Privacy Policy — EU Shield

Who We Are

EU Shield is a brand operated by Veritus s.r.o., Podlesná 91, 044 13 Valaliky, Slovakia, Company ID (IČO): 50256211, registered in the Slovak Commercial Register (“we”, “us”). Veritus s.r.o. is the data controller for all processing described in this Privacy Policy and delivers all services. Contact for all privacy matters: privacy@eushield.eu.

Data We Process When You Become a Client

GDPR Article 27 EU Representative service: your company name, registration number and address; your contact person’s name, role, e-mail and phone; a description of your processing activities and records of processing (ROPA per Article 30 GDPR); and correspondence we receive on your behalf from EU data protection authorities and data subjects.

GPSR Responsible Person service: your company name, registration number and address; your contact person’s details; product identification data (product names, models, batch or serial references); product technical documentation and declarations of conformity you provide to us; and correspondence we receive on your behalf from EU market surveillance authorities and consumers.

We process this data under Article 6(1)(b) GDPR (performance of a contract and pre-contractual steps, including our intake forms) and Article 6(1)(c) GDPR (legal obligations arising from Article 27 GDPR and from Regulation (EU) 2023/988 on general product safety).

Intake Forms

When you complete one of our intake forms, the information you submit is processed to prepare your Representation Agreement or Responsible Person Mandate and to verify your company details. Our intake forms run on Google Forms; Google Ireland Ltd. acts as our data processor for this purpose. If you do not proceed with the service, intake data is deleted within 12 months.

Website Data

When you visit eushield.eu, we collect aggregated visit statistics: pages visited, approximate location derived from IP, browser type and referral source. We use this solely to understand how our website is used, on the basis of our legitimate interest (Article 6(1)(f) GDPR). We do not run remarketing, advertising trackers or cross-site profiling, and we do not sell personal data.

Data Sharing

We share data only as necessary to provide our services: correspondence addressed to you is forwarded to you (our client); EU data protection authorities and market surveillance authorities may receive information where we are legally required to respond or cooperate; and we use data processors for e-mail, hosting, form intake (Google) and document storage, each under a data processing agreement. We do not sell, rent or trade personal data.

International Transfers

Client data is processed within the EU. Where a sub-processor of our service providers is located outside the EU, transfers rely on the safeguards of Chapter V GDPR, such as standard contractual clauses or an applicable adequacy decision.

Data Retention

Client account and correspondence data is retained for the duration of the service plus 3 years after termination, for legal record keeping. Product technical documentation held under the GPSR Responsible Person service is retained for as long as the GPSR requires it to remain available to market surveillance authorities (up to 10 years from the product being placed on the market), or returned to you on termination per your instructions. ROPA records are retained per your instructions or returned to you upon termination. Aggregated website statistics are retained for 12 months.

Data Subject Rights

If you are an individual whose data we process (as a website visitor or as a client’s contact person), you have the right to: access your data (Article 15), rectify inaccurate data (Article 16), erase your data (Article 17), restrict processing (Article 18), data portability (Article 20), and object to processing based on legitimate interest (Article 21). Contact us at privacy@eushield.eu to exercise these rights. You also have the right to lodge a complaint with a supervisory authority; ours is the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).

Security

We implement appropriate technical and organizational measures per Article 32 GDPR: encrypted data transmission (TLS), access controls, regular security reviews, and incident response procedures.

Updates

This Privacy Policy was last updated in July 2026. We will notify clients of material changes via e-mail. Contact us with any questions.