Information on the processing of personal data

Who this notice is for

If a business has checked its counterparty using LegitView.eu and you appear in a public source as:

• a person running a sole proprietorship,
• a member of a management board, a shareholder, a commercial proxy or another person disclosed in a business register,
• a beneficial owner,
• a transport manager or a person named in another sector register,
• a liquidator, an insolvency administrator or another person disclosed in proceedings concerning the entity,

— then we have processed data about you that is publicly available in that source. In line with Article 14 GDPR we explain below where we obtained it, why and on what basis we process it, for how long, and what rights you have.

If you are our user — that is, you have an account with us — the Privacy Policy applies to you; it describes processing connected with using the Service. This page is for people whose data appeared in a check result.

1. Data controller

The controller has not appointed a Data Protection Officer, because the conditions in Article 37(1) GDPR are not met. All data protection matters are handled personally by the controller — write to rodo@legitview.eu.

2. Where we obtained your data

Exclusively from publicly available sources in the countries where we provide the Service, and from information supplied to us by the business ordering the check. These are:

• business registers and court registers,
• tax registers and lists, including the EU VAT information exchange system,
• registers of road carriers and registers of transport licences and authorisations,
• registers, lists and announcements concerning insolvency, restructuring and liquidation,
• registers of beneficial owners,
• public vehicle registers and motor insurers’ databases,
• publicly available information about the internet domain and the e-mail address indicated by the ordering party — the domain registry, the domain configuration and the publicly accessible website,
• data provided by the ordering party: the tax or registration identifier of the entity, the registration plate number of the vehicle and trailer, and the counterparty’s e-mail address.

We provide the Service for entities from fourteen countries: Poland, the Czech Republic, Slovakia, Lithuania, Latvia, Estonia, Bulgaria, Romania, France, Serbia, Slovenia, Spain, Italy and Croatia. Which sources concern you depends on the country of the entity that was checked.

What we do not do: we do not buy data from data brokers, we do not take it from social media, we do not use marketing databases, and we do not process your image, biometric data, credit history, or data concerning health, opinions or membership of organisations.

3. What data about you we process

Depending on which source you appear in and in what role:

• Identification data: first name and surname, company name, identification and registration numbers of the entity,
• Data about your function: position in a corporate body, scope of representation, type of commercial proxy, number and value of shares, role in an entity without legal personality, function of liquidator or insolvency administrator,
• Business contact data: business or registered address, phone number, e-mail address, website — only where disclosed in the source,
• Beneficial owner data: first name and surname, nationality, country of residence, date of birth, nature and extent of the holding,
• Professional qualification data: transport licence and authorisation numbers, the certificate of professional competence of a transport manager with its date and country of issue, and information about other businesses where the same person holds that function — where the source discloses it,
• Status data: business status and tax status with dates and legal grounds, information about insolvency proceedings,
• Bank account numbers disclosed in tax lists — in the case of a sole proprietorship, also connected with a natural person,
• Vehicle data: registration plate number, information about motor third-party liability insurance and the roadworthiness test, vehicle type — where the register or insurers’ database of the given country makes it available,
• Domain and e-mail address data: the name and age of the domain, publicly disclosed domain registration data, mail configuration, and the content of the publicly accessible website to the extent needed to compare it with register data.

National identification number (PESEL) — partial form only

On screen, in the report and in the stored snapshot of a check, the PESEL number is masked (for example 6711***40). Masking is performed by our server, before the data is stored and before it reaches the browser of the person who ordered the check.

In extracts from the Polish National Court Register the number is masked by the register itself — only the first digit is disclosed. We pass it on exactly in that form and we do not reconstruct the missing digits.

The full number exists in only two places, where removing it would destroy the evidential value of the document: in the raw response of the source stored in the evidence store, and in the original extract from the register of beneficial owners, downloaded from that register’s own server and not modified by us. Both stores have file-system level access restrictions and are deleted after 365 days.

We never process identity card numbers or any other identity document numbers.

4. Why and on what basis

We do not use your data for marketing purposes. We do not sell it, we do not share it with anyone for the purpose of building databases, and we run no marketing on it.

Legitimate interests assessment

Before we began processing we carried out the balancing test required under Article 6(1)(f) GDPR, taking into account the European Data Protection Board’s Guidelines 1/2024 (version adopted for public consultation on 8 October 2024), and we update it as the Service develops. Our conclusions:

• the interest in preventing fraud in business-to-business dealings is legitimate and real,
• the processing is necessary — there is no less intrusive way of checking a counterparty than consulting data that the legislator itself made public,
• we limit the scope to information already publicly disclosed and to data supplied by the ordering party; a person holding a function in a company body or running a business must expect those details to be public,
• the counterweight is your right to object — we consider each objection individually and, unless we demonstrate compelling grounds, we stop the processing.

We keep the documentation of the test and present it to the Polish supervisory authority on request.

5. How long we keep the data

After those periods the data is deleted. Erasure at your request is carried out irrespective of the periods above, to the extent that it does not conflict with a legal obligation or with the defence of claims.

6. Who else sees this data

• The business that ordered the check — receives the result on screen and the report. In its own business it is an independent controller of that data and is itself responsible for what it does with it next.
• Hetzner Online GmbH (Germany) — hosting of the server, the database and the file stores, under a data processing agreement.
• home.pl (Poland) — e-mail and domain, under a data processing agreement; this concerns correspondence only, not the reports themselves.
• Network infrastructure providers (EEA) — links and egress addresses used when querying sources.
• Public authorities — to the extent that we are legally obliged to disclose data to them.

The complete and current list of recipients is in the Privacy Policy, and that list is the only binding one.

Transfers outside the European Economic Area

Your data as a person listed in a source is processed exclusively on servers within the EEA. The egress addresses used when querying sources are also within the EEA.

The only case of data leaving the EEA concerns a check of a Serbian entity: the query containing the entity identifier or a registration plate then goes to a register in Serbia. This is the sending of a query, not the transfer of a data set, and it takes place at the request of the person ordering the check (Article 49(1)(b) and (c) GDPR). Serbia is a party to Convention 108+ and has data protection legislation modelled on the GDPR.

Visit statistics and, formerly, typefaces — the only elements connected with the USA — concerned solely people visiting our public website of their own initiative, never people whose data we retrieve from sources. Since 1 November 2026 we serve typefaces from our own server, so that element has fallen away as well.

7. Your rights

You can exercise them at any time, free of charge:

Deadlines. We reply without undue delay and in any case within one month of receiving the request (Article 12(3) GDPR). In particularly complex cases we may extend that period by a further two months — we will then inform you of the extension and its reasons within the first month.

Identity verification. So as not to disclose data to an unauthorised person (Article 12(6) GDPR), where we have reasonable doubts we may ask for additional information — only to the extent necessary for identification, for example the identification number of the entity you are connected with. We never ask for scans of identity documents.

8. Right to lodge a complaint

If you believe that we process your data unlawfully, you have the right to lodge a complaint with a supervisory authority. The authority competent for us is:

You may also lodge a complaint with the supervisory authority of your habitual residence or place of work (Article 77 GDPR). For the countries where we provide the Service these are, respectively: Úřad pro ochranu osobních údajů (Czech Republic), Úrad na ochranu osobných údajov (Slovakia), Valstybinė duomenų apsaugos inspekcija (Lithuania), Datu valsts inspekcija (Latvia), Andmekaitse Inspektsioon (Estonia), Комисия за защита на личните данни (Bulgaria), ANSPDCP (Romania), CNIL (France), Informacijski pooblaščenec (Slovenia), AEPD (Spain), Garante per la protezione dei dati personali (Italy), AZOP (Croatia). In Serbia the competent authority is the Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti.

9. Automated decisions and the right to human intervention

The summary of a check result — data consistency, discrepancies, gaps — is produced by deterministic rules comparing data from independent sources. We do not use machine learning, statistical models or artificial intelligence for this. We use machine learning models for technical purposes only, to read captcha-type protections on source websites, and they have no influence whatsoever on the result.

We do not take decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22(1) GDPR). A report organises information, but the assessment and the decision — for example whether to enter into a contract — are taken by a human on the side of the business that ordered the check.

We are mindful of the judgment of the Court of Justice of the EU of 7 December 2023 in case C-634/21, according to which a third party’s scoring may be treated as an automated decision where the decision-maker routinely and substantially relies on it. That is why we advise ordering parties to assess every result themselves, and why we grant you the rights below regardless of how our mechanism is legally classified.

A principle we follow: silence from a source is not information that a fact does not exist. We mark missing data as missing data, not as a negative result concerning you.

10. Were you required to provide this data

No — and you did not provide it to us. We obtained it from a public source in which it was disclosed by operation of law. It was the legislator, not us and not you, who decided that this information is public.

If you want to change or remove data at the source, the right route is to contact the operator of that source — it is the operator that decides on the content of the entry. We can only change what we hold on our side.

11. Version history