Privacy policy

Who we are

This policy explains how VEYNC ("VEYNC", "we", "us") handles personal data in connection with Veync: the veync.com website, the Veync AI cyber validation platform and the related services we provide. VEYNC is a corporation incorporated in the State of Delaware, USA, with its principal office in Europe at Tour First, 1 Place des Saisons, 92400 Courbevoie — Paris La Défense, France.

For personal data collected through this website, through enquiries and sales conversations, and for the administration of customer accounts, VEYNC is the data controller. Questions about this policy and requests to exercise your rights go to [email protected].

When a customer uses the Veync platform to validate its own environment, any personal data contained in the customer's systems, logs or engagement evidence is processed on the customer's behalf. In that case the customer is the controller and VEYNC acts as its processor under the customer agreement and its data processing addendum (DPA); requests about that data should be directed to the customer.

We have not appointed a Data Protection Officer, as we are not required to. Our privacy team can be reached at [email protected].

Scope of this policy

This policy covers visitors to veync.com, people who contact us or request a briefing, business contacts at our customers, prospects, partners and suppliers, authorized users of the Veync platform, and security researchers who report vulnerabilities to us. It does not cover third-party websites linked from this site, which have their own policies.

Veync is a business-to-business service. We do not offer it to consumers.

Information we collect

Information you give us. When you write to us or use the briefing request form, we receive the details you choose to provide: typically your name, work email address, organisation, role, organisation size, region, the areas of interest you select and your message. The form on this site does not transmit data to a server: it opens a pre-filled email in your own email client, and we receive the enquiry only if you send that email.

Account and contract information. For customers and their authorized users we process business contact details, account credentials and access roles, billing contacts and invoicing records, and the communications that make up the commercial relationship.

Platform usage and security telemetry. When authorized users access the Veync platform we record sign-in events, IP addresses, browser and device information, actions taken in the console and API calls. These audit records are a security control: they show who authorized, started, paused or stopped each engagement.

Engagement evidence. Validation engagements produce evidence such as executed actions, responses from the systems under test and the resulting findings. This evidence can incidentally contain personal data held in the customer's environment. It is processed only within the agreed scope, on the customer's instructions, under the customer agreement and DPA.

Website and server logs. Requests to veync.com pass through our content delivery network and reach our web server, both of which keep technical logs including IP addresses, the pages requested, the time of the request, the referring page and the browser user agent. We use these logs to keep the site available and to detect and investigate abuse. We do not run analytics on this site.

Security research reports. If you report a vulnerability, we keep your report, your contact details and our correspondence with you so that we can verify and fix the issue and, where you agree, credit you for it.

How we use personal data

We use personal data to respond to enquiries and arrange briefings; to provide, secure, maintain and support the Veync platform; to scope, authorize, run and report on validation engagements; to manage accounts, contracts, invoicing and payments; to send service and security notices; to protect our systems, our users and the public against fraud, abuse and unauthorized testing; to improve the platform using aggregated, de-identified usage information; and to comply with legal obligations and enforce our agreements.

We do not sell personal data, we do not use it for targeted advertising, and we do not use customer engagement evidence for any purpose other than delivering the services to that customer.

Legal bases for processing (EEA and UK)

Where the GDPR or the UK GDPR applies, we rely on the following legal bases. Performance of a contract: to provide the platform and services to our customers, and to take steps at your request before entering into a contract. Legitimate interests: to respond to business enquiries, keep our systems and this website secure, prevent misuse and develop our services, where those interests are not overridden by your rights. Consent: where we ask for it, which you can withdraw at any time. Legal obligation: for accounting and tax records and for responding to lawful requests from public authorities.

How we share personal data

We share personal data only with service providers that process it on our behalf under written contracts, listed in the processors table below; with professional advisers such as auditors and lawyers who are bound by confidentiality; with public authorities where we are legally required to, or where it is necessary to protect our rights, our users or the public; and with a successor in the event of a merger, acquisition or sale of assets, under equivalent protections.

Customer engagement evidence is never shared with another customer. Findings in third-party products are handled through coordinated disclosure without exposing the customer's data.

International data transfers

VEYNC is based in the United States, and the servers that host this website and our email are located there. Our content delivery network operates globally. Personal data from the EEA, the UK or Switzerland may therefore be transferred to and processed in the United States and other countries.

For those transfers we rely on the European Commission's Standard Contractual Clauses, with the UK addendum where applicable, or on the EU–U.S. Data Privacy Framework where the recipient is certified, together with supplementary measures such as encryption in transit. You can request a copy of the relevant safeguards from [email protected].

Customer engagement evidence is stored in an EU region by default, or in another region agreed in the customer agreement.

How long we keep it

Enquiries that do not lead to a commercial relationship are deleted within twenty-four months of our last exchange. Enquiries that do become part of the customer record are kept for the duration of the relationship.

Customer account, contract and invoicing records are kept for the term of the agreement and afterwards for as long as accounting and tax law requires. Platform audit logs and engagement evidence are retained and deleted as set out in the customer agreement and DPA.

Web server and content delivery network logs are kept for up to thirty days, unless a specific record is needed for longer to investigate a security incident.

You can ask us to delete your data sooner, and we will unless we are required to retain it.

How we protect personal data

We protect personal data with administrative, technical and physical measures appropriate to the risk, including encryption in transit, access restricted to the people who need it, multi-factor authentication for administrative access, logging and monitoring, and regular testing of our own systems with the same discipline we apply for customers.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify affected customers, individuals and supervisory authorities as the law requires.

Your rights under the GDPR and UK GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to access the personal data we hold about you; to have inaccurate data rectified; to have your data erased; to restrict its processing; to receive it in a portable format; to object to processing based on our legitimate interests; and, where processing is based on consent, to withdraw that consent at any time without affecting earlier processing.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

You also have the right to lodge a complaint with a supervisory authority. Details are given in the complaints section at the end of this policy.

Your rights as a California resident (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what personal information we collect, use and disclose; to request its deletion; to request correction of inaccurate information; to opt out of the sale or sharing of your personal information; to limit the use of sensitive personal information; and not to receive discriminatory treatment for exercising these rights.

In the past twelve months we have collected the categories of personal information described in this policy: identifiers and contact details, professional information, internet and network activity, and the content of your communications with us. We collect them from you, from your organisation and from your use of our services, and we use them for the business purposes described above.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit. You may use an authorized agent to make a request on your behalf; we will ask the agent for proof of authorization. We respond to verifiable requests within 45 days.

How to exercise your rights

To exercise any of these rights, write to [email protected]. We will respond within one month under the GDPR, or within 45 days under the CCPA, and we will tell you if we need to extend that period and why. We do not charge for a request unless it is manifestly unfounded or excessive.

We will ask you to confirm your identity only where we genuinely cannot otherwise establish it, and we will not use that step to delay a request. If your request concerns data we process on behalf of a customer, we will pass it to that customer and help it respond.

Children

Veync is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, write to [email protected] and we will delete it.

Changes to this policy

We may update this policy as our services or legal obligations change. The date at the top of this page shows when it was last updated, and we notify customers of material changes in advance by email or in the platform.

Governing law

This policy, and any non-contractual matter arising from it, is governed by the laws of the State of Delaware, USA, without regard to its conflict-of-laws rules, and the state and federal courts located in Delaware have jurisdiction. This does not limit any mandatory data-protection right you have under the law of your country of residence, including the GDPR and the UK GDPR, or your right to complain to your local supervisory authority.

Contact

VEYNC, Tour First, 1 Place des Saisons, 92400 Courbevoie — Paris La Défense, France. Privacy and data-subject requests: [email protected]. Legal notices: [email protected]. Product and account support: [email protected].