Privacy Policy
This policy covers the Chrome extension EU Company Verifier and its backend API.
1. What we process
| Data | Where | Why | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| ExtensionPay user id / plan status | Backend (Cloudflare KV) | Verify Free / Pro entitlement | Contract (Art. 6(1)(b)) |
| Lookup query (company name / VAT / register number) and country | Backend, then Apify Actor | Fulfil the lookup | Contract |
| Result (company name, number, status, address, activity, changes) | Backend cache (≤ 7 days) + your device (history ≤ 500) | Speed + CSV export (Pro) | Contract + legitimate interest (caching) |
| IP address (hashed with a salt) | Backend | Abuse prevention (Free-tier reinstall) | Legitimate interest (Art. 6(1)(f)) |
| Your optional KVK API key (NL) | Only on your device (chrome.storage.local); forwarded once per NL lookup and never stored server-side |
Enable Dutch lookups | Consent / Contract |
2. What we do not collect
- Browsing history
- Page content, except when you click “Detect this site’s company” (reads only the active tab, and optionally one same-origin imprint page)
- Director / officer names (stripped; GDPR data minimisation)
- Personal Spanish DNI / NIE numbers (blocked client- and server-side)
- Payment card data (handled solely by ExtensionPay / Stripe)
3. Recipients / processors
- Cloudflare – Worker + KV (EU/EEA preferably).
- Apify – Actor
ifritdmc/eu-company-registry-verify-supplierfor company-register lookups. See Apify legal / DPA. - European Commission VIES – VAT validity check.
- ExtensionPay / Stripe – payments. See ExtensionPay and Stripe’s privacy documentation.
- Handelsregister / KVK / SIRENE / BORME – official public registers (via the Actor).
4. Retention
- Plan cache: 10 minutes
- Result cache: 7 days (empty results: 1 day)
- Monthly quota counters: ~40 days
- Local history: until you clear it or uninstall the extension
- KVK key: until you delete it in Settings
5. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability and objection (Arts. 15–21). Email the controller at ifritalexis@gmail.com. You may lodge a complaint with the Spanish AEPD (aepd.es) or your local supervisory authority.
6. International transfers
Where a processor stores data outside the EEA, we rely on appropriate safeguards (e.g. Standard Contractual Clauses) provided by that processor. Prefer EU/EEA regions when configuring Cloudflare.
7. Children
This product is not directed at persons under 16.
8. Changes
Material changes will be noted on this page and in the Chrome Web Store listing when the extension is published.