND THE TRANSFER MECHANISM; OR CONFIRM THAT THERE ARE NO TRANSFERS.] Information about safeguards or a copy of them may be obtained using the contact details in section 2, while protecting other persons’ information and confidential information.
7 Your rights
| Right | Summary |
|---|---|
| Access | Obtain confirmation of processing, information and a copy of your data. |
| Rectification | Request correction of inaccurate data or completion of incomplete data. |
| Erasure | Request deletion of data in the circumstances provided by law; this right is not absolute. |
| Restriction of processing | Request restriction of processing in the circumstances set out in the GDPR, including while the accuracy of contested data is being checked. |
| Data portability | Receive the data you have provided or have it transferred to another controller where processing is automated and based on contract or consent. |
| Object | Object, on grounds relating to your situation, to processing based on legitimate interests, including profiling. For direct marketing: at any time, without giving a reason. |
| Withdraw consent | Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. |
| Contest an automated decision | Where Article 22 GDPR applies, exercise the applicable safeguards, including human intervention, expressing your point of view and contesting the decision. |
| Lodge a complaint | Contact the State Data Protection Inspectorate (VDAI) (https://vdai.lrv.lt) or the supervisory authority of the EU Member State of your habitual residence, place of work or place of the alleged infringement. |
Submit requests to [PRIVACY EMAIL]. Where there are reasonable doubts about identity, we request only proportionate additional information. We respond without undue delay and no later than within one month. Where necessary, this period may be extended by a further two months; we inform you of this and the reasons within the first month. Where we act only as a processor, we assist the customer in fulfilling the request. You do not need to contact Zenviq first in order to lodge a complaint with a supervisory authority.
8 Automated assessment and profiling
Zenviq may automatically cross-check data, identify discrepancies and provide a risk level, score or recommendation. The factors depend on the service: consistency between the company and contact details, document validity, operational, cooperation or payment history. The assessment reflects the data available at the time of the check and may change. Missing information may result in a conclusion that there is insufficient data.
Assessment of a legal person does not in itself constitute profiling of a natural person. If a natural person’s reliability or behaviour is assessed automatically, profiling rules may apply. You may request verification of data relating to you and an explanation of the assessment factors. The advisory nature of the result does not remove Zenviq’s applicable data protection obligations.
[CONFIRM THE ACTUAL AUTOMATION MODEL: THE UNDERLYING LOGIC AND THE INFLUENCE OF FACTORS, THE SIGNIFICANCE OF THE RESULT AND CONSEQUENCES FOR THE NATURAL PERSON, HUMAN REVIEW AND THE PROCEDURE FOR MAKING A REQUEST. IF ARTICLE 22 GDPR APPLIES, SPECIFY THE PARTICULAR PERMITTED EXCEPTION AND SAFEGUARDS.]
[IF AI PROVIDERS ARE USED, CLARIFY THE PURPOSE, RECIPIENTS, SCOPE OF DATA, RETENTION AND ACTUAL CONDITIONS FOR THE USE OF DATA TO TRAIN MODELS.]
9 Cookies and similar technologies
Essential cookies and similar technologies are used where required for the service you have requested, for example login and a secure session. We activate non-essential analytics, advertising or other tracking technologies only after obtaining prior consent. Refusing must be as easy as consenting. You can change your choices and withdraw consent through [COOKIE SETTINGS LINK].
| Purpose | Cookie | Category | Provider | Duration |
|---|---|---|---|---|
| [LOGIN OR OTHER ESSENTIAL FUNCTION] | [EXACT NAME] | Essential | [PROVIDER] | [DURATION] |
| [IF TRAFFIC ANALYSIS IS USED] | [NAME] | Analytics | [PROVIDER] | [DURATION] |
| [IF ADVERTISING MEASUREMENT IS USED] | [NAME] | Marketing | [PROVIDER] | [DURATION] |
[COMPLETE BASED ON THE COOKIES AND OTHER TRACKING TECHNOLOGIES ACTUALLY USED; REMOVE UNUSED ROWS.]
10 Changes to this policy
We update this policy when services, data processing or legal requirements change. We publish the current version and its date at [WEBSITE ADDRESS]. We notify you of significant changes in an appropriate manner. Where new processing requires consent, we obtain it before starting the processing. Use of the service does not in itself constitute consent to all data processing purposes.