Privacy Policy

Account data

Your email address, your password hash, your name, and the company you work for. We store passwords only as a one-way hash and never in a recoverable form.

Verification events

When a consumer scans a code or chip associated with your products, we record the scan event in order to give you a verified record of who engaged, where the scan occurred, and when. This includes a coarse geographic location derived from the scanning IP address, the device family, and the timestamp. We do not collect the IP address of a consumer for any purpose other than this geolocation and abuse prevention, and we do not retain the raw address alongside the event record beyond the retention window set out below.

Product and content data

The products, batches, codes, images, and marketing content you upload to the platform. This is your business data and remains yours.

Technical data

Server logs, including IP address, request path, response status, and user agent, retained for security and operational diagnostics. These logs are not used for marketing.

Plan and subscription status

The plan assigned to your account, your subscription status, and the billing cycle you selected. We do not store card details on our servers. Where a plan is paid for, payment is taken by our payment processor under its own privacy policy, and it passes to us only a masked card reference and the last four digits.

What we do not collect

We do not sell personal data. We do not build advertising profiles. We do not collect special-category data from consumers, and we ask that you not submit it to us. We do not read the content of consumer messages sent to your branded verification pages without your instruction.

• To operate the service. Generating codes and chip identities, processing verification scans, rendering your branded verification pages, and delivering the analytics we present to you.
• To secure the service. Authenticating you, enforcing rate limits, detecting automated abuse and scraping, investigating anomalous access, and maintaining audit records of production access.
• To bill you. Processing subscriptions, issuing invoices, and managing plan entitlements.
• To communicate with you. Transactional messages such as verification, password reset, and security notices, and service announcements where materially relevant to your account.
• To comply with our legal obligations. Where we are required to retain or disclose records.

We rely on contract as the legal basis for processing required to deliver the service, legitimate interests for security, fraud prevention, and service improvement, and consent where we contact you for marketing. You may withdraw consent at any time without affecting the lawfulness of processing already carried out.

We do not share personal data with third parties except in the following circumstances, and never for their own commercial purposes:

• Processors acting for us. The infrastructure and service providers listed below, processing data strictly on our documented instructions.
• At your direction. Verification events are shared with the brand associated with the scanned product, which is the purpose for which they were collected. We do not share consumer data with brands outside the specific verification event.
• Professional advisers. Legal, accounting, and audit advisers, under confidentiality obligations.
• Legal or safety grounds. Where disclosure is required by law, necessary to protect the rights and safety of GeBeCert or others, or required to investigate fraud or abuse.
• Corporate transactions. In a merger, acquisition, or asset sale, subject to the acquirer assuming the obligations in this policy.

We do not sell personal data, and we have never sold or shared personal data for cross-context behavioural advertising.

We host the service on third-party infrastructure and use third-party processors for cloud hosting, email delivery, and IP geolocation. This makes the service deliverable at scale, but it means some personal data is processed outside our sole control. We treat that as an accountable risk rather than a disclaimer, and we describe below exactly what we do about it.

Our commitments to our processors

• Written contractual controls. Every processor handling personal data on our behalf is bound by a data processing agreement that limits them to our documented instructions, restricts onward disclosure, and imposes confidentiality and security obligations no less protective than our own.
• Due diligence before onboarding. We assess a provider’s security posture, certification status, and incident history before their data touches the platform, and we reassess on a periodic cycle.
• Access limitation. Processors receive only the data required for the function they perform. Payment and email providers receive the identifiers they need to deliver their service and nothing beyond it.
• Encryption. Data in transit is encrypted with TLS 1.3 or better, and data at rest is encrypted with AES-256 or equivalent. Encryption keys are held separately from the data they protect.
• Segregated production access. Production access is restricted to named engineers, authenticated with hardware-backed multi-factor authentication, time-bound, and logged. Every production query is recorded.
• Continuous vulnerability management. Dependency scanning, runtime patching, and independent security testing are part of the standard release cycle, not an annual exercise.
• Subprocessor transparency and objection. We maintain a current list of processors below. We give at least 30 days' written notice before a new processor begins handling your personal data, including the processing it will perform. If you object in writing within 15 business days of that notice, on reasonable data-protection grounds, we will either not appoint the new processor or, if that is not possible, allow you to terminate the affected service without penalty and refund any prepaid, unused fees.
• We answer for our processors. We remain fully liable to you for the performance of a processor's data-protection obligations where that processor fails to meet them. You never have to pursue a processor directly to enforce your rights.

Current processors

The authoritative register of subprocessors, with the data each one holds and the country of processing, is published as a standalone page: our subprocessor list. The table below and that page are the same list.

If a processor is compromised

A security incident at a processor is treated as our incident. Where a processor notifies us of unauthorised access to personal data, we do the following, without waiting for the processor to complete its own investigation before acting:

1. Contain. We suspend the affected integration, revoke its credentials, and isolate any access path it had into our environment.
2. Determine scope. We establish what data was accessed, which individuals are affected, and how the exposure occurred.
3. Remediate. We rotate affected credentials and secrets, close the exploited path, and apply any additional hardening the incident reveals is necessary.
4. Notify. We notify you without undue delay, and in any event no later than 72 hours after we become aware of a personal data breach affecting your data. We notify the relevant supervisory authority within the statutory deadline, and we do so on our own initiative rather than waiting for the processor to do it. Our notification to you is not an acknowledgement of fault or liability, but it does not limit any rights you have under these terms or the agreement.
5. Assist. We make available the information you need to meet your own notification obligations to data subjects and supervisory authorities, and we provide reasonable assistance with those notifications. Where a processor is the source, we obtain the underlying detail from them and pass it to you rather than making you chase it.
6. Report. We publish the nature of the incident, the categories of data involved, the likely consequences, and the measures taken, so that you are not left to infer what happened.

Full technical detail is set out on our Security page. In summary:

• All data at rest is encrypted with AES-256.
• All data in transit is encrypted with TLS 1.3.
• Passwords are hashed with bcrypt at a cost factor of 12.
• Production access is restricted, hardware-MFA protected, time-bound, and logged.
• Data is backed up nightly to encrypted, geographically separate storage.
• Dependency vulnerabilities are scanned on every build, and critical findings block release.

No system is perfectly secure. We design to limit the impact of a compromise rather than to assume it cannot happen, and we will disclose incidents that affect your data in accordance with the notification process above.

We maintain a documented incident response plan covering detection, triage, containment, eradication, recovery, and notification. A suspected or confirmed breach of personal data is escalated immediately to the responsible owners, and we notify affected individuals and supervisory authorities within 72 hours of becoming aware of a notifiable incident, as required.

Where an incident originates in a processor’s environment, the notification obligations in this policy apply to us from the point we become aware of it, and are not contingent on the processor’s own investigation or notification.

Please report any suspected vulnerability or unauthorised access to [email protected]. We acknowledge reports within one business day and will keep you informed as the investigation progresses.

GeBeCert is established in Hong Kong. Our infrastructure is operated by a cloud hosting provider whose data centres sit outside Hong Kong, and our email and geolocation processors operate outside Hong Kong as well. That means personal data is processed in one or more other jurisdictions.

Where a transfer of personal data is subject to a restricted-transfer regime, we put in place an appropriate safeguard before the transfer takes place. We rely on the applicable standard contractual clauses where they are available, and on an adequacy decision where the destination is covered by one. Where we cannot satisfy either, we do not transfer the data.

We do not sell personal data, and we have never done so. We do not use personal data for cross-context behavioural advertising, and we have never shared it for that purpose. Verification events recorded against a product are not used to build advertising profiles of consumers.

Subject to the jurisdiction in which you are established, you may:

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete data we no longer have a lawful basis to retain.
• Restrict or object to processing carried out on the basis of legitimate interests.
• Port data to another provider in a structured, machine-readable format.
• Withdraw consent at any time where consent is the basis for processing.
• Complain to your local supervisory authority.

Requests are handled within 30 days and are free of charge. We may ask you to verify your identity before we act. We note that verification event data is shared with the brand whose product was scanned; where you are a consumer rather than a customer, direct your request to that brand, and we will support them in responding.

Where you act as a customer

If you are a brand using the service, we process the personal data in your verification events on your instructions. That means the brand is the controller and we are the processor. We notify you without undue delay if we receive a request that concerns personal data you control and that we process on your instructions, so that you can meet the applicable deadline, and we assist you in responding to it. The full processor terms are in our Data Processing Agreement.

Deletion and confirmation

On termination of the service we make your data available for export for 30 days, after which we delete it from our live systems and from backups on the following rotation, and we delete any remaining derived data. We confirm completion of deletion in writing on request. Data we are required by law to retain is isolated, kept under restricted access, and deleted once the retention obligation expires; the schedule that governs each category is published in Section 07.

Privacy enquiries and rights requests: [email protected].

Security disclosures: [email protected].

We may need to verify your identity before completing a request. If you are not satisfied with our response, you have the right to lodge a complaint with your supervisory authority.