VEDI - PRIVACY POLICY

Version 1.0
Last updated: 11 August 2026

1. INTRODUCTION AND SCOPE OF THE PRIVACY POLICY

1.1. The Company

The website vedi.ie (the “Platform”) is operated by Chern & Co Limited, a company registered in Ireland under company number 604324, trading as Vedi (“Chern & Co”, “the Company”, “we”, “us”, or “our”).
Registered office: 18 Mallow Street, Limerick, V94 N12Y, Ireland.
Telephone: +353 1 485 4244
Email: [email protected]

Chern & Co acts as a data controller for the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”) and the Irish Data Protection Acts 1988 to 2018 (together, the “Data Protection Legislation”) in respect of the personal data described in this Privacy Policy.

1.2. Scope of the Privacy Policy

This Privacy Policy describes how we collect, use, store, disclose, and protect personal data in the course of providing business intelligence and corporate insight services within the Republic of Ireland. It applies to two distinct groups:
“End User” means the “Client” (the legal entity (including a sole practitioner) that registers an Account or otherwise enters into this Agreement, and any individual who accesses the Platform on its behalf) , in its capacity as the recipient of Output Data for its own internal business purposes.
“Data Subjects” means natural persons whose professional data appears in records made available through the Platform, including company directors, secretaries, shareholders, ultimate beneficial owners (UBOs), and other officers of business entities operating in the Republic of Ireland.

This Policy is incorporated into, and should be read together with, the Vedi Terms and Conditions and the Vedi Cookie Policy. Capitalised terms not defined in this Policy have the meanings given to them in the Terms and Conditions.

Please read this Policy carefully. If you do not agree with any part of it, you must immediately cease all use of the Platform.

2. INFORMATION WE COLLECT AND SOURCES

We process two principal categories of personal data:
(i) information collected directly from Clients in connection with their use of the Platform, and
(ii) professional information about Data Subjects obtained indirectly from our licensed Data Provider.

2.1 Information Collected Directly from Clients

When a Client registers for an account or interacts with our services, we collect various types of personal data necessary for account maintenance and service delivery:
Identity and Contact Data: full name, business email address, professional telephone number, job title, and the name and registered details of the Client organisation.
Billing Data: billing address, VAT registration number, and payment information. Card details are collected and processed directly by our third-party payment processor (Stripe) and are not stored by Chern & Co.
Authentication Data: Memorable words, security questions, and password hashes used to secure the client’s account and verify identity.
Usage and Technical Data: IP addresses, login timestamps, browser types, and records of the specific company reports or documents accessed. When a Client signs in or signs up, we also set a device identifier on the Client's device, held by us only as an irreversible hash, together with the basic browser and platform details the browser sends with each request, and the country and network operator derived from the IP address.
Communications Data: emails, support tickets, complaints, and any other correspondence between the Client and Chern & Co.

2.2 Information Collected Indirectly via Third Parties

Our business analytics platform aggregates data from a variety of trusted sources to provide a comprehensive view of the Irish corporate landscape. This information often relates to natural persons in their professional capacities as officers, owners, or significant stakeholders of business entities.

Official Publications: We monitor the Iris Official Publications and other insolvency publications to identify entities in liquidation or receivership.
Regulatory and Legal Sources: Information regarding court judgments and mortgages is sourced from the courts and official registries.
Contractual Partners: We receive information from business partners and data brokers regarding payment performance and professional contact details for market mapping.

Important note. Chern & Co does not produce credit scores, credit reports, credit limits, risk bands, or any other credit assessment products. The data we make available is intended to support, not replace, the Client's own due diligence and risk assessment processes.

3. PURPOSES OF PROCESSING AND LAWFUL GROUNDS

Every processing activity conducted by the Platform is supported by a valid lawful basis under Article 6 of the GDPR.

3.1 Legitimate Interests (Article 6.1)

The primary lawful basis for maintaining our corporate database is the legitimate interest of the Platform and its Clients. We have a legitimate interest in the commercial supply of data, while our Clients require this information to:
Manage Credit Risk: assessing the financial stability of prospective business partners to prevent trade credit losses.
Prevent Fraud and Financial Crime: verifying the identities of corporate officers and screening for PEPs and sanctions list appearances.
Conduct Due Diligence: ensuring that business transactions are conducted with legitimate entities and identified stakeholders.

3.2 Performance of a Contract (Article 6.1.b)

We process Client Data when it is necessary to fulfil our contractual obligations to our Clients. This includes processing payments, providing customer support, and delivering the specific analytics and reports requested via the Platform.

3.3 Legal Obligation (Article 6.1.c)

In certain circumstances, we process personal data to comply with legal requirements, such as anti-money laundering (AML) and know-your-customer (KYC) regulations, or to respond to valid requests from law enforcement and regulatory authorities.

3.4 Client as Independent Data Controller.

Platform, the Client acts as an independent data controller in respect of that data. The Client is solely responsible for:
(i) establishing a valid lawful basis under the GDPR for its own use of the data;
(ii) complying with the transparency, accountability, and data minimisation principles of the GDPR;
(iii) ensuring that data subject rights can be exercised in respect of any data the Client retains;
(iv) implementing appropriate technical and organisational security measures, modelled at minimum on ISO/IEC 27001;
(v) notifying Chern & Co without undue delay, and in any event within 48 hours, of any Personal Data Breach affecting personal data obtained via the Platform.
These obligations are set out in detail in the Vedi Terms and Conditions.

3.5 Account Security and Licence Enforcement (Article 6.1.f)

This subsection describes a further, distinct legitimate interest from the one described in section 3.1 above, and the two should not be read as competing statements of the same basis.
Purpose: detecting unauthorised access to a Client account and enforcing the per-seat licensing terms of the Client's subscription.
Lawful Basis: legitimate interests under Article 6(1)(f) of the GDPR, having regard to Recital 49 of the GDPR concerning network and information security. A legitimate interests assessment covering this processing has been carried out and is available on request from [email protected].
What We Collect and When: when a Client signs in or signs up successfully, we set a device identifier on their device. This identifier is never set for a visitor who is not signing in, cannot be read by any script, is random and meaningless outside our systems, and is held by us only as an irreversible hash. It remains on the device after sign-out so that the same device is recognised at the next sign-in. Alongside the identifier, we collect the basic browser and platform details the browser sends with every request, and we derive the country and network operator associated with the IP address locally, so IP addresses are not sent to any third party for this purpose; country and network operator are used at that level only and are never used to locate a household or address.
Retention: the login records this processing creates are retained for 90 days, after which they are permanently deleted. The device identifier itself is different: it remains on the Client's device for approximately 400 days, with that period running from the Client's most recent sign-in because the identifier is re-issued on each successful sign-in. It is not removed when the Client signs out, because recognising the same browser at the next sign-in is the purpose of the identifier. Clearing the browser's stored data removes it.
Automated Review: a nightly automated review of a Client's own recent logins may flag possible account sharing for internal review. This review does not produce any automated decision affecting the individual: it does not result in account lockout, does not impose any additional verification requirement, and does not restrict access.

4. USAGE RESTRICTIONS AND TERRITORIAL LICENSING

Personal data made available through the Platform is licensed under strict terms agreed between Chern & Co and the Data Provider. These restrictions are essential to protect the rights of Data Subjects and the integrity of the Irish data ecosystem.

4.1 Internal Business Use Only

Personal data accessed through the Platform is licensed solely for the Client's internal business purposes. Clients are strictly prohibited from:
(i) selling, redistributing, sublicensing, or otherwise commercially exploiting personal data accessed via the Platform;
(ii) incorporating personal data accessed via the Platform into any product or service that is supplied to any third party;
(iii) using such data to produce, license, or supply any credit report, credit score, credit limit, risk band, or any product competing with the credit reporting services of the Data Provider;
(iv) using such data, or contact information of directors and officers, for direct marketing, telemarketing, prospecting, or to compile any business directory;
(v) inputting such data into any artificial intelligence or machine learning system for the training of any model intended for external use or distribution;
(vi) transferring such data to any third party without prior written consent of Chern & Co.

4.2 Territorial Limitations: The Republic of Ireland

The licensed Territory for use of the Platform and the data made available through it is the Republic of Ireland. Clients must ensure that the Platform is accessed only by registered clients operating within this jurisdiction. Where personal data is to be transferred to a country outside the European Economic Area or the United Kingdom, the Client must ensure that an appropriate transfer mechanism is in place under the Data Protection Legislation, including (where applicable) the EU Standard Contractual Clauses (“SCCs”), the UK International Data Transfer Agreement (“IDTA”), or the UK Addendum to the EU SCCs.

4.3 Permitted Delivery Methods

Data must be accessed and received via the Platform’s designated Delivery Methods only. Any attempt to obtain data through unauthorised means, such as web scraping, automated crawlers, or framing techniques, constitutes a breach of our terms and will result in the immediate suspension of service.

5. DISCLOSURE OR PERSONAL DATA

We disclose personal data only as set out in this Policy and only where there is a lawful basis to do so. The categories of recipients are:
Clients of the Platform: professional data about Data Subjects is disclosed to registered Clients, in accordance with the licensing terms set out in clauses 2 and 4.
Service providers and processors: we engage carefully selected third-party providers (including cloud hosting, security, payment processing, communications, and analytics) who process personal data on our behalf and strictly under our written instructions, in compliance with Article 28 of the GDPR.
Professional advisers: our legal, accounting, audit, insurance, and corporate advisers, where this is necessary for the management of our business.
Law enforcement and regulators: where required or permitted by law, we may disclose personal data to courts, regulators, the Data Protection Commission, the Revenue Commissioners, or law enforcement.
Successors in business: in the event of a sale, merger, or reorganisation of Chern & Co, personal data may be transferred to the successor entity, subject to equivalent protections.
The Data Provider: we may disclose information to the Data Provider where required to comply with our licence obligations, including in connection with audits and the verification of compliance with usage restrictions.
We do not sell personal data and do not share personal data with third parties for their own marketing purposes.
For questions, contact [email protected] .

6. DATA SECURITY AND INFRASTRUCTURE

Chern & Co implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our security framework is modelled on ISO/IEC 27001 and reflects the standards required of us by the Data Provider.

6.1 Technical Measures

Encryption in transit: all communications with the Platform are protected using Transport Layer Security (TLS).
Encryption at rest: personal data is encrypted at rest in our hosting environment.
Access control: strict role-based access controls, multi-factor authentication for all administrative access, and audit logging.
Network security: firewalls, intrusion detection, regular vulnerability scanning, and penetration testing.
Backup and recovery: regular encrypted backups and tested disaster recovery procedures.

6.2 Organisational Measures

(i) documented information security policies and procedures;
(ii) training of staff and contractors handling personal data;
(iii) written confidentiality undertakings from all personnel;
(iv) written data processing agreements with all third-party processors;
(v) incident response and breach notification procedures.

6.3 Hosting and International Transfers

Our primary hosting environment is located within the Republic of Ireland and the European Economic Area. Where we engage processors located outside the EEA or the United Kingdom, we ensure that the transfer is protected by an appropriate safeguard under Article 46 of the GDPR, including:
(i) Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914);
(ii) the UK International Data Transfer Agreement or UK Addendum where applicable;
(iii) a Transfer Impact Assessment to evaluate the legal protections in the recipient country.

We do not transfer personal data made available through the Platform outside the EEA or the United Kingdom for any purpose other than the provision of services in support of the Platform, and only with appropriate safeguards in place.

6.4 Personal Data Breach

In the event of a Personal Data Breach affecting personal data we control, we will notify the Irish Data Protection Commission within 72 hours of becoming aware of the breach where required by Article 33 of the GDPR, and will notify affected Data Subjects where required by Article 34. Clients are required to notify us of any breach affecting personal data obtained via the Platform within 48 hours, in accordance with the Vedi Terms and Conditions.

7. RIGHTS OF THE DATA SUBJECT

We recognise the fundamental rights granted to individuals under the GDPR and the Data Protection Act 2018. Data subjects whose information is processed by the Platform may exercise the following rights:
Right of Access: The right to request a copy of the personal data we hold and information about how it is processed.
Right to Rectification: to have inaccurate personal data corrected. Where the data originates from a public registry made available via our Data Provider, permanent rectification may require correction at the source registry.
Right to Erasure: The right to request the deletion of personal data, subject to exemptions for legal obligations or legitimate interests.
Right to Restriction: The right to request that we limit the processing of data in certain circumstances, such as while the accuracy of the data is being verified.
Right to Object: The right to object to processing based on legitimate interests or for direct marketing purposes.
Right to Data Portability: The right to receive personal data in a structured, commonly used, and machine-readable format.
To exercise these rights, individuals should contact Us at the email address [email protected]

8. MECHANISM OF ACCEPTANCE AND AGREEMENT

8.1 Express Acceptance via Registration

During the Account creation process, and on subsequent logins where this Policy or the Vedi Terms and Conditions have been updated, Clients are required to confirm acceptance of this Policy by clicking an acceptance box (the click-wrap mechanism). This acceptance creates a binding contractual relationship between the Client and Chern & Co.

8.2 Acceptance by Use

By accessing or using any part of the Platform (including limited public-facing pages available without registration), you acknowledge that you have read and understood this Policy. If you do not agree with any part of it, you must immediately cease use of the Platform.

9. COOKIE POLICY

This website uses cookies to support technical performance and security, to monitor usage, and as part of links to third‑party platforms. Please see our Vedi Cookie Policy for details.

10. CONTACT US

Data protection enquiries and rights requests: [email protected]
General correspondence:(mailto:[email protected])* [email protected]
Postal address: Chern & Co Limited, 18 Mallow Street, Limerick, V94 N12Y, Ireland.
Telephone: +353 1 485 4244
If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Irish supervisory authority:

Data Protection Commission
The Data Protection Commission (c/o Data Protection Officer), 6 Pembroke Row, Dublin 2, D02 X963, Ireland.
Website: https://www.dataprotection.ie/en

11. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time, for example to reflect changes in the law, in our services, or in our processing practices. Where changes are material, we will give Clients at least 15 days’ notice on a durable medium in line with the requirements of Regulation (EU) 2019/1150 (the “P2B Regulation”) before the change takes effect, save where a shorter period is required to comply with a legal obligation or to address an imminent security risk.
The current version of this Policy, with the date of last update, will always be available on the Vedi website. We recommend that you review it periodically.