VerifioPrivacy policy
Last updated: 17 September 2026
Verifio helps customers see which webshops they can trust, and helps webshops collect verified reviews and show a representative Trustscore. This policy explains which personal data we process, why, how long we keep it and what your rights are.
It applies to everyone who deals with Verifio: customers who receive a review invitation, people who write or read reviews, visitors of verifio.eu, webshops using the Verifio dashboard, and stores that use the Verifio app for Shopify.
1.Who we are
Verifio is operated by Verifio, a trade name of GMM Van Benten (sole proprietorship), Amsterdam, the Netherlands (Chamber of Commerce 92303846) ("Verifio", "we", "us").
For privacy questions and requests, email privacy@verifio.eu. For everything else: hello@verifio.eu.
2.Our role: controller or processor
Under the GDPR it matters who decides what happens with data. Verifio has two roles:
| Situation | Verifio's role | Who you can contact |
|---|---|---|
| Your Verifio account, reviews you publish, the public Trustscore, visits to verifio.eu, our own emails and billing | Controller | Verifio (privacy@verifio.eu) |
| Customer and order data a webshop shares with us to send review invitations, and data processed in optional tools for that webshop (such as parcel claims, product feeds or customer service analysis) | Processor on behalf of the webshop | The webshop, or Verifio, which forwards your request |
When we act as a processor, the webshop is responsible for having a legal basis and for informing its customers. Our obligations as a processor are set out in the data processing terms in our terms of service.
3.Which data we process and why
We only process the data needed for the purposes below. Per group of people:
| Who | Data | Purpose | Legal basis |
|---|---|---|---|
| Visitors of verifio.eu | IP address and browser details in technical server logs; the cookies described in the cookie policy | Running and securing the website | Legitimate interest |
| Customers invited by a webshop | Name, email address, order reference, order date, order value, country and postal code, payment, delivery and cancellation status | Sending one review invitation per completed order and linking a review to a real order | For the webshop: legitimate interest or contract. For Verifio as processor: the webshop's instructions |
| Customers invited by a webshop | Whether the invitation was opened or clicked, with the email client type, network type and a one-way hash of the IP address | Calculating a representative Trustscore and filtering out automatic opens by security scanners (see section 4) | Legitimate interest in honest, representative scores |
| Reviewers | Review text, rating, display name, date, country, the verified order it belongs to and the email address of your account | Publishing verified reviews, preventing fake reviews, handling reports | Contract (our terms) and legitimate interest |
| Webshop users | Name, email address, role in the team, sign-in details, settings | Providing the dashboard and support | Contract |
| Webshops (business data) | Company name, Chamber of Commerce number, address, website, subscription and invoices | Billing, certification of the webshop and legal obligations | Contract and legal obligation (tax records) |
| People who contact us | Name, email address and the content of your message | Answering your question | Legitimate interest |
We do not ask for and do not want special categories of personal data (such as health data). Please do not include personal details in review texts; see the review guidelines.
4.Email opens and the Trustscore
Most customers never write a review, and people with a bad experience write more often. To prevent a Trustscore that only reflects complaints, Verifio also counts customers who opened the invitation but did not leave a review, at a lower weight. Every invitation email says this briefly and links to the explanation.
- We measure an open with a small image in the email and a click with the link in the email. We do not use this for advertising and do not build profiles.
- Email security scanners open emails automatically. To filter those out we look at the email client type and the type of network. We store the IP address only as a one-way hash with a daily changing key, so it cannot be turned back into an IP address.
- Raw open and click events are deleted after 90 days. Only a per-invitation status (for example "opened") and aggregated numbers without personal data remain.
- Many email apps block images by default. In that case no open is measured, and an unopened invitation is never counted in the Trustscore.
- Every invitation contains an unsubscribe link. After unsubscribing you receive no more review invitations via Verifio.
More detail: verifio.eu/how-it-works
5.Store integrations and the Verifio app for Shopify
A webshop can connect its store to Verifio through the Verifio app for Shopify, a WooCommerce plugin or our API. Through such a connection we receive order data as described in section 3, and product data for the feed manager.
When a store installs the Verifio app for Shopify, Verifio asks for access to products, inventory and orders. From orders we use the customer's name, email address, phone number and shipping and billing address, only to:
- send review invitations after an order is fulfilled, and skip cancelled orders;
- prepare claim documents for lost or damaged parcels, if the webshop uses that tool;
- show product data in the feed manager, if the webshop uses it.
Order details received from Shopify are kept for at most 12 months (see section 10). When a store removes the app, Shopify asks us to erase the store's data; we then delete the customer data of that store within 30 days, unless the law requires us to keep it. Privacy requests from customers that reach us through Shopify are handled in the same way.
6.Optional tools for webshops
Some webshops use additional Verifio tools. In each case Verifio processes the data on behalf of that webshop:
| Tool | What is processed | Purpose |
|---|---|---|
| Parcel claims (lost or damaged parcels) | Order and shipment data, customer name, address, email and phone number, and carrier emails in a mailbox the webshop connects (for example Microsoft 365 or IMAP) | Recognising carrier messages and preparing claim documents such as an invoice or statement of non-receipt |
| Feed manager and marketplaces | Product and stock data; for marketplace orders (such as bol) also the order and delivery details of the customer | Sending products to sales channels and showing marketplace orders |
| Customer service analysis | Tickets from the webshop's own customer service system (such as Zendesk) | Finding recurring issues. Personal details are masked before texts are analysed with AI |
| AI assistants | The question or text the webshop user enters, and product or feed data | Explaining feeds, drafting texts and replies for the webshop |
7.Automated processing
The Trustscore is calculated automatically from verified reviews and invitation outcomes, using a published method. It is a score about a webshop, not about a customer. We also use automatic checks to detect fake reviews and misuse; reports about reviews are assessed by a person.
Verifio does not make automated decisions about customers that have legal or similarly significant effects.
9.Transfers outside the EU
Our main systems run in the EU. Some service providers are based outside the EU. In that case we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses, with additional measures where needed.
10.How long we keep data
| Data | Retention |
|---|---|
| Customer data from orders (name, email, phone, address, order lines) | Deleted or anonymised after 12 months. Counts without personal data remain |
| Raw email open and click events | 90 days |
| Published reviews | As long as the review is online. You can ask us to remove your review at any time |
| Verifio accounts | Until you delete the account or ask us to |
| Parcel claim files | As long as needed to settle the claim and meet legal obligations |
| Invoices and payment records | 7 years (Dutch tax law) |
| Technical logs | Only as long as needed for security and troubleshooting |
| Backups | Encrypted, overwritten after 7 days |
| Data of a webshop after the end of the service, or after removing the Shopify app | Deleted within 30 days, unless the law requires otherwise |
11.How we protect data
- All connections are encrypted (HTTPS/TLS).
- Passwords and keys for connected mailboxes and customer service systems are stored encrypted. Access to Shopify stores uses tokens that expire after an hour and are renewed automatically.
- Access for Verifio staff is limited by role, and access to data of webshops is logged.
- Daily encrypted backups, with tested restores.
- Retention periods are enforced automatically.
- We follow an incident response policy. In case of a data breach we inform affected webshops without undue delay, and the Dutch Data Protection Authority and affected people where required.
12.Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have incorrect data corrected;
- have data deleted, including your reviews and account;
- restrict processing or object to processing based on legitimate interest;
- receive data you provided in a machine-readable format (portability);
- withdraw consent where processing is based on consent;
- file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or the authority in your country.
Send your request to privacy@verifio.eu. We respond within one month. To protect your data we may ask you to confirm that the email address is yours. If the request concerns data we process for a webshop, we forward it to that webshop and help them handle it.
No longer want review invitations? Use the unsubscribe link in any invitation.
13.Children
Verifio is not intended for children under 16. We do not knowingly process data of children under 16 beyond order data a webshop shares with us. If you believe we hold such data, contact privacy@verifio.eu.
15.Changes to this policy
We update this policy when our processing changes. The date at the top shows the latest version. Webshops are informed by email about material changes that affect their customers' data.
16.Contact
Verifio, a trade name of GMM Van Benten (sole proprietorship), Amsterdam, the Netherlands (Chamber of Commerce 92303846). Privacy: privacy@verifio.eu. General: hello@verifio.eu.