Privacy Policy

In short

LegitView is a tool for companies: you check a counterparty, their vehicle and their contact address, and we query public sources in the countries we cover on your behalf and put the result into a single report. This Policy explains what we do with your data (Section A) and with the data that appears in a check result (Section B).

Data controller

For data protection matters write to our dedicated address: rodo@legitview.eu. For commercial and technical matters — info@legitview.eu.

The controller has not appointed a Data Protection Officer, because the conditions set out in Article 37(1) GDPR are not met (we are not a public authority, we do not carry out regular and systematic monitoring of individuals on a large scale, and we do not process special categories of data on a large scale). Data protection matters are handled personally by the controller.

Territorial scope

We provide the Service for entities from fourteen countries: Poland, the Czech Republic, Slovakia, Lithuania, Latvia, Estonia, Bulgaria, Romania, France, Serbia, Slovenia, Spain, Italy and Croatia. The scope and depth of the data differ between countries — they depend on what each source makes publicly available.

Serbia is not part of the European Economic Area — see the section “Transfers outside the EEA”.

People appearing in verification reports

If a LegitView report contains the data of a person listed in a public source (for example as a sole trader, a member of a management board, a shareholder, a beneficial owner or a transport manager), we meet our information obligation towards that person under Article 14 GDPR on a separate page:

GDPR Notice — information on processing (Article 14 GDPR)

To exercise your rights (access, rectification, erasure, objection): GDPR request form or rodo@legitview.eu.

Your rights

You have the right to request:

We handle requests without undue delay and in any case within one month (Article 12(3) GDPR), free of charge. Account deletion and a copy of your data are provided on request — there is no separate button in the Application; an e-mail to rodo@legitview.eu or info@legitview.eu is enough.

If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office in Poland (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) and — if you live in another EU country — with the supervisory authority of your habitual residence or place of work (Article 77 GDPR). For Italy this is the Garante per la protezione dei dati personali, for Spain the AEPD, for France the CNIL, for Croatia AZOP, and correspondingly in the remaining countries.

Personal data and privacy

The information below is divided into two sections:

• A Section A – processing of the data of users and of people who contact us
• B Section B – processing of data that appears as a result of a check

A Processing related to the use of the Service

1. Account and provision of the Service

2. Contact, enquiries and demonstrations

We do not run a newsletter, we do not send mass marketing campaigns and we do not display advertising.

3. Visit statistics on legitview.eu (with your consent)

Details, the full list of files and a description of the consent mechanism are in the Cookie Policy.

4. Security and accountability

5. Handling data protection requests and correspondence

6. Claims

B Data processed as part of a check

Where the data comes from

The data in a report comes from publicly available sources in the countries where we provide the Service, and from information supplied to us by the business ordering the check. These are:

• business registers and court registers,
• tax registers and lists, including the EU VAT information exchange system,
• registers of road carriers and registers of transport licences and authorisations,
• registers, lists and announcements concerning insolvency, restructuring and liquidation,
• registers of beneficial owners,
• public vehicle registers and motor insurers’ databases,
• publicly available information about the internet domain and the e-mail address indicated by the ordering party — the domain registry, the domain configuration and the publicly accessible website,
• data provided by the ordering party: the tax or registration identifier of the entity, the registration plate number of the vehicle and trailer, and the counterparty’s e-mail address.

We do not buy data from data brokers, we do not take it from social media, we do not use marketing databases and we do not build our own permanent database about individuals. We retrieve data on demand, at the moment a check is performed.

Categories of data that may appear in a result

• Entity identification data: name, identification and registration numbers, registered address, legal form, date of registration, scope of activity,
• Data of natural persons running a business: first name and surname, business address, dates of commencement, suspension, resumption and removal of the business, nationality, and phone number, e-mail address and website — only where the entrepreneur has disclosed them in the register,
• Data of persons holding functions in the entity: first name and surname, function in the body, scope of representation, type of commercial proxy, number and value of shares, data of liquidators and insolvency administrators,
• Data of partners in entities without legal personality (such as a Polish civil-law partnership): names and identification numbers of the partners,
• Beneficial owner data: first name and surname, nationality, country of residence, date of birth, nature and extent of the holding,
• Data of transport managers: first name and surname, number and type of the certificate of professional competence, date and country of issue, and information about other businesses where the same person holds that function — where the source discloses it,
• Status data: business status and tax status with dates and legal grounds, information about licences, authorisations and certified copies, information about insolvency proceedings,
• Bank account numbers disclosed in tax lists,
• Vehicle data: registration plate number of the vehicle and trailer, information about the existence and period of motor third-party liability insurance, roadworthiness test data, vehicle type — to the extent made available by the register or the insurers’ database of the given country,
• Contact address data: the counterparty’s e-mail address provided by the ordering party, the name and age of the domain, publicly disclosed domain registration data, mail configuration, and the content of the publicly accessible website to the extent needed to compare it with register data.

National identification number (PESEL) — partial form only

On screen, in the PDF report and in the stored snapshot of a check, the PESEL number is masked (for example 6711***40). Masking is performed by our server, before the data is stored and before it is sent to the user’s browser. Reports contain the masked form only.

In extracts from the Polish National Court Register the number is masked by the register itself — only the first digit is disclosed. We pass it on exactly as we receive it and we do not reconstruct the missing digits.

The full number exists in only two places, where removing it would destroy the evidential value of the document: in the raw response of the source stored in the evidence store, and in the original extract from the register of beneficial owners, downloaded from that register’s own server. Both stores have file-system level access restrictions and are deleted after 365 days. We never process identity card numbers or any other identity document numbers.

Evidence package and original documents

Every check is preserved in evidential form: we store the raw responses of the sources together with the source address, the response code, a timestamp and a cryptographic hash of the content. This lets us demonstrate what a source showed at a given moment — and lets you demonstrate it to your auditor or counterparty. On request we also provide original documents produced by the sources’ own servers (for example a court register extract, a beneficial owner extract, or a tax status confirmation).

Legal basis: our legitimate interest in documenting the proper performance of the Service and in defending against claims (Article 6(1)(f) GDPR). Retention: 365 days.

Purposes and legal bases

We do not use the data in Section B for marketing purposes, we do not sell it and we do not share it with anyone for the purpose of building databases.

Legitimate interests assessment

Before we began processing we carried out, and we keep documented, a balancing test for Article 6(1)(f) GDPR, taking into account the European Data Protection Board’s Guidelines 1/2024 on processing based on legitimate interests (version adopted for public consultation on 8 October 2024). Our conclusions: the interest in preventing fraud in business-to-business dealings is legitimate; the processing is necessary, because there is no less intrusive way of checking a counterparty than consulting data that the legislator itself made public; and we limit the scope to information that is already publicly disclosed and to data supplied by the ordering party. The data subject retains the right to object (Article 21 GDPR) — we consider each objection individually and, unless we demonstrate compelling grounds, we stop the processing. We present the documentation of the test to the Polish supervisory authority on request.

Profiling and automated decisions (Article 22 GDPR)

The summary of a check result (data consistency, discrepancies, gaps) is produced by deterministic rules comparing data from independent sources. We do not use machine learning, statistical models or artificial intelligence to assess an entity or a person. We use machine learning models for technical purposes only — to read captcha-type protections on source websites — and they have no influence whatsoever on the verification result.

The result does not constitute a decision based solely on automated processing within the meaning of Article 22(1) GDPR; it is a decision-support tool. The business decision — for example whether to enter into a contract — is always taken by a human on the ordering party’s side, after their own assessment.

Right to human intervention. If you are a person whose data appeared in a report and you believe that the result, a status tile or a specific piece of information is incorrect or has led to a decision unfavourable to you, you may request human review of the result, express your own point of view and contest the result. Channel: rodo@legitview.eu. We apply the standards of Article 22(3) GDPR accordingly, regardless of how our mechanism is legally classified. We are mindful of the judgment of the Court of Justice of the EU of 7 December 2023 in case C-634/21, which is why we advise ordering parties to assess every result themselves.

Data that a source does not disclose remains unavailable to us. Silence from a source is not information that a fact does not exist — we mark it as missing data, not as a negative result.

How long we keep data

Erasure on request is carried out irrespective of the periods above, to the extent that it does not conflict with a legal obligation or with the need to defend claims. Data in a backup is removed when that backup expires.

Data security

We apply technical and organisational measures appropriate to the risk, in line with Article 32 GDPR. The application server and the database run on Hetzner Online GmbH infrastructure in Germany (EEA). The connection to the Application is encrypted (TLS 1.3 with enforced encrypted connections).

Specific measures

• passwords stored only as an irreversible hash (PBKDF2-SHA256, 600,000 iterations, a random salt per account),
• the user session in a cookie inaccessible to scripts, sent only over an encrypted connection, valid for 8 hours, with the ability to invalidate all sessions of an account immediately,
• protection against request forgery (origin checks on every operation that modifies data),
• security headers: Content Security Policy, framing prohibition, enforced encrypted connections, content type checking, browser permissions policy,
• rate limiting — separately for each source and for the GDPR request form,
• mutually authenticated communication (mTLS) with public administration registers wherever the register requires it,
• keys and tokens for external interfaces kept only on the server, in the system configuration; they never reach the browser,
• client API keys stored only as an irreversible hash, with the ability to revoke them,
• separation of permissions within a company account (roles: employee, company administrator),
• the evidence store and the document store with file-system level access restrictions,
• an audit log of every sensitive operation,
• database backups performed daily, with a fixed number of copies retained (3 daily and 4 weekly).

Personal data breach procedure (Articles 33–34 GDPR)

If we establish a personal data breach, we notify the Polish supervisory authority without undue delay and in any case within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the risk is high, we also notify the data subjects. Security incidents can be reported to rodo@legitview.eu.

Internal documentation (Articles 30 and 35 GDPR)

We maintain a record of processing activities in accordance with Article 30 GDPR. We have also carried out — as a precaution, under the accountability principle in Article 5(2) GDPR — a data protection impact assessment, which we update as the Service develops. Both documents are internal and we present them to the supervisory authority on request.

Cybersecurity

The amendment to the Polish National Cybersecurity System Act implementing the NIS2 Directive entered into force on 3 April 2026 (Act of 23 January 2026, Journal of Laws 2026, item 252). At our current scale we are neither an essential nor an important entity within the meaning of that act. Independently of that, we apply proportionate risk management measures modelled on Article 21 NIS2: an incident procedure, backups, an audit log and mutual authentication where required. We reassess our status whenever the scale of the business changes.

Recipients of the data

We entrust data only to providers selected with Article 28 GDPR in mind, with whom we have data processing agreements in place. The list below is the only binding list — the Terms of Service and the Data Processing Agreement refer to it instead of repeating it.

In addition, the recipients of the data are: the user who ordered a given check (who receives the result and the report, and is an independent controller of that data in their own business) and public authorities, to the extent that we are legally obliged to disclose data to them.

Public registers are not our processors. Those registers are operated by the competent public authorities and European Union institutions. We merely query the interfaces and services they make available.

Change of provider. We give at least 30 days’ notice of the addition of a new processor or the replacement of an existing one, either on the website or by e-mail. A client who does not agree to the change may terminate the Agreement before it takes effect.

Cookies and similar technologies

The full list of cookies and data stored in browser memory — separately for the legitview.eu website and for the app.legitview.eu Application — together with categories, lifetimes and a description of the consent mechanism, is in a separate document:

Cookie Policy  —  an annex to this Privacy Policy.

In short: in the Application we use only the files necessary for the account to function and to remember the selected language. On the public website, after your consent, anonymised visit statistics are added. You can withdraw consent at any time using the “Change cookie consent” link in the website footer.

Transfers outside the EEA

The infrastructure in which we process account data, the history of checks, reports and the evidence stores is located exclusively within the European Economic Area — on a server in Germany, with e-mail and domain services operated in Poland. The egress addresses used when querying sources are also within the EEA.

The following transfers take place outside the EEA:

The adequacy decision for transfers to the USA was upheld by the judgment of the General Court of the European Union of 3 September 2025 (case T-553/23), against which an appeal has been lodged and remains pending as at the effective date of this Policy. Should that decision cease to apply, we will switch to self-hosted typefaces and disable visit statistics.

Exercising your rights — how to submit a request

Use the form or write to our dedicated address:

GDPR request form  ·  rodo@legitview.eu

We handle requests without undue delay and in any case within one month (Article 12(3) GDPR). In particularly complex cases we may extend that period by a further two months — we will then inform you of the extension and its reasons within the first month. Handling a request is free of charge. Where we have reasonable doubts as to identity, we may ask for additional information (Article 12(6) GDPR) — only to the extent necessary for identification. We never ask for scans of identity documents.

Changes to this Policy

We may amend this Policy, in particular where the law, the scope of the Service or the list of recipients changes. The current version is always available at this address, and the effective date and version number are shown at the top of the document. We inform registered clients of material changes by e-mail to the address assigned to the Account.