PRIVACY POLICY
Last updated: 16th of June 2026
This privacy policy explains the nature, scope and purpose of the processing of personal data in the context of our online offering and the associated websites, functions and content (hereinafter collectively referred to as "Vernos"). The privacy policy applies regardless of the domains, systems, platforms and devices (e.g. desktop or mobile) used to access the online service. The terms used, such as "personal data" or their "processing" are to be understood in the sense of the definitions in Art. 4 of the EU General Data Protection Regulation (GDPR). Vernos is a digital loyalty platform operated by Vernos, based in Spain.
- Inventory data e.g. names and addresses of customers
- Contact data e.g. e-mail addresses, telephone numbers, Messenger IDs
- Content files e.g. text input, photographs, videos
- Contractual data e.g. time of conclusion, content, payment information
- Usage data e.g. visited websites, access times
- Meta/communication data (processed anonymously) e.g. device IDs, IP addresses, location data
The term "user" covers all categories of data subjects involved in data processing. These include our business partners, customers, interested parties and other visitors to Vernos. The terms used, such as "user", are to be understood gender-neutrally.
We process users' personal data only in compliance with the relevant data protection regulations. This means personal data will only be processed if you give your consent, if there is a legal basis, or based on our legitimate interest (Art. 6 para. 1 lit. b GDPR). We point out that the legal basis of consent is Art. 6 para. 1 lit. a and Art. 7 GDPR; the legal basis to process data in order to provide our services and enforce contractual measures is Art. 6 para. 1 lit. b GDPR; the legal basis to process data in order to comply with legal obligations is Art. 6 para. 1 lit. c GDPR; and the legal basis to protect our legitimate interests is Art. 6 para. 1 lit. f GDPR.
The servers used by Vernos are operated in compliance with EU laws. Our service provider uses the Fly.io platform to provide hosting services. Only data centers within the EU are used.
We take organizational, contractual and technical security measures in accordance with the state of the art to ensure that processing of personal data is compliant with data protection laws (especially the GDPR) and to protect the data processed by us against accidental or intentional manipulation, loss, destruction or access by unauthorized persons.
We only transfer data in compliance with legal regulations. We only transfer data to third parties if the transfer is necessary to maintain contractual liabilities (Art. 6 para. 1 lit. b GDPR) or based on our legitimate interest (Art. 6 para. 1 lit. f GDPR) to run our business in an efficient and economically justifiable way. If we use subcontractors to provide our services, we will take appropriate legal precautions as well as appropriate technical and organizational measures to ensure the protection of personal data in accordance with the relevant statutory provisions. If content, tools or other means from other providers (hereinafter jointly referred to as "third party providers") are used within the scope of this privacy policy and their registered office is located in a country outside the EU, it must be assumed that a data transfer to that country takes place. Data is transferred to third countries either if there is an appropriate level of data protection, user consent or other legal permission.
We process inventory data (e.g. names and addresses as well as contact data of users) and contract data (e.g. services used, names of contact persons, payment information) for the purpose of fulfilling our contractual obligations and services pursuant to Art. 6 para. 1 lit. b GDPR. Users may create a business account to issue wallet passes using Vernos. During the registration process, the required information will be stated. The user accounts are not public and cannot be indexed by search engines. If you terminate your account, its data will be deleted unless the data must be retained to comply with legal obligations pursuant to Art. 6 para. 1 lit. c GDPR. It is the responsibility of users to secure their data before the end of the contract in the event of termination. We are entitled to irretrievably delete all user data stored during the term of the contract. Within the scope of registration, login and use of our online services, we store the IP address and the time of the respective user action. The processing of this data is based on our legitimate interest as well as the user's protection against misuse and other unauthorized use. This data will not be transferred to third parties unless it is necessary to pursue our claims or there is a legal obligation pursuant to Art. 6 para. 1 lit. c GDPR.
When contacting us (via e-mail or other means), the user's details will be collected in order to process the contact enquiry in accordance with Art. 6 para. 1 lit. b GDPR. The user's details may be stored in our Customer Relationship Management System ("CRM System") or comparable systems.
On the basis of our legitimate interests within the meaning of Art. 6 para. 1 lit. f GDPR, we collect data on each access to the server on which this service is located (so-called server log files). The access data includes the name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referring URL, IP address and the requesting provider. Log file information is stored for security reasons (e.g. to investigate misuse or fraud) for a maximum period of seven days and then deleted. Data whose retention is necessary for evidence purposes is excluded from deletion until the respective incident has been finally resolved.
Cookies are pieces of information that are transferred from our web server or third-party web servers to the user's web browser and stored there for later retrieval. We use "session cookies", which are only stored for the duration of the current visit to our web offering to enable features such as login state. A randomly generated session ID is stored in a session cookie along with information about its origin and storage period. Session cookies are deleted when you finish using Vernos and log out or close your browser. If users do not want cookies stored on their device, they may deactivate the corresponding option in their browser settings.
Based on our legitimate interest (Art. 6 para. 1 lit. f GDPR) we may integrate content or services from third parties, such as payment processors or fonts. This requires that the third-party provider knows your IP address in order to deliver content to your device. We endeavour to use only providers who use IP addresses solely to serve content.
Users have the right, upon request and free of charge, to obtain information about the personal data that we have stored about them, to correct inaccuracies, to restrict processing, to request deletion of their personal data, and, where applicable, to exercise their right to data portability. In the event of unlawful data processing, users may file a complaint with the competent supervisory authority. In Spain, the competent supervisory authority is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es. Users may also contact our data protection contact at any time:
support@vernos.de
The data stored by us will be deleted as soon as it is no longer required for its intended purpose and there are no legal obligations to retain it. If user data is not deleted because it is required for other legally permissible purposes, its processing will be restricted. In accordance with Spanish legal requirements, accounting records are retained for 6 years pursuant to Article 30 of the Código de Comercio, and tax-relevant documents are retained for 4 years pursuant to Article 66 of the Ley General Tributaria.
Users may at any time object to the future processing of their personal data in accordance with statutory provisions. The objection can be made in particular against processing for purposes of direct marketing.
We reserve the right to amend this privacy policy to adapt it to changed legal situations or changes to the service or data processing. If user consent is required or if elements of the privacy policy form part of the contractual relationship with the user, changes will only be made with the user's consent. We ask users to inform themselves regularly about the content of this privacy policy.