VEDI - PRIVACY POLICY
Version 2.0
Last updated: 26 August 2026
1. INTRODUCTION
The website https://vedi.ie (the “Website”) is operated by Chern & Co Limited, a company registered in Ireland under company number 604324, trading as Vedi (“Chern & Co”,”we”, “us”, or “our”).
Chern & Co acts as a data controller for the personal data described in this Privacy Policy under the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”) and the Irish Data Protection Acts 1988 to 2018 (together, the “Data Protection Legislation”).
Registered office: 18 Mallow Street, Limerick, V94 N12Y, Ireland.
Telephone: +353 1 485 4244.
Email: [email protected] .
About Vedi. Vedi is the trading name under which Chern & Co is developing a business intelligence platform for the Irish market. This Policy explains how we collect and use personal data of website visitors and individuals who register interest in our future service, including for marketing communications. We will update this Policy before the platform goes live to reflect any additional processing activities, and we will notify subscribers of material changes (see clause 12).
In addition to our website visitors and account holders, this Privacy Policy applies to natural persons whose personal data is processed within the Vedi Business Intelligence Platform (the “Platform”). This includes directors, company secretaries, shareholders, beneficial owners, liquidators, receivers, and authorised representatives of registered corporate entities in the Republic of Ireland, whose statutory records are sourced from the official public registry.
2. WHO THIS POLICY APPLIES TO
This Policy applies to:
• Website visitors: anyone who browses the Vedi website.
• Subscribers: individuals who submit a contact, demo, or waitlist form, sign up for our newsletter, or otherwise register their interest in the future Vedi platform or related services from Chern & Co.
• Correspondents: anyone who contacts us by email, telephone, or other channels.
• Corporate Registry Data Subjects: Irish company directors, company secretaries, shareholders, beneficial owners (including registrable beneficial owners), liquidators, receivers, examiners, authorised persons, registered office agents, and registered business name owners whose personal data is processed within the Platform.
3. PERSONAL DATA WE COLLECT
3.1 Information You Provide Directly
When you submit a form on our website, subscribe to our newsletter, request a demo or early access, or contact us by any other means, we collect:
• Identity and Contact Data: full name, business email, professional telephone number (where provided), job title, and the name of your organisation.
• Interest Data: the topics, services, or features you express interest in; your professional sector; your country.
• Marketing Preferences: your opt-ins, opt-outs, and communication preferences.
• Communications: the content of your messages, enquiries, and our correspondence with you.
3.2 Information Collected Automatically
• Usage Data: pages visited, links clicked, time spent on pages, and referral source.
• Technical Data: IP address, device and browser identifiers, operating system, and language preferences.
• Cookies and Similar Technologies: as described in the Vedi Cookie Policy.
3.3 Corporate Registry Data Sourced from the Companies Registration Office (CRO)
We act as an independent data controller in respect of personal data sourced legally under bulk data and image licence agreements from the Irish Companies Registration Office (CRO). Because this data is obtained from a third-party public register rather than directly from you, we provide the following information regarding our processing of your data:
• Identity and Contact Data: full name, residential or service address,date of birth (processed strictly for identity verification and deduplication purposes, with public display on the Platform limited to month and year), Eircode, and country of residence.
• Corporate Role and Relationship Data: company number, role type (e.g., director, secretary, liquidator, receiver, examiner, or authorised person), dates of appointment and resignation, and company status.
• Scanned Filings and Image Data: unaltered PDF images of official filings submitted to the CRO (such as annual returns, incorporation forms, and officer details), which may contain handwritten or electronic signatures, witness details, and other personal data included in the public record.
4. HOW WE USE YOUR DATA
We process personal data for the purposes set out below, each under a valid lawful basis under Article 6 of the GDPR.
| Purpose of Processing | Categories of Data Subjects | Lawful Basis & GDPR Article |
|---|---|---|
| Responding to your enquiries, requests, and other correspondence. | Website Visitors, Prospects, and Correspondents | Legitimate interests in handling enquiries (Art. 6(1)(f)); steps prior to entering a contract at your request (Art. 6(1)(b)). |
| Sending direct marketing communications by email, including newsletters, product updates, launch announcements, event invitations, and information about Chern & Co services. | Newsletter Subscribers and Registered B2B Users | Consent (Art. 6(1)(a)) and Regulation 13 of the Irish ePrivacy Regulations (S.I. 336/2011). You can withdraw consent at any time. |
| Personalising marketing content and measuring engagement (such as open and click rates of our emails) to improve our communications. | Newsletter Subscribers and Registered B2B Users | Consent (Art. 6(1)(a)). We obtain your explicit consent (opt-in) before placing any email tracking pixels or analytical technologies, and you may withdraw this consent at any time. |
| Operating, securing, and analysing performance of the website, and preventing fraud or abuse. | Website Visitors and Registered B2B Users | Legitimate interests in operating a secure website (Art. 6(1)(f)). |
| Complying with applicable laws and responding to lawful requests from public authorities. | All Categories of Data Subjects | Legal obligation (Art. 6(1)(c)). |
| Establishing, exercising, or defending legal claims. | All Categories of Data Subjects | Legitimate interests (Art. 6(1)(f)). |
| Operating the Vedi business intelligence and corporate compliance platform to enable our business customers to conduct legal search, corporate due diligence, company verification, fraud prevention, and anti-money laundering (AML) checks. | Corporate Registry Data Subjects | Legitimate Interests (Art. 6(1)(f) GDPR). Sourcing, structuring, and displaying this information is strictly limited to records made publicly available by the Registrar of Companies pursuant to statutory transparency obligations under the Irish Companies Act 2014. |
Marketing Communications and Your Choices
We will send you marketing communications by email only where you have given us your explicit consent (for example, by ticking the marketing opt-in box on our signup or contact form, or by subscribing to our newsletter).
Every marketing email includes a clear unsubscribe link. You can also withdraw consent or object to marketing at any time by emailing [email protected] . Withdrawal does not affect the lawfulness of any processing carried out before withdrawal. On unsubscribe, we will keep a minimum record of your email address on a suppression list, to ensure that we do not contact you again in error.
We do not sell personal data, and we do not share personal data with third parties for their own marketing purposes.
In strict compliance with our CRO licence agreements, Vedi does not use, distribute, or apply any part of the personal data sourced from the CRO for the purposes of engaging in Unsolicited Marketing Communications. We impose identical strict contractual prohibitions on all our platform customers. Furthermore, images of scanned public documents are processed and displayed exactly as supplied by the CRO, without any alteration, modification, or manipulation.
5. WHO WE SHARE YOUR DATA WITH
We share personal data only where there is a lawful basis to do so, and only with the following categories of recipient:
• Service providers (processors): carefully selected providers of website hosting, email delivery, form and CRM tooling, and website analytics. Processors act strictly under our written instructions and are bound by data processing agreements compliant with Article 28 of the GDPR.
• Professional advisers: our legal, accounting, and insurance advisers, where this is necessary for the management of our business.
• Regulators and public authorities: where required by law, including the Data Protection Commission, the Revenue Commissioners, and law enforcement.
• Successors in business: if Chern & Co is sold, merged, or reorganised, personal data may be transferred to the successor entity, subject to equivalent protections.
• Vedi Platform Users: Corporate registry data (such as company officer roles and public document filings) is shared with our business customers who use the Vedi platform for legitimate commercial due diligence, search, and compliance purposes.
6. INTERNATIONAL TRANSFERS
Our primary hosting environment is located within the Republic of Ireland and the European Economic Area. Where a processor is located outside the EEA or the United Kingdom, we ensure that the transfer is protected by an appropriate safeguard under Article 46 of the GDPR, such as:
• Standard Contractual Clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914);
• the UK International Data Transfer Agreement or UK Addendum where applicable;
• a Transfer Impact Assessment of the legal protections in the recipient country.
7. HOW LONG WE KEEP YOUR DATA
We retain personal data only for as long as necessary for the purposes for which it was collected.
| Category | Retention Period | Reason for Retention |
|---|---|---|
| Registered B2B Account Holders (Vedi Clients) | Active subscription period + 6 years following the end of the financial year of termination. | Compliance with statutory tax, financial, and accounting record-keeping obligations under the Irish Taxes Consolidation Act 1997, and the Statute of Limitations 1957. |
| Newsletter Subscribers & Lead Contact Forms | Until you unsubscribe, withdraw consent, or after 12 months of complete marketing inactivity. | Delivery of subscribed communications, newsletters, and product updates. |
| Marketing Suppression List (Opt-out) | Indefinitely (unless a complete erasure request is legally validated under GDPR Article 17). | Compliance with GDPR Article 21 and Irish ePrivacy Regulations (S.I. 336/2011) to permanently honour your opt-out and prevent re-contact. |
| Enquiries and Correspondence | Up to 24 months from the date of last contact/resolution. | Customer service quality control, business reference, and dispute resolution. |
| Website Analytics Data | Up to 26 months (with anonymised IP addresses). | Optimising website performance, user experience, and evaluating marketing campaigns. |
| Security and Access Logs | Up to 12 months (unless required longer for active incident investigation). | Monitoring website security, preventing unauthorized access, and investigating potential fraud or cybersecurity incidents. |
| Corporate Registry Data (Sourced from the CRO) | Retained on the Platform for as long as it remains part of the statutory public register at the CRO, or as long as necessary to maintain accurate historical corporate transparency under the Irish Companies Act 2014. | Facilitating business transparency, user research, and B2B corporate compliance (KYC, AML, and credit risk evaluation). Updated dynamically via daily and weekly bulk synchronisation. |
After the applicable retention period, we securely delete or anonymise personal data so that individuals can no longer be identified. Please note that for Corporate Registry Data, since the Platform is a direct reflection of the public record, records are only deleted or updated on Vedi once they have been officially updated, removed, or expunged by the Registrar at the CRO.
8. HOW WE PROTECT YOUR DATA
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encryption in transit (TLS), role-based access controls, multi-factor authentication for administrative access, regular software updates, and written confidentiality undertakings from personnel.
In the event of a personal data breach, we will notify the Irish Data Protection Commission within 72 hours of becoming aware of the breach where required by Article 33 of the GDPR, and will notify affected individuals where required by Article 34.
9. YOUR RIGHTS
Under the Data Protection Legislation, you have the following rights in respect of personal data we hold about you:
• Access (Art. 15): to obtain confirmation of whether we process your personal data and a copy of that data.
• Rectification (Art. 16): to have inaccurate personal data corrected.
• Erasure (Art. 17): to request deletion of personal data, subject to applicable exemptions.
• Restriction (Art. 18): to request that processing be limited in certain circumstances.
• Object (Art. 21): to object to processing based on legitimate interests, including direct marketing. We will stop direct marketing processing on receipt of an objection.
• Data portability (Art. 20): to receive personal data in a structured, commonly used, machine-readable format.
• Withdraw consent: where processing is based on consent, to withdraw that consent at any time.
• Lodge a complaint: with the Irish Data Protection Commission (details in clause 11).
To exercise any of these rights, email [email protected]. We will respond within one month of a valid request, although this may be extended by two further months for complex or numerous requests. We may need to verify your identity before responding.
If you are a Corporate Registry Data Subject and wish to correct inaccurate personal data on our platform, please note that Vedi mirrors the official records of the CRO.
To ensure a permanent update of the public record, any official corrections must first be registered directly with the CRO. Once the CRO processes and publishes the correction, our database will automatically reflect these updates within our daily or weekly synchronization cycles.
However, if you detect a synchronisation or processing error unique to the Vedi platform (where our data does not match the official CRO record):
Please contact us at [email protected]
Upon verifying the discrepancy, we will correct the error on our platform without delay.
In accordance with our CRO licence obligations, we will proactively notify all customers who accessed the factually erroneous material on our platform to inform them of the error and provide the updated information.
10. COOKIES
The Vedi website uses cookies and similar technologies to support technical performance, security, and analytics. Full information is set out in the Vedi Cookie Policy.
11. CONTACT US AND COMPLAINTS
Data protection and rights requests: [email protected] .
General correspondence: [email protected] .
Postal address: Chern & Co Limited, 18 Mallow Street, Limerick, V94 N12Y, Ireland.
Telephone: +353 1 485 4244
If you are not satisfied with our response, you have the right to lodge a complaint with the Irish supervisory authority:
Data Protection Commission
6 Pembroke Row, Dublin 2, D02 X963, Ireland.
Telephone: +353 1 765 0100 or 1800 437 737.
Website: https://www.dataprotection.ie .
12. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time, including before the launch of the Vedi platform. Where changes are material, we will notify subscribers by email at least 15 days before the change takes effect, except where a shorter period is required to comply with a legal obligation or to address an imminent security risk. The current version, with the date of last update, will always be available on the Vedi website.
End of Privacy Policy, Version 2.0, dated 26 August 2026.