1. Introduction
eIDAS Pro ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect information when you use our digital identity verification services.
Our service is built on the principles of privacy-by-design and data minimization, in full compliance with the General Data Protection Regulation (GDPR) and the eIDAS Regulation.
2. Data Controller
eIDAS Pro acts as a data processor on behalf of our customers (data controllers) who integrate our verification services into their applications. For direct communications with eIDAS Pro (website visits, support inquiries, consultations), eIDAS Pro is the data controller.
Contact Information: Email: support [at] eidas-pro.com LinkedIn: linkedin.com/company/eidas-pro
3. Information We Process
3.1 Age and Identity Verification
When someone verifies through our service, a merchant starts a verification session and the person completes it with one of these methods:
- Bank identity (iDIN) through IDURA: you sign in with your own bank. Our broker, IDURA, returns to us only whether the age check passed. We receive a technical identifier of your bank login, use it only while the response is checked, and never store it. We never receive your name, address or date of birth.
- EU Digital Identity Wallet: your wallet shares your date of birth from your person identification data. We compare it with the required age in memory and discard it; it is never stored.
We store a verification session (merchant, verification type, method, status, the yes/no result and timestamps) while the verification runs. Sessions expire 15 minutes after they start and are then deleted.
We keep a verification audit record of each result: merchant, session reference, method, outcome, the reason for a refusal, processing duration and, if something failed, the error type and message. It contains no IP address, no browser or device identifier, no identifier of you and no date of birth.
3.2 Technical Data
- Web server logs: our web server records the IP address, browser user agent and requested URL of every request, for security and troubleshooting.
- Rate limiting: to stop abuse we count requests per IP address in one-minute windows; the counters expire after the window.
- Application logs: our application logs record service events and errors; they contain no IP addresses and no identifier of the person verifying.
- Error monitoring: when our software fails we send the error to Sentry. We do not send IP addresses or login credentials to Sentry; an error report may include limited technical context such as the browser type and the page address. On our website and verification pages, a replay of the page is recorded only when an error occurs, with all text and media masked.
- Administrator console: our internal administration console, available only to eIDAS Pro staff over a private network, records sign-in events of its administrators for 90 days and administrative actions (for example suspending a merchant account, granting credit or changing the sanctions list) for 180 days. These records contain the administrator's e-mail address, the action and the affected account, but no IP address or browser information. Where an action concerns a merchant account, the merchant account identifier is stored with it.
3.3 Website and Marketing Data
When you visit our website or contact us, we may process:
- Contact information (name, email, company) you enter in forms
- Anonymous usage statistics through cookieless analytics (Umami); no IP address or cookie identifies you
- Communication data (support requests, consultation notes)
3.4 Customer Account Data
For merchants who use our service we process account credentials, billing information (handled by Stripe; we never see card data) and usage statistics (number of verifications, error rates).
4. Why We Process Data
- Service delivery: performing verifications for merchants and managing their accounts.
- Security: web server logs and rate limiting protect the service from abuse (legitimate interest).
- Proof of service: the verification audit record lets a merchant and us show that a verification took place and what it returned.
- Reliability: error monitoring lets us find and fix failures.
- Partner programme: applying one partner-code discount per company, sharing your company name, plan and amounts paid with the partner who referred you, and paying and accounting for partners (consent, contract and legitimate interest; see section 6.1).
- Communication and legal compliance: answering enquiries, billing, and meeting legal obligations.
5. Retention
| Data | Kept for |
|---|---|
| Verification session | Deleted when it expires, 15 minutes after it starts |
| Date of birth (wallet) and bank login identifier (iDIN) | Not stored |
| Verification audit record | Currently 365 days |
| Web server logs (IP address, user agent, URL) | 14 days |
| Rate-limit counters | One minute |
| Administrator console sign-in events | 90 days |
| Administrator console administrative actions | 180 days |
| Error reports (Sentry) | According to our Sentry plan's retention |
| Backups of our database | At most 30 days. Backups are taken for example before each release and stored access-restricted on our server in Hungary. A deleted record can remain in a backup until that backup expires; backups are used only to recover from failures, never to restore records that were deleted on purpose |
| Customer account data and billing records | Duration of the contract, then 10 years (accounting obligation) |
| Partner and applicant contact and company details, IBAN and payout records | Duration of the partner relationship, then 10 years (accounting obligation) |
| Rejected partner applications | 12 months after the decision |
| Partner applications not yet decided | Until we decide on them; they are not deleted automatically |
| Commission records | 10 years (accounting obligation) |
| Marketing contact data | Until you unsubscribe or ask us to delete it |
The 10-year periods follow from Article 16 of the Luxembourg Commercial Code, which requires accounting records (invoices, payment, commission and payout records) to be kept for 10 years from the end of the financial year they relate to. They apply only to those records; when you close your account, everything else is deleted within 30 days, except verification audit records, which run to their normal 365-day expiry (they contain no identifier of the person verifying). Our Data Retention Policy lists every period and how it is enforced.
6. Recipients
We do not sell personal data. We share it only with:
- IDURA (Idura ApS, Denmark), our identity broker, and Bluem, the iDIN service provider, when you choose bank identity. Both act as independent controllers for the identification they carry out; according to IDURA, the verification passes through IDURA without being stored there. Your bank processes your sign-in as an independent controller.
- Hosting: Macronet (macronet.hu) hosts our servers in Hungary.
- Database: Supabase Pte. Ltd. (Singapore); the database is stored in Frankfurt, Germany.
- Email: Resend (Plus Five Five, Inc., United States), for account, service and newsletter emails; it stores account data and logs in the United States.
- Error monitoring: Sentry (Functional Software, Inc., United States); error reports are stored in Frankfurt, Germany.
- Analytics: Umami, self-hosted by us; cookieless.
- Bot protection: Cloudflare Turnstile (Cloudflare, Inc., United States) checks our website forms and the public demo for automated abuse; it processes your IP address and browser signals during the check. For those signals Cloudflare also acts as an independent controller under its own terms.
- Payments: Stripe (Stripe Payments Europe, Limited, Ireland), for subscription billing.
- Authorities, when the law requires it.
- Partners, as described in section 6.1.
6.1 Partner Programme
- Merchants: if a partner code is used, we share your company name, plan and the amounts you paid with the partner who referred you, for as long as that partner earns a commission on your subscription (at most 12 months). The legal basis is the consent you give when entering the code, and the contract.
- One-company check: we store the VAT and company registration numbers, the shop domain and a card fingerprint provided by Stripe (a token, not card data). These are compared across accounts to apply one discount per company. The legal basis is our legitimate interest in preventing discount abuse.
- Partners and applicants: we keep contact and company details, IBAN and payout records for the partner relationship, and then for 10 years as accounting records. Rejected applications are deleted 12 months after the decision. Applications we have not yet decided on are kept until we decide; they are not deleted automatically.
- Commission records: kept for 10 years (accounting obligation).
7. For API Customers (B2B)
Your Role: DATA CONTROLLER
You are the data controller for any verification results you store in your systems.
What This Means - You Still Need:
- Privacy policy disclosing eIDAS verification use
- Retention policy for verification logs (we recommend 30-90 days)
- Deletion procedures for expired data
- Data subject request handling (access, deletion requests)
- Basic security measures for stored verification results
What You DON'T Need:
- Special category data handling (no biometrics stored)
- Document storage security infrastructure
- Image retention and redaction workflows
8. Your Rights Under GDPR
You have the right to:
- Access: Request a copy of your personal data we hold
- Rectification: Correct inaccurate or incomplete data
- Erasure ("Right to be Forgotten"): Request deletion of your data
- Restriction: Limit how we process your data
- Portability: Receive your data in a machine-readable format
- Object: Opt-out of marketing communications or certain processing activities
- Lodge a Complaint: File a complaint with your national data protection authority
To exercise these rights, contact us at support [at] eidas-pro.com. We will respond within 30 days.
8.1 Withdrawing Your Consent
Where we rely on your consent, for example to share your company details with the partner who referred you, to assess your partner application, or to send you product updates, you can withdraw it at any time. Email support [at] eidas-pro.com with the subject line "Withdraw consent" and say which consent you withdraw; for marketing emails you can also use the unsubscribe link in any message. We then stop the processing that relied on that consent. Withdrawal does not affect the lawfulness of processing carried out before it (Article 7(3) GDPR). Data we must keep on another legal basis, such as accounting records, is kept only for that purpose.
9. Security Measures
- Encrypted transport (TLS) for all connections
- Rate limiting against abuse
- Breach notification to the supervisory authority within 72 hours where required
10. Cookies
- Verification session cookie (
eidas_vs): links your browser to the verification you started; strictly necessary; expires after 15 minutes. - Session and preference cookies on our website and dashboards: keep you signed in and remember settings.
- Analytics: Umami is cookieless.
We use no advertising cookies and no behavioural tracking.
Some imagery on this website, including hero background videos, is AI-generated.
11. International Data Transfers
Our servers and database backups (Hungary), our database (Supabase, stored in Frankfurt, Germany) and our analytics (self-hosted) are in the EU. IDURA (Idura ApS) is established in Denmark. Some providers are established outside the EEA or can access data from outside it:
- Supabase (Supabase Pte. Ltd., Singapore) and its US affiliate can access the database from Singapore and the United States. Safeguard: EU Standard Contractual Clauses (Supabase is not certified under the EU–US Data Privacy Framework).
- Resend (Plus Five Five, Inc.) stores account data and e-mail logs in the United States; e-mails are sent through an EU sending region. Safeguard: EU–US Data Privacy Framework and EU Standard Contractual Clauses.
- Sentry (Functional Software, Inc.) stores error reports in Frankfurt, Germany, and can access them from the United States. Safeguard: EU–US Data Privacy Framework, with EU Standard Contractual Clauses as fallback.
- Stripe contracts with EU customers through Stripe Payments Europe, Limited (Ireland) and transfers data to Stripe, LLC in the United States. Safeguard: EU–US Data Privacy Framework, with EU Standard Contractual Clauses as fallback.
- Cloudflare (Cloudflare, Inc.) runs Turnstile on its global network. Safeguard: EU–US Data Privacy Framework, with EU Standard Contractual Clauses as fallback.
Our Sub-processors page lists every provider, the data it processes and where it stores it.
12. Minors
Age verification exists so that minors can be refused. If a minor tries to verify, the attempt is processed like any other: the result is a refusal, and we store nothing that identifies them.
13. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Significant changes will be communicated via:
- Email notification to registered users
- Prominent notice on our website
- Updated "Last Modified" date at the top of this policy
Continued use of our services after changes constitutes acceptance of the updated policy.
14. Contact Us
For privacy-related questions, requests, or concerns:
Email: support [at] eidas-pro.com Subject Line: Privacy Request - [Your Request Type] Response Time: Within 30 days (as required by GDPR)
For urgent security matters, please use the subject line "URGENT: Security Issue" and we will respond within 24 hours.