Legal

GDPR & Data Protection

Last updated: May 2026

Our GDPR commitment in plain English

We do not sell your data. We do not use your customers' data. Veyra is a transparent tool — what goes in stays private. The only external service we use is Google Analytics on our marketing website, and that data is anonymous.

1. Our role under GDPR

The GDPR distinguishes between data controllers (who decide why and how data is processed) and data processors (who process data on behalf of controllers).

Veyra acts in both capacities:

  • Controller — for account and billing data of Veyra customers (the companies and agents who sign up)
  • Processor — for chat conversation data that your website visitors generate. You (the Veyra customer) are the controller of that data. We process it only on your behalf, according to your instructions.

2. Legal basis for processing

We process personal data only where we have a lawful basis under Article 6 GDPR:

  • Contract performance — account data is processed to deliver the service you signed up for
  • Legitimate interests — security logs and anonymous analytics to keep the platform safe and improve it
  • Legal obligation — billing records retained as required by Dutch tax law

We do not rely on consent as a legal basis for our own processing, so you will not be pestered with consent pop-ups for the core service.

3. No data selling or sharing

Veyra does not sell, rent, trade, or otherwise share personal data with any third party for commercial purposes — ever. We do not share data with data brokers, advertising networks, or analytics companies beyond the anonymous Google Analytics usage described in our Cookie Policy.

The only third parties that handle any data are essential service providers acting as processors under a data processing agreement: our hosting infrastructure and payment processor (Mollie).

4. Your rights as a data subject

Under GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15)

You can request a copy of all personal data we hold about you.

Right to rectification (Art. 16)

You can request correction of inaccurate or incomplete data.

Right to erasure (Art. 17)

You can request deletion of your data. We will comply within 30 days, subject to any legal retention obligations.

Right to data portability (Art. 20)

You can request your data in a structured, machine-readable format (JSON or CSV).

Right to restriction and objection (Art. 18 & 21)

You can ask us to restrict processing in certain circumstances or object to processing based on legitimate interests.

To exercise any of these rights, contact us at info@veyra.support. We will acknowledge your request within 72 hours and respond fully within 30 days.

5. Data transfers

Veyra stores and processes data within the European Union. We do not transfer personal data to countries outside the EU/EEA unless covered by an adequacy decision or appropriate safeguards (such as Standard Contractual Clauses).

Google Analytics may process anonymised visit data in the United States under Google's standard DPA and Standard Contractual Clauses.

6. Data processing agreement

If your use of Veyra involves processing personal data of EU residents on your behalf (for example, chat conversations with your visitors), you may require a Data Processing Agreement (DPA) as required by GDPR Article 28.

We are happy to provide a signed DPA. Contact us at info@veyra.support to request one.

7. Complaints

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or with the supervisory authority in your country of residence.

We would prefer to resolve any concern directly — please reach out to us first at info@veyra.support.