Home · Legal
Data protection
This statement provides information on the processing of personal data in connection with the use of this website, the VERID app and the services offered through them.
This English text is a translation provided for convenience. VERID is an Austrian business and the legally binding version of this document is the German original. In the event of any discrepancy, the German version prevails.
1. Controller
The controller within the meaning of the General Data Protection Regulation is Markus Angerer, Schillerstraße 2, 8280 Fürstenfeld, Österreich, contactable at hello@verid.at. This privacy policy applies to the website verid.at, to the VERID app for iPhone and iPad and to all services VERID offers through them.
2. Purposes and legal bases of processing
VERID processes personal data in order to provide the website, maintain a customer account, accept orders, produce a compliant passport photo, a Business Portrait or a VERID AI result from the photograph submitted, make the results available, issue invoices and answer enquiries.
The legal basis is performance of the contract including steps taken prior to entering into it (Art. 6(1)(b) DSGVO), compliance with legal obligations, in particular obligations arising from tax and accounting law (Art. 6(1)(c) DSGVO), consent where it has been given (Art. 6(1)(a) DSGVO), together with the legitimate interest in secure, stable operation of the website free from abuse, as well as in an aggregated evaluation of its use (Art. 6(1)(f) DSGVO).
Providing the order, contact and image data is necessary for the conclusion and performance of the contract; without those data an order can neither be accepted nor carried out. There is no statutory obligation to provide them, so any further detail is voluntary.
When the website and its interfaces are called up, the server writes technical access logs in order to detect attacks and abuse, analyse faults and keep the service available. Recorded are the time, the requested address without query parameters and without access or order identifiers, the request method, the status code, the response time, the amount of data transferred and a shortened IP address (for IPv4 without the last group of digits, for IPv6 only the first three blocks). Cookies, sign-in data, images and form contents are not logged. To fend off attacks on the server itself, the firewall and the sign-in service log connection and sign-in attempts with the full IP address. These logs are kept on the server on which VERID runs, are accessible only for technical operation, are neither combined with other data nor used for advertising or to analyse visitor behaviour, and are deleted after 14 days. The legal basis is the legitimate interest in secure and stable operation (Art. 6(1)(f) DSGVO).
3. Categories of recipients
Personal data are passed to recipients of the following categories: hosting and IT operations, payment processing, email dispatch, image processing, AI-assisted answering of text enquiries as well as, where printed products are ordered, printing and shipping service providers.
Providers of AI services: generating ordered business portraits and automatically checking passport photos for headwear, glasses and covered facial features. The providers act as processors for VERID.
There is no transfer to advertising networks or to analytics services. Disclosure to public authorities takes place only in so far as a statutory obligation requires it.
4. Transfers to third countries
Some of our service providers also process data in third countries. Such transfers are based on the European Commission's standard contractual clauses pursuant to Art. 46(2)(c) DSGVO, which form part of these providers' data processing terms.
5. Retention
Personal data are erased as soon as the purpose of their processing ceases to apply and no statutory retention obligation stands in the way. For records relevant under tax law, invoices in particular, a retention period of 7 years applies.
For each order, VERID keeps the finished images and the source photo they were created from, in order to deliver the results, provide them again if they are lost and assess complaints. Other captures from the same process are not used for any other purpose and are subject to the same maximum period. This data is kept for no longer than 24 months from purchase and deleted earlier on request, unless a legal obligation requires otherwise. The legal basis is the performance of the contract and the legitimate interest in resolving complaints (Art. 6(1)(b) and (f) GDPR). A customer account can be deleted at any time; data subject to a statutory retention obligation, or serving the establishment, exercise or defence of legal claims, remain stored until the relevant period expires (Art. 17(3)(b) and Art. 17(3)(e) GDPR).
Location data is removed from the source photo. Transmission is encrypted; access to stored images is limited to authorised persons and is logged.
7. Processing of photographs and facial features
For standard-compliant fitting, the position and proportions of facial and head features are measured and technical quality values of the image are determined. The measurements serve cropping and quality checking; they are stored as numerical values together with the check results in the order's processing record and kept for as long as the order's images, so that support and complaints remain traceable. No biometric template for identification is created or stored, and no comparison between persons takes place.
The technical quality check is a preliminary check, never an automated decision within the meaning of Art. 22 DSGVO; whether a passport photo is accepted rests solely with the relevant authority or accepting body.
The same principles apply to the Business Portrait. VERID AI also processes the requests entered in text form in order to answer them. Images are used for advertising or reference purposes only with separate, express consent.
Business Portrait and automated image check: a business portrait is created with the help of an external AI service. With the consent given at purchase, the same service can also check the passport photo automatically. Only a copy of the photo is transmitted, without name, e-mail address, order number or image metadata. The results are stored like the other images of the order.
Only with separate, voluntary consent does VERID additionally use the source photo and the finished images internally to improve fitting, background removal and checking. For this purpose a copy is stored separately from the order and without name, e-mail address or order number. The purchase is fully possible without this consent. It can be withdrawn at any time with effect for the future; the copies are then deleted. The legal basis is consent (Art. 6(1)(a) GDPR and, insofar as biometric data is concerned, Art. 9(2)(a) GDPR). No disclosure for training third-party AI models takes place.
8. Rights of the data subject
Data subjects have the right of access, to rectification, to erasure, to restriction of processing, to data portability, together with the right to object to processing based on Art. 6(1)(f) DSGVO. Consent once given may be withdrawn at any time with effect for the future; the lawfulness of processing carried out before that withdrawal remains unaffected.
A message to the address named in section 1 suffices to exercise those rights. Without prejudice to other remedies, there is a right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40 to 42, 1030 Vienna.
9. Version of this statement
This privacy statement is amended as soon as the processing described or the legal bases behind it change. The version published on this page at the time of reading applies. Last updated: 03/11/2026.