1. Purpose and scope
This public policy describes Veris EHS’s approach to handling client data across EHS, ESG and risk management services. It is a general data policy, not a standalone Data Processing Agreement or an instrument requiring signature.
The signed client agreement, deployment schedule and any agreed Data Processing Agreement set the specific service obligations, responsibilities and processing instructions. Where those documents set different or more specific requirements, they govern the contractual relationship, subject to applicable law.
2. Ownership and responsibilities
Client data remains the client’s property. The client is the data controller for personal data introduced into its environment and is responsible for a lawful basis, accurate information, appropriate notices, authorised users and compliance with local regulatory requirements.
Veris EHS acts as a processor for that personal data, using it to provide the agreed services under documented client instructions. Instructions may be set out in the agreement, the client’s administrative configuration or specific written directions. If an instruction appears unlawful or outside the agreed scope, Veris EHS raises it with the client before proceeding.
3. Data and processing activities
Data may relate to employees, contractors and other personnel who use the platform, are assigned responsibilities or are identified in operational records. Standard personal data includes names, work emails, job titles, departments and supervisory relationships, together with records and logs generated through permitted workflows.
Processing includes storage, retrieval, display, assignment, routing, notification, reporting, export and audit logging. Clients must minimise personal data in forms, attachments and enabled integrations, and agree any sensitive-data or AI-related processing requirements before use.
Client personal data is not sold or used for advertising, unrelated profiling or commercial analytics products.
4. Deployment and data residency
Data residency is agreed at deployment. Veris EHS does not unilaterally change the hosting region. Region changes are planned through a written change request, normally with at least 30 days’ notice, an agreed migration window and a review of legal and operational implications.
- SaaS / hosted: Veris EHS manages the agreed hosting environment and associated service operations.
- Private cloud: a dedicated environment is deployed within the agreed private or sovereign cloud boundary; responsibilities are documented with the client.
- Public cloud: deployment may run in the client’s chosen cloud subscription and region, with account ownership and operational responsibilities agreed in writing.
- On-premises / local: the client controls its infrastructure and network, including any air-gapped environment. Access, updates, backups and deletion responsibilities follow the deployment agreement.
5. Transfers and migration
Clients must assess data localisation rules and lawful transfer mechanisms for each operational region. Veris EHS supports that assessment for processing within its responsibilities and uses protected hosting and encrypted transfer methods.
During a managed region migration, data in transit is encrypted, a verified source backup is maintained until successful migration is confirmed, and integrity is checked before source data is decommissioned. Authorised users may be unable to access the platform during the agreed migration downtime.
6. Protection and access controls
The allocation of controls varies by deployment. Client-managed infrastructure is subject to the responsibilities in the agreed deployment schedule. Material reductions in protection within Veris EHS’s responsibilities are communicated to the client before implementation.
- Encryption in transit using TLS 1.2 or higher and encryption at rest using AES-256 or an equivalent industry-standard method in managed environments.
- Role-based permissions and need-to-know access for authorised personnel.
- Logging of internal access and confidentiality obligations for personnel handling client information.
- Logical separation of client data, regular patching, vulnerability management and security monitoring.
- Incident response procedures, staff security awareness and periodic review of technical and organisational measures.
7. Sub-processors and disclosures
Where needed for hosted services, Veris EHS engages infrastructure sub-processors under written obligations covering confidentiality, security and restricted processing. The applicable list is available to clients on written request.
Intended changes affecting client personal data are notified at least 30 days in advance. Clients may raise data protection objections within 15 days; unresolved objections are handled under the client’s agreement. Approved region changes include a review of associated sub-processors.
Data is not disclosed to client affiliates or other third parties without documented authority, except where required by applicable law. Where permitted, Veris EHS notifies the client before a legally required disclosure.
8. Security incident response
Veris EHS maintains an incident response process for data within its responsibilities. The designated client contact is notified without undue delay, no later than 72 hours after a personal data breach is confirmed. A preliminary notification is made within 24 hours where a breach is reasonably suspected but not confirmed.
Notifications include the known nature and scale of the incident, affected data, likely consequences, contact point and mitigation measures. Information is supplemented as it becomes available. The client determines its reporting duties to authorities and affected individuals, with Veris EHS’s reasonable assistance.
9. Retention, export and deletion
Client administrators set record-level retention during the subscription, taking account of operational and legal requirements. On termination, clients receive an export period of at least 30 days for data held by Veris EHS, in a structured, commonly used, machine-readable format.
Production personal data is permanently deleted within 90 days after the export period ends, unless applicable law requires longer retention. On request, written confirmation is provided within 15 business days after deletion is completed.
Backup copies remain protected and are overwritten on their normal rotation schedule; they are not used for further operational processing after termination. Data that must legally be retained is isolated, protected and deleted when the retention obligation ends. The client is informed of the legal requirement and affected data.
For client-managed cloud or on-premises installations, the client’s agreement determines who performs export, backup rotation and deletion.
10. Rights requests and compliance information
Veris EHS provides reasonable technical assistance for client-led access, correction, deletion, restriction and portability requests. Individuals should send platform-related requests to their employer or the client’s designated data protection contact first.
Clients may request relevant security and processing documentation and submit data protection questionnaires. Assessments and audits are handled under the agreed confidentiality, notice, scope and cost provisions of the client agreement. Information about another client is not disclosed.
11. How to delete your account
You can delete your account at any time from within the app. Open your profile and tap the “Delete account” button. Your account, sign-in details and personal settings are then removed and you are signed out of the app.
Deleting your account does not automatically erase records held by your employer. Records that your organisation is required to keep for safety, audit or regulatory reasons remain under your employer’s control, and data that applicable law requires Veris EHS or your employer to retain is handled under section 9.
If you cannot access the app, or if you need your account deleted for another reason, contact contact@verisehs.ai with the subject “Account Deletion” and we will assist.
12. Governing law, updates and contact
This policy is effective from 1 July 2026 and is governed by UAE law, subject to mandatory data protection requirements in the applicable local regulatory environment. It does not replace a client’s own legal assessment or signed processing terms.
Material changes affecting enterprise clients are notified in writing at least 30 days before taking effect. Data policy questions, sub-processor requests and compliance enquiries can be sent to contact@verisehs.ai with the subject “Privacy / Data Request”.