Privacy Policy

1. Introduction

B2Trust ("we", "us", "our") operates the website b2trust.com – a free business registry search platform that aggregates publicly available company data from official government registries worldwide. This Privacy Policy explains how we collect, use, and protect information when you use our platform.

Data Controller. B2Trust sp. z o.o., with its registered office at Wigury 15, 26-021 Daleszyce, Poland, is the controller of the personal data processed through this platform. You can contact us using the details in Section 14.

2. Information we collect

2.1 Information you provide

• Contact form submissions: When you contact us through our contact form, we collect your name, email address, company name (if provided), and message content.
• Account information: If you create an account, we collect your email address and display name.

2.2 Information collected automatically

• Usage data: We use Google Analytics to collect anonymised usage statistics, including pages visited, search queries performed on our platform, time spent on pages, and referring websites.
• Technical data: Browser type, operating system, device type, approximate (city-level) location, and screen resolution. Where an IP address is processed – for example by Google Analytics to derive coarse geolocation, or by our hosting and error-monitoring providers for security – it is used transiently and we do not retain the raw address in our own systems.
• Report verification lookups: When a report verification link (/verify/…) is opened, we record a SHA-256 hash of the visitor's IP address, whether the verification ID was found, and the time of the lookup. We keep these records for up to 48 hours and use them only to limit automated attempts to guess verification IDs. We do not store the raw IP address; however, a hashed IP address is pseudonymous rather than anonymous – it can be linked back to the original address by an attacker who tries enough candidates – so we treat it as personal data and disclose it here.
• Cookies: We use essential cookies for site functionality and, only with your consent, analytics cookies. See Section 7 for details.

2.3 Information we do NOT collect

• We do not collect payment information – B2Trust is free to use.
• We do not collect sensitive personal data (racial or ethnic origin, political opinions, religious beliefs, health data, etc.).
• We do not require personal identification documents.

3. Company data from public registries

B2Trust aggregates and displays company information sourced from publicly accessible government business registries, including but not limited to ARES (Czech Republic), KRS / Krajowy Rejestr Sądowy (Poland), Brønnøysundregistrene (Norway), Handelsregister (Germany), and VIES / EU VAT Information Exchange System.

This data is public by law and published by the respective government authorities. B2Trust does not collect, store, or process personal data of individuals through these registries – we only display business entity information (company names, registration numbers, addresses, legal forms, registration dates, and business activities) as made available by the official sources.

If any registry data incidentally contains personal data (such as a sole proprietor's name that is part of the company name), this data is processed on the basis of legitimate interest (Article 6(1)(f) GDPR) and is limited to what the government registry has made publicly available.

4. How we use your information

We use collected information to:

• Provide and maintain the B2Trust search platform
• Respond to your enquiries submitted through the contact form
• Analyse usage patterns to improve platform functionality and user experience
• Generate aggregated, non-identifying statistics about platform usage
• Ensure platform security and prevent abuse

We do not:

• Sell your personal data to third parties
• Use your data for targeted advertising
• Create individual user profiles for marketing purposes
• Share your contact information with third parties without your consent

5. Legal basis for processing (GDPR)

• Contact form data – Consent (Article 6(1)(a)): you choose to submit the form.
• Account data – Contract performance (Article 6(1)(b)): necessary to provide the service.
• Analytics data – Consent (Article 6(1)(a)): analytics cookies are set only after you opt in through our cookie banner, as required for non-essential cookies by the ePrivacy Directive (Article 5(3)). You may withdraw your consent at any time.
• Public registry data – Legitimate interest (Article 6(1)(f)): data already made public by government authorities.
• Security and abuse prevention (including report-verification lookups) – Legitimate interest (Article 6(1)(f)): we have a legitimate interest in keeping the platform available and in preventing automated enumeration of verification identifiers.

6. Data sharing and third parties

We share data only with the following processors:

• Netlify, Inc. – hosting and serverless compute for the platform. Privacy policy: https://www.netlify.com/privacy/
• Supabase – database provider; stores account data, platform content, and contact-form submissions. Privacy policy: https://supabase.com/privacy
• Resend, Inc. – transactional email delivery; processes contact details (name, email, message) to deliver our reply notifications. Privacy policy: https://resend.com/legal/privacy-policy
• Google LLC (Google Analytics) – anonymised usage analytics, set only after you consent. Privacy policy: https://policies.google.com/privacy
• Sentry (Functional Software, Inc.) – error and performance telemetry; may process technical data such as IP address and error context. Privacy policy: https://sentry.io/privacy/

We do not sell, rent, or trade your personal information.

7. Cookies

We use two categories of cookies:

• Essential cookies – required for site functionality and session management. They do not require consent and expire at the end of your browser session.
• Analytics cookies (Google Analytics) – set only after you opt in through our cookie banner. They are used for anonymous usage statistics and may be retained for up to 2 years.

Analytics remain disabled until you consent, and you can withdraw consent or change your preferences at any time; the platform functions fully without them. For the full list of cookies, the third parties we share data with, and how to manage your preferences, see our Cookie Policy.

8. Data retention

• Contact form submissions: Retained for up to 12 months, then deleted.
• Account data: Retained for the duration of your account. Deleted within 30 days of an account-deletion request.
• Analytics data: Aggregated, anonymised data is retained indefinitely in aggregate form; individual-level data is retained for up to 14 months (Google Analytics default).
• Public registry data (cache and business identity index): To deliver fast search results, B2Trust maintains a cache of company records retrieved from source registries and a business identity index that grows as searches are performed. This data reflects information already made public by government authorities and is processed on the basis of legitimate interest (Article 6(1)(f); see Section 3). Cached records are refreshed periodically from the source registries; we do not publish historical change-logs of individual registry entries.
• Verifiable report snapshots: When a report PDF is generated, we store a frozen copy of the exact data shown on that document, a SHA-256 fingerprint of it, a verification identifier, and the date of issue. Unlike the cache described above, this copy is deliberately never refreshed or corrected – its sole purpose is to let anyone holding the document confirm what it stated at the moment it was issued. Snapshots are retained for 24 months from the date of issue. After that we erase the stored report content, but keep the verification identifier, the fingerprint, and the date of issue indefinitely, so that a document issued long ago is still recognised as one we issued rather than reported as unknown. We also record how many times a verification link has been opened and when it was last opened.

9. Your rights (GDPR)

If you are located in the European Economic Area, you have the right to:

• Access – request a copy of your personal data
• Rectification – request correction of inaccurate data
• Erasure – request deletion of your personal data
• Restriction – request limitation of processing
• Portability – receive your data in a structured, machine-readable format
• Object – object to processing based on legitimate interest
• Withdraw consent – withdraw consent at any time (for consent-based processing)

To exercise any of these rights, contact us at the email address listed below. We will respond within 30 days.

Note: Rights regarding public registry data are limited, as this data is sourced from government authorities and its publication is governed by the respective national laws.

Note on verifiable reports: A report snapshot (see Section 8) records what a specific document stated on the date it was issued. Because that is its only function, we do not correct or update snapshots – correcting one would destroy the very thing it exists to prove, much as an issued invoice is not rewritten when a detail later changes. If the underlying registry data is wrong or has since changed, the correction belongs at the source registry and will be reflected in current search results and in any newly generated report; the historical snapshot will continue to show what the earlier document said. If you believe a snapshot should nonetheless be restricted or erased, contact us using the details in Section 14 and we will assess the request under Articles 17 and 18.

10. Data security

We implement appropriate technical and organisational measures to protect your data, including encrypted data transmission (HTTPS/TLS), secure hosting infrastructure (Netlify, Supabase), access controls and authentication for administrative functions, and regular security reviews.

11. International data transfers

Some data is processed outside the European Economic Area (EEA) by our service providers:

• Hosting and serverless compute (Netlify, Inc.) – United States
• Analytics (Google LLC) – United States
• Email delivery (Resend, Inc.) – United States
• Database (Supabase) – London, United Kingdom
• Error telemetry (Sentry) – Frankfurt, Germany (within the EEA)

Transfers to the United States are protected by Standard Contractual Clauses (SCCs) approved by the European Commission. Data hosted in the United Kingdom is covered by the European Commission's adequacy decision for the United Kingdom; data hosted in Germany remains within the EEA.

12. Children

B2Trust is a business-oriented platform and is not directed at children. We do not knowingly collect data from anyone under 16. Please note that our Terms of Service separately require users to be at least 18 years old to enter into the agreement – the two thresholds serve different purposes (the data-protection consent age versus contractual capacity).

13. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the platform after changes constitutes acceptance.

14. Contact

For privacy-related enquiries, data access requests, or complaints:

B2Trust sp. z o.o.
Wigury 15, 26-021 Daleszyce, Poland
Email: privacy@b2trust.com
Website: https://b2trust.com/contact

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.