Key Points Summary (Non-Binding)
Important: This summary is for convenience only. It does not replace the full Privacy Policy below.
Who we are
Veriscope AB is a Swedish company. We operate the Veriscope Lens app, the Heatmap/Marketplace, and related tools and services. Unless we state otherwise, Veriscope AB is the data controller for the personal data processing described in this policy.
What data we collect
We may collect:
- account and contact details (such as name, email address, organisation and role);
- account settings and profile information;
- Footage and associated metadata (including timestamps, device information and optional location data where enabled);
- transaction, licensing, payment and payout records;
- usage, device and log data (such as IP address, device identifiers, browser/app information and activity logs);
- communications data, including support requests and feedback; and
- for end-to-end encrypted messaging, limited metadata such as sender and recipient identifiers, timestamps and routing information.
Why we process personal data
We process personal data to:
- provide and operate the Platform and Services;
- support Veriscope’s own marketing
- enable upload, review, licensing and distribution of Footage;
- process payments, payouts and accounting;
- maintain security, prevent fraud and enforce our terms;
- provide support and service communications;
- improve and develop the Platform; and
- comply with legal and regulatory obligations.
We do not sell personal data collected through those technologies to third parties.
Blockchain and decentralised storage
Some records or references relating to Footage and transactions may be stored or referenced on Blockchain or Decentralised Storage networks. We aim to avoid storing plain personal data directly on-chain and instead use hashing, pseudonymisation and off-chain storage wherever reasonably possible. Because such systems may be immutable and distributed, full erasure or modification may not always be technically possible.
End-to-end encrypted messaging
Some messaging features may use end-to-end encryption (E2EE). Where that is the case:
- Veriscope generally does not have the keys needed to decrypt message content;
- we cannot routinely read the content of E2EE messages;
- we may still process limited messaging metadata to operate and secure the service; and
- we rely on user reports, metadata and other available information to investigate abuse.
Children and young users
Accounts are for 13+ only. We do not knowingly allow children under 13 to create Accounts. Users aged 13 to 17 may use the Platform only in accordance with our Terms & Conditions and, where required by law, with parental or guardian consent.
Your rights
You have rights under GDPR, including rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where consent is used. For details, see the full Privacy Policy below.
1. Introduction and scope
1.1 Who we are
This privacy policy explains how Veriscope AB (“Veriscope”, “we”, “us” or “our”) collects, uses, shares and protects personal data in connection with our services.
Veriscope AB is a company established in Sweden and operating within the European Union. We provide:
- a web-based marketplace where media companies and other professional organisations can review and purchase licences to use newsworthy and reliable footage; and
- a mobile application (Veriscope Lens) and related tools that allow individuals and professionals around the world to capture, upload and manage such footage.
Together, our websites, marketplace, mobile app, and related tools and services are referred to in this policy as the Platform or the Services. We work with Contributors and Clients around the world, including in the EU/EEA, United Kingdom, United States, MENA region, Africa and other regions.
Unless we say otherwise, Veriscope AB is the data controller for the processing of personal data described in this privacy policy. This means that we decide why and how personal data is processed for these purposes.
Parts of our infrastructure are built on blockchain and decentralised storage technologies (such as IPFS). This means that certain information related to Footage and associated transactions may be recorded on, or distributed via, decentralised networks operated by multiple independent nodes. Sections 3, 7, 9 and 12 below explain in more detail how this affects our processing of personal data and, in particular, the practical limits on deletion and rectification of data that has been stored on such networks.
Our professional clients (such as media organisations and other buyers) will usually act as independent data controllers for their own downstream use of any licensed footage and related information. In some cases, depending on the specific arrangements, Veriscope and a client may act as independent or joint controllers, but this will be clarified in the relevant contractual documentation where appropriate.
1.2 Who this policy applies to
This privacy policy applies to the processing of personal data relating to:
- Contributors – individuals who use the Veriscope App or Platform to capture, upload and manage footage, and who may receive payments or other benefits related to such content.
- Clients – professional customers such as media companies, news organisations, agencies, and other buyers who use our Platform to browse, license and download footage.
- Registered users and account holders – any individual who creates an account on the Platform, whether as a contributor, client representative, or in another capacity.
- Website and app visitors – individuals who visit our website or use our app without creating an account, including those who receive marketing communications.
- Individuals appearing in footage or related content – to the extent that Veriscope processes their personal data in connection with upload, storage, review, moderation, licensing and distribution of footage.
- Other individuals – such as people who contact us with enquiries, job applicants, and representatives of suppliers or other partners.
This policy applies regardless of where you are located, but it is particularly designed to meet the requirements of EU and Swedish data protection law, including the EU General Data Protection Regulation (GDPR).
Our Services are not directed at children under 13 and we do not knowingly collect personal data from them (see section 11 below).
1.3 Roles and relationships
Veriscope’s role may vary depending on the processing activity.
1.3.1 Veriscope as controller
Veriscope generally acts as an independent controller for processing relating to:
- user accounts and profiles;
- operation of the Platform and messaging features;
- hosting, indexing and presentation of Footage;
- search, analytics, logs and security monitoring;
- payments, payouts and accounting;
- customer support, communications and service administration; and
- legal, compliance and enforcement activities.
1.3.2 Contributors and Clients as independent controllers
Contributors and Clients typically act as independent controllers for their own downstream use of Footage and related personal data, for example in:
- broadcasts, publications and articles;
- internal review or archiving;
- documentary, editorial or commercial uses; and
- rights management or compliance processes carried out in their own organisations.
1.3.3 Processor arrangements in limited cases
In some cases, depending on the specific arrangements, Veriscope and a Client may act as independent or joint controllers, or Veriscope may process personal data on documented instructions from a Client as a processor under a separate agreement. Where relevant, this will be clarified in the applicable contractual documentation.
2. Definitions
In this policy:
“App” means any mobile application published by or on behalf of Veriscope AB that provides access to the Services.
“Client” means any organisation or professional customer that uses the Platform to search for, review, license, purchase, download or otherwise use Footage and related services, and where relevant, its authorised users.
“Contributor” means any individual who captures, uploads or otherwise provides Footage or related content to the Platform, whether as a professional or non-professional creator.
“EEA” means the European Economic Area (EU Member States plus Iceland, Liechtenstein and Norway).
“Blockchain” means a distributed ledger or similar technology where data is recorded in blocks that are cryptographically linked and, once confirmed, is typically intended to be immutable and transparently verifiable by network participants.
“Decentralised storage” (including technologies such as IPFS) means a distributed system in which copies of content and related identifiers are stored across multiple independent nodes, rather than on a single server controlled by Veriscope.
“Footage” means any video, image, audio-visual or similar content, together with associated metadata, that is captured, uploaded, stored, reviewed, licensed, distributed or otherwise processed via the Platform.
“Personal data” means any information relating to an identified or identifiable natural person, as defined in the GDPR. This includes information that identifies you directly (e.g. your name or email address) or indirectly (e.g. an IP address, device identifier, or footage in which you appear).
“Platform” means our websites, the web-based marketplace, any subdomains, and the App, together with related online tools and interfaces provided by or on behalf of Veriscope.
“Processing” means any operation performed on personal data, whether or not by automated means, such as collection, recording, organisation, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure or destruction.
“Services” means all services, features and functionalities offered by Veriscope via the Platform, including account management, upload and management of Footage, marketplace and licensing services, payment processing, analytics, support, and communications.
“User” means any individual who accesses or uses the Platform or Services in any capacity, including Contributors, Client representatives, website visitors and other account holders.
Any other terms used in this policy that are defined in the GDPR shall have the meaning given to them in the GDPR.
3. Categories of personal data we collect
The personal data we collect about you depends on your relationship with us and how you use the Services.
3.1 Identification and contact data
This includes:
- full name;
- username or display name;
- email address;
- password (stored by us only as a secure password hash);
- organisation name and role or job title (for Clients or professional Contributors);
- country or region;
- communication and marketing preferences;
- any other contact details you choose to provide (for example, links to professional profiles).
3.2 Account and profile data
This includes:
- account registration details and settings;
- language, time zone and interface preferences;
- profile picture or avatar (where provided);
- biographical information, portfolio or profile descriptions you add;
- verification details where applicable (for example, information used to verify your identity, professional status or ownership of an account);
- security and login-related information (such as password change dates, account status, roles and permission levels).
3.3 Contributor data
For Contributors who provide Footage, we may process:
- upload history and library of Footage and related content;
- information about contributions, such as titles, descriptions, tags and categories;
- transaction history and payout records relating to licensing or other monetisation of Footage;
- payout-related details (for example, limited bank or payment account identifiers as required to send payments via third-party providers);
- information relating to rights, licences and clearances you provide;
- communications between you and Veriscope regarding your contributions, including support queries and correspondence about your Footage;
- optional biography, professional details and portfolio information that you choose to publish or share with Clients.
3.4 Client data
For Clients and their authorised users, we may process:
- business contact details (name, work email address, business phone number where provided, organisation name and address, role or position);
- details of authorised users and account administrators;
- account configuration and roles (e.g. who can approve purchases or manage licences);
- billing details (such as invoicing address, tax identifiers where provided, and relevant billing contact data);
- history of licences, purchases, downloads and other transactions;
- preferences and settings regarding notifications, rights usage and permissions.
3.5 Content and metadata relating to Footage
When you upload or provide Footage, or when we process Footage in connection with the Services, we may process:
- the digital files themselves (video, image, audio-visual or other media content);
- file names and internal identifiers;
- thumbnails, preview images and extracts;
- technical and device information embedded in or associated with the file (such as file format, resolution, frame rate, device model, operating system, app version, network information, error logs);
- upload date and time, and other timestamps;
location-related data and geotags, where you choose to include or authorise such data (for example, precise GPS coordinates captured by your device when this functionality is enabled). For users of the Veriscope mobile application, access to location data may be required in order to use certain core features of the Services, including capturing and uploading Footage. This is because location metadata is a key component of authenticating the provenance, reliability and newsworthiness of content on the Platform. If you do not grant location access in the App, you may not be able to use certain features, including uploading Footage. For users accessing the Platform via the website or other interfaces, providing location data is generally optional, and you may be able to use the Platform without enabling precise location sharing.
Where location data is collected, you can control permissions through your device settings, subject to the limitations described above.;
- descriptive tags, captions, titles, categories, rights information and other metadata you or we assign;
- human or automated moderation information, such as flags, review notes, decisions and restrictions;
- rights and licence information, including permitted uses, territorial and temporal restrictions, and usage history where tracked;
- any personal data of individuals who appear in the Footage or whose personal data is otherwise embedded in the content or metadata, to the extent we process it in connection with our Services.
3.6 Transaction and payment data
This includes:
- records of purchases, sales, licences and other transactions (e.g. type of licence, duration, territory, usage, associated Footage, date and time);
- amounts paid or received, currency, applicable fees and taxes;
- chosen payment method and limited payment card or bank information as processed by our payment providers;
- payment status, refunds and chargeback information;
- invoice and receipt details;
- accounting entries associated with transactions.
We generally do not store full payment card numbers or security codes. Payment card data is typically processed directly by third-party payment service providers acting as independent controllers or processors, using secure payment infrastructure. We may retain limited data such as the last digits of the card, card type and expiry date, to the extent necessary for record-keeping, security and fraud prevention.
3.7 Usage and log data
When you access or use the Platform, we may automatically collect:
- IP address;
- device identifiers (for example, device ID, advertising or app identifiers);
- browser type and version, operating system, device type;
- access times and dates;
- pages and screens viewed, links clicked, features used, search queries and navigation paths;
- app event logs, diagnostic information, crash reports and performance data;
- referral URLs or the source from which you reached our Platform;
- approximate location inferred from IP address (for example, city or region).
3.9 Communications data and E2EE messaging metadata
If you communicate with us, we may process:
- the content of emails, messages, forms, support tickets, chats or other communications;
- your contact details and any information you provide in such communications;
- responses you give in surveys, feedback forms or reviews;
- your preferences regarding marketing and other communications, including unsubscribe requests and opt-outs; and
- recordings or transcripts of calls or video conferences where applicable and where permitted by law, for support, training and quality purposes.
If messaging features on the Platform use end-to-end encryption (E2EE):
- we generally cannot access or read the content of E2EE messages on our servers because we do not hold the decryption keys;
- we may still process metadata such as sender and recipient identifiers, timestamps, routing information, delivery events, and related device or network identifiers to operate, secure and improve the messaging service; and
- if a User reports abusive or unlawful behaviour and chooses to share screenshots, copied messages or other relevant information with us, we may process that information for investigation, safety and enforcement purposes.
3.10 Compliance and verification data
To comply with legal and regulatory obligations and to protect our Services and users, we may process:
- identity verification data, such as document numbers or copies, photographs or video verification, and other information required to confirm your identity or eligibility where required by law or our policies;
- information about suspected misuse, fraud, copyright infringement, content violations or other breaches of our terms;
- information relating to complaints, takedown requests and legal demands;
- records relating to investigations, legal claims and law enforcement requests.
In the future, we may introduce more formal “know your customer” (KYC) or similar verification checks for Contributors and, where relevant, certain Clients. This could involve collecting and verifying identity documents and related information, in accordance with applicable law. If and when we implement such processes, we will provide additional or updated information about the categories of data involved and the purposes of processing, where required by law
4. How we collect personal data
We collect personal data from various sources:
4.1 Data you provide directly
You may provide personal data to us when you:
- register for an account or update your profile;
- upload or manage Footage or other content;
- enter into a licence or purchase via the Platform;
- subscribe to newsletters or marketing communications;
- participate in surveys, promotions or events;
- contact us via email, forms, in-app messaging or other channels;
- provide information for identity verification, compliance checks or rights management.
4.2 Data collected automatically
We automatically collect certain data when you access or use the Platform, including:
- usage and log data (see section 3.7 above);
- cookies and similar technologies data (see section 3.8 and 6 below);
- app-related diagnostic and performance information through SDKs and similar tools integrated into the App.
4.3 Data from third parties
We may receive personal data about you from:
- Clients and organisations – for example, when a Client creates user accounts for its staff, or shares contact details of its representatives, or when Contributors or Clients provide references to people involved in rights clearances;
- Payment service providers – for example, confirmations of payments, limited payment details, fraud alerts or chargeback information;
- Analytics and advertising partners – providing us with aggregated or pseudonymised analytics or audience information, subject to applicable law and your choices;
- Identity verification and compliance providers – providing verification results and risk assessments in accordance with their own privacy practices and applicable law;
- Social login or single sign-on providers – if we offer this option and you choose to use it, we may receive basic profile information (such as name, email address and profile picture) and a token used to authenticate you;
- Publicly available sources – for example, publicly accessible professional profiles, websites or databases, where relevant and lawful (e.g. verifying media organisations or contact details).
In all cases, we will only process such data for the purposes described in this policy and in accordance with applicable law.
5. Purposes and legal bases for processing (GDPR)
Under the GDPR, we must have a legal basis to process your personal data. The main legal bases we rely on are:
- Performance of a contract (Article 6(1)(b) GDPR) – where processing is necessary to enter into or perform a contract with you, or to take steps at your request before entering into such a contract.
- Legitimate interests (Article 6(1)(f) GDPR) – where processing is necessary for our legitimate business interests, and your interests or fundamental rights and freedoms do not override those interests.
- Legal obligation (Article 6(1)(c) GDPR) – where processing is necessary to comply with a legal obligation to which we are subject.
- Consent (Article 6(1)(a) GDPR) – where you have given your free, specific, informed and unambiguous consent.
The table below summarises our main purposes and corresponding legal bases.
| Purpose | Examples of activities | Legal basis |
|---|---|---|
| Providing and operating the Platform and Services | Creating and maintaining your account; enabling you to access and use features; enabling Contributors to upload and manage Footage; enabling Clients to search, review and license Footage | Performance of contract (where we have a contract with you); legitimate interests in operating and improving our Services |
| Creating and managing user, Contributor and Client accounts | Registering accounts; authenticating logins; managing roles, permissions and account configurations; communicating about account status | Performance of contract; legitimate interests in providing secure, well-managed accounts |
| Enabling upload, storage, review, licensing and distribution of Footage | Storing and processing Footage and metadata; generating previews; displaying content to Clients; managing rights and licences; facilitating downloads and usage tracking where applicable; and, where applicable, recording or referencing Footage and related transactions on blockchain or decentralised storage networks to provide integrity, verifiability and auditability. | Performance of contract (with Contributors and Clients); legitimate interests in operating a marketplace for newsworthy and reliable Footage; legal obligation where content retention is required |
| Processing payments and payouts; maintaining accounting records | Processing payments from Clients and payouts to Contributors; issuing invoices and receipts; keeping transaction and accounting records; managing refunds and chargebacks | Performance of contract; legal obligation (accounting, tax and financial regulations); legitimate interests in managing our business and preventing fraud |
| Content moderation, safety, fraud prevention and enforcement of terms | Reviewing content for compliance with our policies and the law; handling reports and complaints; preventing misuse, fraud and security incidents; enforcing contracts and terms of use; protecting our rights and the rights of others | Legitimate interests in ensuring the security, integrity and lawful use of our Services; legal obligation (e.g. to respond to lawful requests or comply with regulatory requirements); in rare cases, protection of vital interests of individuals |
| Providing customer support and communicating about the Services | Responding to enquiries; troubleshooting issues; sending service-related and transactional messages (e.g. confirmations, updates, changes to terms or policies); notifying you about changes affecting your account or content | Performance of contract; legitimate interests in maintaining relationships with Users and ensuring good customer service |
| Sending Veriscope marketing communications and newsletters | Sending you information about our Services, features, events, promotions or news that may be of interest; managing your marketing preferences; measuring the effectiveness of Veriscope’s own campaigns | Consent where required by law (e.g. for certain electronic marketing to individuals); otherwise, legitimate interests in promoting and developing our Services, always with an easy opt-out |
| Running analytics used to improve Veriscope’s services | Analysing usage patterns; measuring performance; developing new features; improving user experience and security; personalising content (e.g. recommending relevant Footage) | Legitimate interests in understanding how our Services are used and improving them; for non-essential cookies/trackers, your consent under applicable ePrivacy rules |
| Complying with legal obligations | Keeping records required by law; responding to lawful requests from authorities; complying with GDPR and other data protection rules; meeting tax, accounting and corporate obligations | Legal obligation |
| Managing corporate operations and legal matters | Internal administration; audits and risk management; handling legal claims, disputes or investigations; managing mergers, acquisitions or other corporate transactions | Legitimate interests in running our business and protecting our legal rights; legal obligation where applicable |
We do not use personal data collected through analytics or cookies to support third-party advertising networks or behavioural advertising, and we do not sell personal data for marketing purposes. If this changes, we will update this policy and, where required by law, obtain your consent before placing or reading any non-essential advertising or analytics cookies. Where we rely on legitimate interests, we have carried out and will continue to carry out a balancing test to ensure that your rights and interests do not override our legitimate interests.
Where our use of blockchain and decentralised storage technologies involves personal data, we generally rely on the same legal bases described in the table above, in particular performance of a contract (for example, making sure that licences and transactions are reliably recorded and can be verified) and our legitimate interests in maintaining the integrity and resilience of our Platform.
Where we rely on your consent, you have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing that took place before withdrawal, but it may affect our ability to continue providing certain features or services that rely on that consent.
7. Retention of personal data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, as described in this policy, and for additional periods where required or permitted by law (for example, to comply with record-keeping obligations, resolve disputes or enforce our agreements).
We use the following general criteria and indicative retention periods:
Account and profile data – retained for as long as your account remains active. After account deactivation or closure, we may retain relevant data for an additional period (for example, several years) to:
- respond to enquiries or complaints;
- manage or defend potential legal claims;
- comply with legal or regulatory obligations.
- Footage and related metadata – retained for as long as necessary to provide the Services, support existing licences and legitimate uses, manage rights, and comply with legal obligations. Where Footage has been licensed, we may need to retain it and key associated metadata for the duration of the licence and for a further period to handle disputes, audits or legal claims.
- Transaction and accounting records – retained in accordance with Swedish accounting and tax law and other applicable regulations. This is currently at least seven years from the end of the relevant financial year, or longer if required under applicable law.
- Communications and support records – retained for a reasonable period after the matter has been resolved, typically aligned with limitation periods for potential legal claims and our internal retention policies.
- Compliance and verification data – retained for as long as necessary to meet our legal and regulatory obligations (for example, anti-fraud and security records), and for additional periods where such data is relevant to ongoing or potential investigations or legal proceedings.
Because parts of our infrastructure rely on blockchain and decentralised storage technologies, some records (for example, transaction identifiers, hashes or content identifiers that have been written to a decentralised network and replicated across independent nodes) may not be capable of being altered or erased by us. In such cases, we will take all steps reasonably within our control – such as deleting or de-indexing related data that we store centrally, ceasing to associate that data with you, and, where feasible, requesting removal of cached copies from nodes or gateways we control – but we cannot guarantee the complete erasure of all copies of such data from all decentralised networks.
In all cases, we will act in good faith and use reasonable efforts to respect your data protection rights while taking into account the technical characteristics and limitations of the technologies we use. When personal data is no longer needed for the purposes for which it was collected and no longer required for legal, regulatory or legitimate business reasons, we will delete or anonymise it. Anonymised or aggregated data that no longer identifies an individual is not considered personal data and may be retained and used for analytics, research or other legitimate purposes. In all cases, we will act in good faith and use reasonable efforts to respect your data protection rights while taking into account the technical characteristics and limitations of the technologies we use.
8. Blockchain, decentralised storage and end-to-end encrypted messaging
8.1 Blockchain and decentralised storage
Parts of our infrastructure rely on Blockchain and Decentralised Storage technologies. We may use them to:
- record proofs, timestamps, transaction references, hashes or identifiers related to Footage and associated transactions;
- store or reference content or identifiers across decentralised or distributed networks; and
- support integrity, resilience, traceability and auditability in connection with Footage and licensing activity.
We aim to:
- avoid storing plain personal data directly on-chain wherever reasonably possible;
- use hashing, pseudonymisation and off-chain storage wherever feasible;
- minimise the amount of data written to decentralised systems; and
- keep more detailed personal data under our direct control on systems we manage.
No personal data is written to Blockchain or Decentralised Storage other than the limited provenance fields attached to uploaded Footage, namely the timestamp, registration ID, location, device model (model name and operating system), media type (file extension), server public-key ID, algorithm, nonce, seal version and gyroscopic-dataset length. Some of these fields (for example, location and device identifiers) may themselves constitute personal data, and the immutability and erasure limitations described below apply to them.
Because Blockchain and Decentralised Storage systems may be immutable and distributed, it may not be technically feasible to erase or modify certain records once written. In such cases, we will, where feasible:
- delete, anonymise or restrict access to off-chain data we control;
- cease associating identifiers with you;
- de-index or remove links under our control; and
- explain the technical limitations when responding to data subject requests.
8.2 End-to-end encrypted messaging
Some messaging features may use end-to-end encryption (E2EE). This means that:
- we generally do not have the keys needed to decrypt message content;
- we cannot routinely access or read the content of E2EE messages on our servers; and
- we may still process limited metadata needed to operate, secure and improve the messaging service, including sender and recipient identifiers, timestamps, routing and technical event information, and related device or network identifiers.
If a User reports abusive or unlawful behaviour and chooses to share message content, screenshots or other supporting evidence with us, we may process that information to investigate and respond to the report.
Because some messaging features use E2EE, we cannot proactively monitor all communications and instead rely on:
- clear conduct rules and community standards;
- user reports;
- metadata and technical indicators; and
- other available information.
10. International data transfers
Veriscope AB is based in Sweden, but we may process and store personal data on servers located in other countries, and we may use service providers located outside the EU/EEA, including in countries that may not provide the same level of data protection as in the EU/EEA.
Where personal data is transferred to a country outside the EU/EEA that has not been recognised by the European Commission as providing an adequate level of data protection, we will ensure that appropriate safeguards are in place, such as:
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- other contractual and organisational measures designed to protect your data, such as encryption, access controls and minimisation of data transfers;
- transfers to recipients in countries that are subject to an adequacy decision by the European Commission.
The use of blockchain and decentralised storage technologies (including IPFS) means that some data, or references to data, may be replicated or made available across a distributed network of nodes that can be located in many different countries. Where this involves personal data, we seek to limit the amount and type of personal data stored on such networks, and to use techniques such as pseudonymisation, hashing and encryption where reasonably possible. However, because many of these networks are operated by independent participants, we do not control the exact locations of all copies at all times.
In all cases, we will take steps to ensure that the level of protection afforded to your personal data is essentially equivalent to that guaranteed within the EU/EEA.
You can contact us using the contact details provided on our website if you would like more information about the specific safeguards we use for international transfers.
11. Security of personal data
We take the security of personal data seriously and implement appropriate technical and organisational measures to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures include, as appropriate:
- access controls and role-based permissions to limit access to personal data to those who need it;
- use of encryption technologies to protect data in transit and, where appropriate, at rest;
- secure development practices, including testing and review of our systems and applications;
- logging and monitoring of systems to detect suspicious activity;
- regular backups and continuity measures to help ensure availability and resilience;
- internal policies and procedures regarding data protection, security and acceptable use;
- staff training and awareness programmes on privacy and security obligations;
- careful selection and oversight of service providers and partners, including contractual security and confidentiality obligations.
In the context of our blockchain and decentralised storage components, we also seek to apply privacy-by-design principles, including minimising the personal data that is directly written to decentralised networks and, where feasible, storing personal data in encrypted or pseudonymised form and keeping more detailed personal data under our direct control on cloud-based infrastructure.
Despite our efforts, no system can be completely secure. We cannot guarantee absolute security of your personal data, but we work to continuously assess and improve our security practices in line with industry standards and legal requirements.
If you believe that your account or interaction with us is no longer secure, please contact us using the contact details provided on our website.
12. Children’s privacy
Our Services are not directed to children under the age of 13, and we do not knowingly allow children under 13 to create Accounts.
If you are between 13 and 17, you may use the Platform only in accordance with our Terms & Conditions and, where required by law, with the consent of your parent or legal guardian.
We do not currently apply systematic age-verification to all Users and rely in part on the information provided during registration. We will use reasonable efforts to, where appropriate:
- investigate credible reports of harmful or inappropriate behaviour involving minors;
- enforce our community policies prohibiting exploitation, grooming and other abusive conduct; and
- close Accounts or contact relevant authorities where we have reasonable grounds to believe that a child or young person is at risk.
If we become aware that we have collected personal data from a child under 13 without appropriate consent or legal basis, we will take reasonable steps to delete such data as soon as practicable, subject to legal obligations and technical limitations, including limitations arising from Blockchain or Decentralised Storage systems.
If you are a parent or legal guardian and believe that your child has provided personal data to us, please contact us using the contact details available on our website so that we can address the matter.
13. Your rights under data protection law
Subject to the conditions and exceptions set out in the GDPR and other applicable law, you have the following rights in relation to your personal data:
13.1 Right of access
You have the right to obtain confirmation as to whether we process personal data about you, and to receive a copy of that personal data together with certain information about how and why we process it.
13.2 Right to rectification
You have the right to request that we correct or complete any inaccurate or incomplete personal data relating to you. In many cases, you can update your account information directly through your account settings. Where data has been recorded on immutable ledgers such as certain blockchains, we may not be able to technically amend the historical record itself, but we can correct or supplement the data we store centrally and, where feasible, add corrective information in our systems to reflect the most accurate and up-to-date position.
13.3 Right to erasure (“right to be forgotten”)
You have the right to request that we delete your personal data in certain circumstances, for example where:
- the data is no longer necessary for the purposes for which it was collected;
- you withdraw consent and there is no other legal basis for processing;
- you successfully object to processing based on our legitimate interests;
- the data has been unlawfully processed; or
- we must erase the data to comply with a legal obligation.
There are exceptions to this right. For example, we may not be able to delete data where we need it to comply with legal obligations, maintain necessary records, or establish, exercise or defend legal claims, or where retention is necessary for freedom of expression and information or other overriding legitimate grounds.
In addition, due to the technical characteristics of Blockchain and Decentralised Storage technologies, we may not be able to remove or alter certain records that have already been written to decentralised networks and replicated across independent nodes. In those cases, we will take the steps that are within our control – such as deleting related data stored on our own systems, ceasing further processing, and, where technically feasible, removing or obscuring links between on-chain or decentralised identifiers and our internal records – but we cannot guarantee that all historical entries on such networks can be deleted or modified.
13.4 Right to restriction of processing
You have the right to request that we restrict (suspend) the processing of your personal data in certain circumstances, for example if:
- you contest the accuracy of the data (for a period enabling us to verify it);
- the processing is unlawful and you prefer restriction to erasure;
- we no longer need the data, but you require it for legal claims; or
- you have objected to processing pending verification of our overriding legitimate grounds.
Where processing is restricted, we will continue to store the data but will generally only process it with your consent, for legal claims, to protect the rights of another person, or for important public interest reasons.
13.5 Right to data portability
Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to request that we transmit it to another controller where technically feasible.
13.6 Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data that is based on our legitimate interests. We will then no longer process your personal data for that purpose unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.
You have an absolute right to object to direct marketing at any time. If you object, we will stop processing your personal data for direct marketing purposes.
13.7 Right to withdraw consent
Where we rely on your consent for processing, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal, but it may affect our ability to provide certain features or services.
13.8 How to exercise your rights
You can exercise many of your rights by:
- adjusting your preferences and data in your account settings, where available; or
- contacting us using the contact details provided on our website.
When you make a request:
- we may ask you to provide information to verify your identity and to help us locate your personal data;
- we will respond within the time limits set by applicable law, usually within one month, which may be extended in complex cases.
Where your request concerns data that may be stored or referenced on Blockchain or Decentralised Storage networks, we will explain what we can and cannot do from a technical and legal perspective and will take all reasonable steps that are within our control to address your request.
You also have the right to lodge a complaint with a supervisory authority, as described in section 14 below.
14. Right to lodge a complaint
If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a supervisory authority, in particular in:
- the EU/EEA Member State of your habitual residence;
- your place of work; or
- the place of the alleged infringement.
For Veriscope AB, the competent supervisory authority in Sweden is:
Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY)
Further information about IMY and how to submit a complaint is available on IMY’s official website.
We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority. We therefore encourage you to contact us first using the contact details provided on our website.
15. Automated decision-making and profiling
We do not currently use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.
We may use limited forms of profiling or automated processing for purposes such as:
- analysing usage patterns and preferences to improve the Services;
- suggesting or ranking content (for example, recommending relevant Footage);
- security and fraud detection.
These activities do not produce legal or similarly significant effects for you.
If in the future we introduce automated decision-making or profiling that falls within Article 22 GDPR, we will provide you with specific information about the logic involved, the significance and the envisaged consequences for you, as well as your related rights.
16. Third-party links and services
The Platform may contain links to or integrations with third-party websites, apps, services or platforms (for example, social networks, payment providers, or other media platforms).
Please note:
- These third parties may collect and process personal data about you under their own privacy policies and terms.
- We are not responsible for the privacy practices or content of third-party sites or services.
- We encourage you to review the privacy notices and terms of any third-party services you use or access through our Platform.
17. Changes to this privacy policy
We may update this privacy policy from time to time, for example to reflect:
- changes in our Services or internal processes;
- new legal or regulatory requirements;
- feedback from Users or supervisory authorities.
When we make material changes, we will:
- post the updated version on our website and/or App, with a new “last updated” date at the top of the policy; and
- where appropriate, notify you by email, in-app notification or other prominent means.
We encourage you to review this policy periodically to stay informed about how we handle your personal data.
18. Contact and privacy inquiries
If you have any questions, concerns or requests in relation to this privacy policy or our handling of your personal data, or if you wish to exercise your rights, you can contact us by using the contact details provided on our website. We have not appointed a formal data protection officer (DPO). If this changes in the future, we will update this policy and, where appropriate, publish the relevant contact details on our website.
Where available, this may include a dedicated privacy or data protection contact channel. Please clearly state that your enquiry relates to data protection or privacy so that it can be directed to the appropriate team.
This privacy policy is intended to provide transparent and comprehensive information about how Veriscope AB processes personal data. It does not form part of any contract between you and Veriscope AB, and it is subject to further legal review and local adaptations where necessary.