This privacy policy explains which personal data MeritVeri processes, why, on which legal basis, where the data come from, for how long we keep them, and how you can exercise your rights under the General Data Protection Regulation (GDPR).
Who is responsible
The controller of your personal data is the operator of MeritVeri named in the legal notice. For any privacy question or request, write to hello@skengineer.be or use the contact page. We have not appointed a data protection officer, because the law does not require one for our activities; the operator handles privacy requests personally.
Which data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: email address, display name, country, preferred language, password (stored only as a secure hash) | Creating and securing your account, signing in, sending service emails | Contract: our terms of use (Art. 6(1)(b) GDPR) |
| Reviews: rating, text, relationship with the company, optional employment details and date of experience | Moderating and publishing your review | Contract: our terms of use (Art. 6(1)(b)) |
| Private evidence you upload for a review | Checking the relationship you state. Evidence is never published. | Our legitimate interest in reliable reviews (Art. 6(1)(f)) |
| Verification applications and company claims: contact name, job title, business email, phone number, message, documents and case messages | Handling the application or claim of the company you represent | Contract with the company, or steps at its request before a contract (Art. 6(1)(b)); for your own details as its representative, our legitimate interest in handling the company's request (Art. 6(1)(f)) |
| Contact messages: name, email address, subject, message | Answering your message | Our legitimate interest in answering questions (Art. 6(1)(f)) |
| Reports and moderation decisions: reason, explanation, decision and, if you are not signed in, your email address | Handling reports, informing the people concerned and stating our reasons | Legal obligation under the Digital Services Act (Art. 6(1)(c)) and our legitimate interest in a reliable platform (Art. 6(1)(f)) |
| Company listings: name, address, enterprise and VAT number, public contact details, checked facts and financial figures (for sole traders, these can be personal data) | Operating the public business directory, verifications and awards | Our legitimate interest, and that of the public, in reliable information about businesses (Art. 6(1)(f)) |
| Directors and owners of verified companies: see below | Showing who leads and owns a verified company | Legitimate interest (Art. 6(1)(f)), see below |
| Security data: the IP address and browser type (user agent) of your sign-in sessions, a keyed hash of your IP address for abuse signals and rate-limit counters, and IP addresses or ranges blocked because of abuse | Protecting the platform against spam, fraud and abuse | Our legitimate interest in a secure service (Art. 6(1)(f)) |
| Server access logs: shortened IP address, date and time, the page or file requested, browser type (user agent) and the server response | Keeping the website secure and finding technical faults | Our legitimate interest in a secure service (Art. 6(1)(f)) |
| Records of decisions: who decided what and when (audit records, without the content of private documents) | Justifying our decisions and defending legal claims | Our legitimate interest (Art. 6(1)(f)) and legal obligations (Art. 6(1)(c)) |
We do not collect identity documents for reviews, we do not use your data for advertising or profiling, and no decision about you is taken automatically: every verification, award and moderation decision is made by a person. The verification fee is invoiced outside the website; the invoicing details of a company are kept as accounting records for as long as accounting and tax law requires.
Directors, owners and board members
When a company is verified, we check and record the people who lead and own it: the CEO or managing director, the owners and shareholders and the members of the board of directors. This section gives these people the information required by Article 14 GDPR, because the data do not come from them.
- Which data: full name, role, function (for example "Chair"), the year since which the person holds the role, for shareholders their percentage of the shares, whether a shareholder is a natural person or a company, the source and the date of our check.
- Sources: public sources — the Belgian Official Gazette, the Crossroads Bank for Enterprises, the annual accounts filed with the National Bank of Belgium, and the equivalent registers in the Netherlands and Luxembourg — and documents the company submits, such as its share register. Since the judgment of the Court of Justice of the EU of 22 November 2022 (C-37/20), the register of beneficial owners is no longer open to the public; we do not use it as a public source.
- Purpose and legal basis: showing visitors who leads and owns a verified company, so that they can assess who they deal with. This is based on our legitimate interest and that of the public in transparent business information (Art. 6(1)(f) GDPR). We limit the impact on the people concerned: names are not published by default. A manager of the company can publish them in the company dashboard only after confirming that the people listed have been informed. Roles, functions, shareholdings and the fact that the people were verified stay public, without names.
- Small shareholders: shareholders holding less than 5% are never named publicly. Several of them are shown together with their combined share; a single one is shown as "below 5%", never with the exact share.
- Your right to object: if you are listed, you can object at any time (Art. 21 GDPR), for example through the contact page (subject "Correct or remove a company listing"). We then hide the names on all public pages of the company or remove your entry, unless we have compelling legitimate grounds to continue, which we would explain to you.
- Revoked verifications: if a verification is revoked, the people checked in it are no longer shown.
What is public
If you write a review, your display name, your review and the relationship you selected are public. Your email address, your evidence and our internal notes are never published. Company profiles show the information described above; each fact says whether MeritVeri checked it.
How long we keep data
- Account data: as long as your account exists. When your account is deleted, your reviews are removed from public view and your account is anonymised.
- Sign-in sessions (including IP address and browser type): until you sign out, and at most 14 days.
- Server access logs (shortened IP address, date and time, page requested, browser type): deleted automatically after at most 14 days.
- Contact messages: 365 days.
- Abuse and security events: 90 days.
- Rate-limit counters: 2 days.
- Records of processed deletion requests: 30 days.
- Verification applications, company claims, case messages and their documents: kept as records of our decisions while the company is listed, and deleted when they are no longer needed to justify a decision or to defend a legal claim.
- Directors and owners: as long as the company's profile and verification history are kept. What was checked in a verification is stored with that verification record as proof; it is not published while the names are hidden.
- Moderation and audit records: kept only as long as necessary to justify our decisions or to meet legal obligations.
- Backups: an automatic daily backup is kept on our server on a rolling schedule — one per day for 7 days, one per week for 4 weeks and one per month for 3 months — and then deleted automatically. Before updates we also take a snapshot of the server at our hosting provider; we delete it when it is no longer needed, at the latest after 3 months.
Who receives data
We do not sell personal data. We use the following service providers (processors), bound by data processing agreements:
| Provider | Service | Location and safeguards |
|---|---|---|
| Netcup GmbH, Karlsruhe, Germany | Server: website hosting, database, uploaded files and the backups of the platform | Server in a data centre in the European Union. No transfer outside the European Union. |
| BunnyWay d.o.o. (bunny.net), Ljubljana, Slovenia | Delivers static website files such as scripts, styles and fonts (content delivery network). Processes visitors' IP addresses to deliver these files; sets no cookies. | Established in the European Union; delivers the files from servers in Europe. Some of these servers may be in the United Kingdom or Switzerland, for which the European Commission has decided that they protect personal data adequately (adequacy decisions). |
| Email service provider | Sending service emails | Established in the European Union. |
The website, the database, uploaded files and the backups stay on our server in the European Union. We may also disclose data to authorities when the law requires it.
Cookies and local storage
We only use what is strictly necessary for the website to work. There are no analytics, advertising or tracking cookies and no third-party cookies, so we do not show a cookie banner. Our spam protection runs on our own servers and sets no cookies.
| Name | Type and purpose | Duration |
|---|---|---|
| Session cookie (verimerit.session_token, with the prefix __Secure- over HTTPS) | Cookie. Keeps you signed in. Set with security attributes (HttpOnly, Secure, SameSite) that protect it against misuse, including cross-site request forgery. | Until you sign out or the session expires |
| Two-step sign-in cookie (verimerit.two_factor, with the prefix __Secure- over HTTPS) | Cookie. Only for accounts with two-step verification: links the password step to the code step of one sign-in. Same security attributes. | 10 minutes, removed when the sign-in is completed |
| NEXT_LOCALE | Cookie. Remembers the language you chose with the language switcher. | 1 year, only set when you switch language |
| theme | Local storage in your browser (not a cookie). Remembers light or dark mode. | Until you clear it |
| Sidebar state | Local storage in your browser (not a cookie). Remembers whether the dashboard sidebar is collapsed. | Until you clear it |
Your rights
You have the right to access your data, to have them corrected or erased, to restrict their processing, to data portability and to object to processing based on our legitimate interest (Art. 15–21 GDPR). Signed-in users can:
- download their data as a JSON file from the dashboard settings;
- request the deletion of their account from the dashboard settings.
For all other requests, write to hello@skengineer.be or use the contact page. We answer within one month and may ask you to confirm your identity first. Exercising your rights is free.
You also have the right to lodge a complaint with a supervisory authority. In Belgium, this is the Data Protection Authority, Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels (www.dataprotectionauthority.be).
Changes
If we change this policy, we publish the new version on this page with a new date.
Version history
| Version | Date | Changes |
|---|---|---|
| Draft 3 | Service providers: our own server at Netcup in the European Union (website, database, files and backups) and bunny.net for static website files; no more providers in the United States. Name changed to MeritVeri. Server access logs with shortened IP addresses, kept for at most 14 days. | |
| Draft 2 | Legal bases for every processing, publication of directors and owners (hidden by default, right to object), sources, service providers and transfers, retention, your rights and the Data Protection Authority. | |
| Draft 1 | First version. |
Questions about this document?
Contact us