Privacy Policy

1. Who we are

Vertapass Ltd (“Vertapass”, “we”, “us”) is the data controller for data collected through vertapass.com and the Vertapass application. Our registered office is in London, United Kingdom.

2. What we collect

• Account data — email, display name, organisation name, and authentication tokens.
• Assessment data — answers provided during the compliance assessment flow.
• Evidence uploads — documents you attach to requirements (stored separately for each organisation).
• Usage data — page views, session duration, and browser metadata (collected via first-party analytics only).

3. Lawful basis

We process data under the following bases per UK GDPR Article 6:

• Contract performance (Art. 6(1)(b)) — to deliver the Vertapass service.
• Legitimate interest (Art. 6(1)(f)) — for product improvement and security monitoring.
• Consent (Art. 6(1)(a)) — for optional marketing communications.

4. How we store and protect data

Our public website is served through Cloudflare. The Vertapass application is currently closed while we move it to new infrastructure, and we do not currently hold questionnaire, assessment or evidence data. Before the application reopens, this section will set out where that data is hosted and how it is protected. Sign-in records for people who registered previously are held in Firebase Authentication.

5. Data retention

• Account and assessment data: retained while your account is active, deleted within 30 days of account deletion.
• Evidence uploads: retained per your organisation’s retention policy or 7 years, whichever is shorter.
• Audit logs: retained for 2 years for compliance and security purposes.

6. Your rights

Under UK GDPR and EU GDPR you have the right to:

• Access a copy of your personal data (GDPR export from Settings).
• Rectify inaccurate data.
• Erase your data (“right to be forgotten”).
• Restrict or object to processing.
• Data portability.

To exercise any of these rights, use the self-service tools in your account settings or contact privacy@vertapass.com.

7. Sub-processors

We use the following primary sub-processors. Where data residency or processor terms need more detail, please refer to our Data Processing Agreement.

• Cloudflare — website hosting and delivery.
• Dynadot — email hosting for @vertapass.com addresses.
• Firebase (Google) — authentication records for existing accounts.
• Stripe — payment processing (not in use while the application is closed).
• SendGrid — transactional email (not in use while the application is closed).

8. Contact

For privacy-related enquiries, email privacy@vertapass.com.