Privacy notice for project and contract administration

1 Contact and roles

Giulio Focardi, trading as VERION GROUP, Maximilianstraße 2, 80539 Munich, Germany, info@verion.group is the controller for its own contract, communications and account administration. No data protection officer is designated in this notice. Privacy enquiries can be sent directly to that address.

Roles for participant data processed for the customer’s project purpose must be established before processing. Where VERION acts on the customer’s documented instructions, the customer is controller and VERION is processor, requiring a separate Article 28 GDPR agreement with the actual operational annexes. Joint determination of purposes and essential means requires a separate appropriate arrangement. Acceptance of commercial terms does not establish these roles.

2 Data and purposes

Business and contact information, permissions, project descriptions, participant assignments, billing information, price and payment references and necessary security and acceptance records are processed to establish, perform and document contracts. An acceptance receipt records the account and order, time, business representation declaration, document version and its content. It contains no full card details.

Reviews may process answers, role descriptions and derived assessments relating to identifiable people solely for the previously established lawful project purpose. Acknowledging this notice does not authorise marketing, sale of participant data or independent training of general models. Specially protected data is not intended to be entered without an expressly agreed lawful process.

3 Lawful bases and necessary information

Processing necessary for VERION’s own contract with an individual is based on Article 6(1)(b) GDPR. For business representatives who are not personally the contracting party, Article 6(1)(f) ordinarily supports business communication and administration. Statutory bookkeeping and retention duties rely on Article 6(1)(c). Necessary security and legal records serve legitimate interests in secure operation and exercising legal claims under Article 6(1)(f).

The controller establishes the lawful basis for employee and other participant data in light of the actual use, including section 26 of the German Federal Data Protection Act where applicable. The customer is not deemed to consent on behalf of all participants. Without information necessary for administration or analysis, the relevant service may be unavailable or limited.

4 Recipients and technical services

Access is restricted to authorised provider personnel and customer representatives released for the confirmed project purpose. Participants are not promised blanket anonymity. The customer must explain the actual purpose and authorised recipients before participation.

The VERION application runs on a DigitalOcean Droplet located in Frankfurt am Main. This confirmed application location does not establish that all providers, support access, backups and downstream processing remain exclusively in Germany or the EU.

OpenAI is used for AI-supported processing and text generation. Brevo is used for invitation and transactional messages. Only information needed for the relevant processing step should be transmitted. Actual contractual data regions, subprocessors and retention settings require separate documentation; this notice does not promise a specific residency arrangement or zero-day retention.

Stripe provides payment processing and the invoice creation implemented in the system. Lexware is used for bookkeeping and invoice administration; MiracleSync transfers invoices from Stripe to Lexware. Relevant information includes business and billing recipient details, necessary contacts, amounts, tax information and payment and invoice references. Confidential participant answers and individual analytical reports are outside this billing purpose. Stripe may act as an independent controller for certain processing, including its own statutory payment and security duties. Provider roles must be assessed per activity and contractual relationship.

Apollo and FullEnrich are used to find, verify and enrich business contact information for prospecting. Matching may involve names, business roles, companies, domains and public professional profiles and return business contact information. Querying, matching, transferring and enriching personal data are processing activities; these services are not categorically recipients that process no data. Prospecting is separate from analysis of confidential participant answers. Depending on the service and its own databases, a provider may act as processor or independent controller. Actual roles require documentation against the applicable contracts and settings.

The actual contracting entities, data regions, other recipients, relevant provider agreements and transfer safeguards must be fully documented, including in a data processing agreement where required. Confirmation that a service is used does not prove execution of a particular DPA. Third-country transfers must meet Articles 44 onwards GDPR; acknowledging this notice does not replace the necessary safeguards.

5 Retention and deletion

Accounts, project data and contract records are processed only while necessary for their purpose or required by statutory retention rules or valid legal defence needs. Accounting records follow the applicable tax and commercial retention periods. Participant data is deleted or returned under the project’s separately established instructions and periods; this notice does not permit unlimited retention.

The actual deletion, backup and return process must be established against operational practice before processing begins. Statutorily restricted retention must be separated from further analytical use.

6 Rights and complaints

Subject to statutory conditions, people may request access, correction, deletion, restriction and portability and object on grounds of their particular situation to processing based on Article 6(1)(f). Actual consent may be withdrawn prospectively at any time. Requests concerning customer-controlled processing are directed to the relevant controller or handled on its instructions.

People may complain to a competent supervisory authority, particularly where they habitually live, work or where an alleged infringement occurred. The Bavarian State Office for Data Protection Supervision is a possible contact for private-sector controllers in Bavaria. VERION results are intended for human review; decisions based solely on automation with legal or similarly significant effects are outside the agreed purpose.