In short
- We collect the details you give us on this website and when you use the platform. Our customers add the compliance data.
- For compliance data entered into the platform, the customer companies decide what is collected. We process it on their instructions.
- We do not sell personal data or use it for advertising.
- Data is hosted in the EU by default. We can host it in another region where required.
- You can ask us to access, correct or delete your data at hello@vericona.com.
1. Who we are
VERICONA is a contractor compliance platform operated by Xelentor Technologies Private Limited, a company based in India ("VERICONA", "we", "us"). This policy explains what personal data we handle and why. If you have a question or a complaint, contact us at hello@vericona.com.
2. What this policy covers
This policy applies to:
- This website at vericona.com including the demo request form.
- The VERICONA platform at app.vericona.com used by client companies and contractor companies and their employees.
- The AI assistant and the MCP server that are part of the platform.
- Emails we send in connection with any of these.
It does not cover third-party sites we link to or the internal privacy practices of the client and contractor companies that use the platform.
Our role
For website inquiries and for the account details of platform users (name, email, phone and sign-in records), VERICONA is the data controller.
For compliance content (company profiles, employee records, uploaded documents, assessment answers and ratings), the client company that set the requirements and the contractor company that entered the data are the controllers. VERICONA processes that data on their behalf under our Terms of Service. If you are a contractor employee and want to know why a document was requested, your employer or the client is the right first contact. We will help if you cannot reach them.
Customers are responsible for the notices they give to the people whose data they enter. They are also responsible for having a lawful basis to collect it and for keeping it accurate. We act on their instructions and we are not responsible for instructions or content that break the law.
If you give us personal data about other people, you confirm that you have the right to do so.
3. What data we collect
On this website
When you send a demo request we collect your full name, work email, company name, job title, the range of contractors you manage, your country, any message you write and the page you sent the request from. Only the first three are required. We use this to reply to you and arrange a demo. Requests are stored in a Google Sheet in our Google Workspace account and a notification email goes to our shared inbox.
Our web server keeps standard access logs (IP address, browser type, pages requested and time) for security and troubleshooting. They are deleted after 90 days.
In the platform
The platform records evidence of contractor compliance so most of the data in it is entered by our customers or by contractors at a customer's request.
| Category | Data | Source |
|---|---|---|
| User accounts | First and last name, email, phone, directory identifier and sign-in events | Entered at registration. Sign-in is handled by Microsoft Entra |
| Company profiles | Company name, email, phone, website, registration and VAT numbers, industry, address, logo, contractor type plus ratings and notes given by clients | Entered by the company. Ratings are entered by clients |
| Employee records | First and last name, email, phone, job title, department, profile photo, VERICONA ID, site assignments and individual compliance status | Entered by the contractor company |
| Compliance submissions | Uploaded documents such as insurance certificates, training certificates and licenses, field values such as policy numbers and expiry dates plus assessment answers and scores | Uploaded by contractors and their employees in response to a client's requirements |
| Activity log | Who did what and when: invitations, uploads, assessment results, assignments, reminders and ratings | Generated automatically by the platform |
| Invitations | Invitee name and email, inviting company, site and status | Entered by the inviting user |
Documents may contain more than we ask for. A client decides which documents to require. If a client asks for a document that contains sensitive information such as a medical fitness certificate or a government ID, that information is stored as part of the uploaded file. We do not extract or use it for any purpose other than storing the file and showing it to authorized users. We do not collect dates of birth, national ID numbers, biometric data or precise location as structured fields.
The AI assistant and the MCP server
If you use the AI assistant, we process the questions you type and the platform data needed to answer them. The assistant uses Microsoft Azure AI models hosted on servers in Europe.
Our MCP server lets a customer connect their own AI assistant to their VERICONA account. For example, a client can create requirements and a contractor can upload documents that way. The connected assistant has the same access as the person who connected it. Data that assistant receives is handled by its provider under the customer's own agreement with that provider and not by us. Customers should choose providers accordingly.
4. How we use data and why
Where the UK GDPR or the EU GDPR applies, we rely on the legal bases shown below.
| What we do | Data involved | Legal basis |
|---|---|---|
| Provide the platform: sign you in, show each company the right data, calculate compliance scores, store and serve documents | Account, company, employee and submission data | Contract with the customer |
| Send emails the platform depends on: invitations, automatic expiry reminders and reminders a client sends | Name and email | Contract |
| Reply to demo requests and support inquiries | Demo form data and email content | Steps before entering a contract and legitimate interests |
| Keep the service secure, detect abuse and keep the audit trail | Access logs and the activity log | Legitimate interests |
| Improve the product using aggregated usage information that does not identify individuals | Aggregated usage data | Legitimate interests |
| Contact business contacts who have shown interest in VERICONA | Name, work email and company | Legitimate interests with an easy way to opt out. Consent where the law requires it |
| Keep records where the law requires it | As required | Legal obligation |
Where we act as a processor, the client or contractor company is responsible for having a lawful basis to collect the compliance data they enter.
We do not sell personal data or use it for advertising. We do not use uploaded documents to train machine-learning models.
Automated checks
VERICONA checks each submission automatically against the rules the client has set and calculates a compliance score from the result. These checks do not make decisions about individuals on their own. The client decides who may enter its sites. If you are affected by a decision a client has made using a score, you can ask the client for a review.
5. Who we share data with
Between companies on the platform. This is the purpose of the product. When a contractor accepts a client's invitation, the client can see the contractor's company profile, the employees assigned to the client's sites and the compliance submissions made against the client's requirements. Contractors can see the client's company name, sites and requirements. Companies cannot see each other's unrelated data.
Service providers. We use a small number of providers to run the service. Each is bound by contract to process data only on our instructions.
| Provider | Purpose | Data |
|---|---|---|
| Microsoft (Entra External ID) | Sign-in, password storage and verification, password reset | Name, email, password hash and sign-in events |
| Microsoft (Graph and Microsoft 365) | Sending platform emails | Recipient name and email plus email content |
| DigitalOcean | Hosting the application, database and uploaded files | All platform data |
| Microsoft (Azure AI, servers in Europe) | Answering questions in the AI assistant | The questions you type and the platform data needed to answer them |
| Google (Workspace) | Storing website demo requests and sales notifications | Demo form data |
We do not sell personal data to anyone.
Legal and safety. We may disclose data if a law, a court order or a regulator requires it or to protect the rights, safety or property of VERICONA, our customers or the public. We may also share data with our advisers and subcontractors who need it to help us and where needed to enforce our agreements or prevent fraud and abuse.
Business transfers. If VERICONA is acquired or merges with another company, data may transfer to the new owner under the same commitments as this policy. We will tell customers before that happens.
6. International transfers
The platform is hosted with DigitalOcean in Amsterdam, the Netherlands (EU). The AI assistant uses Microsoft Azure AI models hosted on servers in Europe. We can host a customer's data in another region where required. Please contact us before onboarding to arrange this.
Customer data is stored on servers in the EU. Our team in India can connect to those servers to run and support the service. This counts as a transfer of data to India. Access is limited to named engineers and protected by key-based authentication. Where UK or EU personal data is involved, we use standard contractual clauses or another lawful transfer mechanism.
Microsoft and Google also process data in their global infrastructure.
7. How long we keep data
| Data | Retention |
|---|---|
| Demo requests | 24 months from the last contact, then deleted |
| Platform account and company data | For the life of the customer account, then deleted within 90 days of account closure |
| Uploaded documents and submissions | While the client and contractor relationship is active and for 6 years afterwards, so clients can meet health and safety record-keeping duties, unless the client asks for earlier deletion |
| Activity log | 6 years to support audits |
| Deactivated users and employees | Kept as inactive records so the audit trail stays complete. Personal details are removed on request |
| Web server logs | 90 days |
| Backups | Rolling 30 days. Deleted data leaves backups on that cycle |
We may keep data for longer where we need it to resolve a dispute, enforce our agreements, meet a legal duty or protect legal rights.
8. Security
- All traffic between your browser and VERICONA is encrypted with TLS (HTTPS).
- VERICONA never stores passwords. Sign-in is handled by Microsoft Entra, which enforces the password policy and handles resets. Multi-factor sign-in is supported.
- Every API request carries a signed token tied to one company and every read and write is checked against that company. One customer cannot reach another customer's data.
- Uploaded documents can be downloaded only by a signed-in user of a company entitled to see them. There are no public file links.
- Invitation links expire after 7 days and can be canceled.
- Exports are protected against spreadsheet formula injection.
- Access to production systems is limited to named engineers and protected by key-based authentication.
- The database is backed up daily.
No system is perfectly secure. If we learn of a breach affecting your personal data, we will tell affected customers without undue delay. Where the law requires us to notify an authority, we will do so within the time it sets.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy
- have inaccurate data corrected
- have your data deleted
- restrict or object to how we use it
- withdraw consent where we rely on it
- complain to a supervisory authority
In the UK that authority is the Information Commissioner's Office. In the EU it is your national data protection authority. In India it is the Data Protection Board.
To use a right, email hello@vericona.com from the address on your account. We may ask you to confirm who you are. We reply within 30 days. If your request is about compliance data entered by a client or contractor company, we will work with that company because it controls that data.
We may refuse a request that is manifestly unfounded or excessive. Where the law allows, we may charge a reasonable fee for such a request.
Inside the platform you can already update your profile, your company profile and your employees' details. You can also deactivate users and employees and export contractor, employee and site lists.
10. Regional notices
This section adds detail for visitors and customers in some regions. It applies alongside the rest of this policy.
India
VERICONA is operated by an Indian company so Indian data protection law applies to us. For any question or complaint about how we handle personal data, write to our grievance contact at hello@vericona.com. We reply within 30 days. You can also complain to the Data Protection Board of India.
Australia
If you are in Australia, we handle your personal data with regard to the Australian Privacy Principles. Your data is stored outside Australia in the Netherlands and processed by the service providers listed in section 5, each of which is bound by contract to process data only on our instructions. If a data breach is likely to cause serious harm, we will notify affected customers. Where required, we will also notify the Office of the Australian Information Commissioner. Please raise any complaint with us first. If you are not satisfied, you can complain to that Office.
United States
Residents of some US states, including California, have the right to know what personal data we hold about them and to ask for access to it and for its correction or deletion. We do not sell personal data and we do not share it for advertising. We will not treat you differently for making a request. To make one, email hello@vericona.com from the address on your account. We reply within 30 days.
11. Cookies
This website uses only what it needs to work. Today that is a single browser-storage entry named
vericona-cookie-consent which remembers your cookie choice for 12 months. We do not currently
set any analytics or marketing cookies. If we introduce them, we will use them only if you accept.
If you visit from the EU, the EEA, the UK, Switzerland, Brazil or South Africa, a banner asks you to accept or reject non-essential cookies before any are used. Nothing is pre-selected and Reject is as prominent as Accept. Visitors from other regions do not see the banner. If your browser sends a Global Privacy Control signal, we treat it as a refusal.
You can change your choice at any time with the Cookie settings link in the footer of every page.
The platform at app.vericona.com uses strictly necessary cookies and browser storage to keep you signed in and remember your session. This includes cookies Microsoft sets on the sign-in domain vericona.ciamlogin.com. They cannot be switched off without breaking sign-in. The platform does not use analytics or advertising cookies.
12. Children
VERICONA is a business tool for working adults. We do not knowingly collect data from anyone under 16. If you think a minor's data has been entered, contact us and we will remove it.
13. Changes to this policy
We update this policy when the product or the law changes. The date at the top shows the current version. For material changes we will take reasonable steps to tell customers. For example, we email the main contact of each customer company at least 14 days before they take effect where practical. Continuing to use the service after that date means you accept the update.
14. Contact
Xelentor Technologies Private Limited
A company based in India
hello@vericona.com
EU representative. We have appointed a representative in the EU. To get their contact details email hello@vericona.com.