# Privacy Policy

| | |
|---|---|
| Controller | IVERIOS OÜ, registry code 17516618, Tartu mnt 67/1-13b, Kesklinna linnaosa, Tallinn, Harju maakond, Estonia |
| Contact for privacy matters | info@iverios.eu |
| Version | 1.0 — effective 6 November 2026 |
| Classification | Public |

## 1. Who we are

IVERIOS OÜ provides IVERIOS Trust Center and related services. Our services are operated on our behalf by Ostendo Consulting d.o.o., Remetinečka cesta 100/3, Zagreb, Croatia.

We have assessed that we are not required to appoint a Data Protection Officer: we are a small company and our core activities do not consist of large-scale processing of personal data. Privacy questions are handled by our management at info@iverios.eu.

## 2. Our two roles

- **Controller** — for data about our own customers (company administrators, billing contacts), visitors of our website, and people who contact us.
- **Processor** — for personal data that customers publish or collect in their trust centers (e.g. visitors who request access). Here the customer is the controller and we process data only on its instructions, under our Data Processing Agreement.

## 3. Data we process as controller

| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | name, business e-mail, company, role | provide the service, sign-in | contract (Art. 6(1)(b)) |
| Billing data | company name, address, VAT ID, invoices, payments | invoicing, accounting | contract; legal obligation (Art. 6(1)(c)) |
| Communication | e-mails, support requests | support, service notices | contract; legitimate interest (Art. 6(1)(f)) |
| Security logs | IP address, sign-in events, timestamps | security, abuse prevention | legitimate interest (Art. 6(1)(f)) |
| Terms acceptance | who accepted which version, when, IP | proof of agreement | contract; legitimate interest |

We do not use advertising trackers and do not sell personal data.

## 4. Recipients

We use carefully selected sub-processors (hosting, e-mail, AI processing, payments, accounting). The current list is published in our trust center (*Sub-processor list*).

## 5. International transfers

Data is stored in the European Union (Germany). AI processing via Anthropic may involve processing in the United States; such transfers are covered by the EU Standard Contractual Clauses and the provider's data processing terms.

## 6. Retention

- Account and usage data: for the duration of the contract.
- After the service stops: 12 months, then deleted (with prior notice).
- Invoices and accounting records: as required by law.
- Security logs: up to 12 months.

## 7. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a supervisory authority (in Estonia: Andmekaitse Inspektsioon; in Croatia: Agencija za zaštitu osobnih podataka). Contact us at info@iverios.eu; we respond within one month.

## 8. Security

See our Security Overview and Information Security Policy summary in our trust center.

## 9. Changes

We will publish changes to this policy in our trust center and inform customers of material changes.