Platform & Apps

Privacy Notice for VeriSeal Services

1. Scope and roles

These notes supplement the general Website privacy policyThey concern public product review, VeriSeal mobile apps, the Control Center, optional site features, and ERP integrations. Who is responsible under data protection law depends on the operating model: In the case of customer-specific use, the respective VeriSeal customer regularly decides on the purposes and means of processing; Hawk-TEC then processes the data in accordance with its instructions as a processor. Hawk-TEC is responsible for its own VeriSeal services. Private cloud and on-premise customers can specify their own privacy notices and deletion rules.

2. Product testing and scanning events

During a test, tag, NFC, UHF, QR or barcode identifier, product and label ID, test time, test result, manipulation status, technical device and browser data, IP address and security features such as counter or signature values can be processed. The data is used for authenticity testing, replay and abuse detection, fault analysis, auditability and display of current product information. The legal basis is – depending on the application – Art. 6 (1) (b) or (f) GDPR and, in the case of employee data, the relevant labour law regulations.

3. Optional location analysis

An exact device location is only recorded after explicit, separate approval by the user. Location sharing is disabled by default and can be revoked at any time in the device settings. Without approval, at most a rough country or region information derived technically from the network connection can arise. Location data is used exclusively for the purpose described before approval, for example to detect unusual distribution channels, for stocktaking or for documented on-site inspection. The app can always be used for basic product testing without precise location. The legal basis for the exact location is Art. 6 para. 1 lit. a GDPR.

4. App permissions

NFC wird zum Lesen oder – in einem autorisierten Einrichtungsablauf – zum Schreiben unterstützter NFC-Siegel verwendet. Die Kamera wird nur für QR-, Barcode-, OCR- oder Fotoerfassung genutzt. Standort, Kamera und NFC werden nur im Umfang der jeweils gestarteten Funktion angesprochen. Betriebssysteme können zusätzliche technische Berechtigungsinformationen anzeigen. Nicht freigegebene Berechtigungen werden nicht durch VeriSeal umgangen.

5. User accounts, tenants and security

For the Control Center, name, business contact details, organization, tenant assignment, role, permissions, login times, MFA status, session and security data, and administrative changes can be processed. Audit logs are used for traceability of product, label, user and system settings. Passwords are not stored in plain text. Access is restricted according to the client and assigned according to the principle of the least required authorization.

5a. Security and access logging

To protect accounts, tenants, products and systems, VeriSeal logs authenticated access and security-relevant sign-in events. In particular, the log records the user account, time, functional area accessed, type of access, result status, processing duration, IP address, browser or device information, and a request ID. Passwords, session tokens, form contents and URL query parameters are not included in the access log. The logs are used exclusively for access control, detecting misuse and faults, ensuring traceability, and safeguarding network, information and product security. They are tamper-evidently chained and accessible only to specifically authorised administrators. Depending on the operating model, the legal basis is Article 6(1)(f) GDPR or the legal basis applicable to the respective controller. Retention periods and access permissions are defined in the applicable deletion, authorisation and operating policy.

6. ERP, Odoo and production integration

During an integration, product, article, series, batch, inventory, production, storage, service and status data can be exchanged between VeriSeal and the connected system. Personal data will only be transferred to the extent necessary for the agreed process. Scope, responsibilities, recipients, deletion periods and technical protective measures are defined in the respective customer contract, authorisation concept and, if applicable, in a contract for order processing.

Storage time and deletion

The storage period depends on the purpose, operating model, customer configuration and legal proof or retention obligations. Location data receives a separate, client-related deletion period; the default setting of the location analysis is 30 days, unless a shorter period has been agreed. Account and session data are deleted or blocked after the end of the authorization. Security and audit events can be stored for longer if necessary for product safety, recall, compliance, or to prevent misuse. Before productive operation, the respective person responsible shall determine a binding deletion and storage concept.

8. Recipients and data transfers

Recipients can be the respective VeriSeal customer, its authorized users, Hawk-TEC as operator or processor as well as contractually bound hosting, maintenance and integration service providers. Data is not sold for advertising purposes. Transfers to third countries only take place if this is provided for in the respective operating model and the legal requirements, in particular an adequacy decision or suitable guarantees, are met.

Rights of data subjects and contact

Data subjects have rights to information, correction, deletion, restriction, data portability, objection and revocation of consent in accordance with the legal requirements. In the case of a customer-specific system, you primarily address your request to the organisation that uses VeriSeal. Hawk-TEC supports customers in machining. For our own VeriSeal services, please contact us at info@hawk-tec.de. Complaints may be addressed to the competent data protection supervisory authority.

10. Automated risk alerts

VeriSeal can generate rule-based risk and abuse warnings, for example in the case of repeated, spatially unusual or technically contradictory scans. Such information supports the examination, but without separate configuration does not lead to an exclusively automated decision with legal or comparable significant effect against a person.

11. Status and authoritative version

Last updated: September 2026. The specific processing is further defined for each project, operating model and consent dialogue. The German version is the authoritative legal information; translations are provided to aid understanding.