Data protection

1. Controller

The controller within the meaning of the General Data Protection Regulation is Markus Angerer, Schillerstraße 2, 8280 Fürstenfeld, Österreich, contactable at hello@verid.at. This statement applies to the website verid.at and to the services offered by VERID through it.

2. Purposes and legal bases of processing

VERID processes personal data in order to provide the website, maintain a customer account, accept orders, produce a compliant passport photo, a Business Portrait or a VERID AI result from the photograph submitted, make the results available, issue invoices and answer enquiries.

The legal basis is performance of the contract including steps taken prior to entering into it (Art. 6(1)(b) DSGVO), compliance with legal obligations, in particular obligations arising from tax and accounting law (Art. 6(1)(c) DSGVO), consent where it has been given (Art. 6(1)(a) DSGVO), together with the legitimate interest in secure, stable operation of the website free from abuse, as well as in an aggregated evaluation of its use (Art. 6(1)(f) DSGVO).

Providing the order, contact and image data is necessary for the conclusion and performance of the contract; without those data an order can neither be accepted nor carried out. There is no statutory obligation to provide them, so any further detail is voluntary.

3. Categories of recipients

Personal data are passed to recipients of the following categories: hosting and IT operations, payment processing, email dispatch, image processing, AI-assisted answering of text enquiries as well as, where printed products are ordered, printing and shipping service providers.

There is no transfer to advertising networks or to analytics services. Disclosure to public authorities takes place only in so far as a statutory obligation requires it.

4. Transfers to third countries

Personal data are also processed by processors in third countries. Such a transfer rests on standard contractual clauses pursuant to Art. 46(2)(c) DSGVO; a copy of those safeguards is supplied on request.

5. Retention

Personal data are erased as soon as the purpose of their processing ceases to apply and no statutory retention obligation stands in the way. For records relevant under tax law, invoices in particular, a retention period of 7 years applies.

Image files and order data are kept only for as long as is required to make the results available, to honour statutory warranty rights and to complete the order; the periods of availability stated in the ordering process and in the customer account govern. A customer account can be deleted at any time; data subject to a statutory retention obligation, or serving the establishment, exercise or defence of legal claims, remain stored until the relevant period expires (Art. 17(3)(b) and Art. 17(3)(e) DSGVO).

6. Information held on the device

Information is stored on and read from the device in so far as this is strictly necessary for operating the website and for the functions expressly requested, such as signing in, the ordering process and safeguarding the session; no consent is required for this pursuant to § 165(3) TKG 2021. Any storage going beyond that takes place solely after active consent has been given, and it can be withdrawn at any time with effect for the future.

No evaluation of usage behaviour for advertising purposes takes place. VERID sets marketing cookies only with express consent; no active marketing services are embedded at present.

The overview below lists every entry together with its purpose, its kind and its storage period. The legal basis of the strictly necessary entries is performance of the contract or the legitimate interest in secure operation (Art. 6(1)(b) and Art. 6(1)(f) DSGVO), and of any storage going beyond that, consent (Art. 6(1)(a) DSGVO); the information on this is provided pursuant to § 165(3) TKG 2021. The choice made can be changed or reversed at any time immediately below.

7. Processing of photographs and facial features

For compliant fitting, the position and proportions of individual facial features are measured and technical quality values of the image are determined. That measurement serves the crop and the quality check alone, never the unique identification or authentication of a person; special categories of personal data within the meaning of Art. 9 DSGVO are not processed.

The technical quality check is a preliminary check, never an automated decision within the meaning of Art. 22 DSGVO; whether a passport photo is accepted rests solely with the relevant authority or accepting body.

The same principles apply to Business Portrait. VERID AI additionally processes the enquiries entered in text form in order to answer them. Any use of images or entries for training, advertising or reference purposes takes place solely on the basis of separate, voluntary consent that may be withdrawn at any time.

8. Rights of the data subject

Data subjects have the right of access, to rectification, to erasure, to restriction of processing, to data portability, together with the right to object to processing based on Art. 6(1)(f) DSGVO. Consent once given may be withdrawn at any time with effect for the future; the lawfulness of processing carried out before that withdrawal remains unaffected.

A message to the address named in section 1 suffices to exercise those rights. Without prejudice to other remedies, there is a right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40 to 42, 1030 Vienna.

9. Version of this statement

This privacy statement is amended as soon as the processing described or the legal bases behind it change. The version published on this page at the time of reading applies. Last updated: 11/09/2026.