Privacy & Cookie Policy

1. Introduction

This Privacy Notice describes how Geo Veritas collects, uses, stores, and protects personal data provided by users in connection with its services relating to the registration, verification, and analysis of minerals that are stolen, missing, or subject to provenance due diligence.

Geo Veritas is committed to ensuring the highest level of confidentiality and data security in accordance with the legislation of the United Arab Emirates (Federal Decree-Law No. 45 of 2021 – Personal Data Protection Law) and the principles of transparency, proportionality, and purpose limitation.

2. Data Controller

Geo Veritas FZC
Registered Office: c/o LU.RO.MA, 2nd Floor, Amber Gem Tower – Ajman, UAE
E-mail: privacy@geo-veritas.com

The Controller determines the purposes and means of the processing of personal data.

3. Categories of Data Collected

Geo Veritas may collect and process the following categories of data:

• Identification and contact details (name, surname, email, phone number, institution or company);
• Technical data relating to minerals (photographs, descriptions, provenance, inventory numbers, weights, dimensions);
• Contractual and billing data, where required for the provision of services;
• Navigation data and technical cookies necessary for the correct functioning of the website.

Geo Veritas does not collect sensitive data except where strictly necessary and voluntarily provided by the user for the performance of the service.

4. Purposes of Processing

Personal data is processed for the following purposes:

• Provision of requested services, including registrations, verifications, and certifications;
• Management of contractual and administrative relationships with clients, partners, or institutions;
• Technical or informative communications regarding submitted requests;
• Fulfilment of legal obligations or of requests from competent authorities;
• Protection of the Company’s rights, including the prevention of fraud or improper use of services;
• Statistical or internal research activities in anonymised form.

Data will not be used for marketing purposes without the explicit consent of the data subject.

5. Legal Basis of Processing

Data processing is based on:

• Contractual performance of requested services;
• Explicit consent of the data subject, where required;
• Legal obligations under applicable laws;
• Legitimate interest of the Controller in ensuring the security and integrity of its services.

6. Method of Processing

Data is processed in electronic and/or paper format by authorised personnel using security systems in accordance with international ISO/IEC 27001 standards.

Geo Veritas adopts appropriate measures to prevent loss, alteration, unauthorised access, or disclosure of data.

7. Data Retention

Personal data is stored for the time necessary to fulfil the purposes for which it was collected and in any case no longer than ten (10) years, unless longer retention is required by law.
Upon expiry of this period, data will be permanently deleted or anonymised.

8. Communication and Transfer of Data

Data may be communicated, strictly where necessary, to:

• collaborators, consultants, or institutional partners of Geo Veritas;
• public-security or judicial authorities in cases involving investigations into stolen assets;
• IT and hosting service providers acting as Data Processors.

Data will not be transferred to countries outside the United Arab Emirates unless the destination ensures an adequate level of protection or appropriate safeguards (such as standard contractual clauses) and with the explicit consent of the data subject.

9. Rights of the Data Subject

The user may exercise the following rights at any time:

• Access to their personal data;
• Rectification or updating of inaccurate or incomplete data;
• Erasure (“right to be forgotten”) in cases provided by law;
• Restriction or objection to processing on legitimate grounds;
• Data portability, where technically feasible;
• Withdrawal of consent without affecting the lawfulness of prior processing.

Requests may be submitted to privacy@geo-veritas.org and will be processed within 30 days of receipt.

10. Information Security

Geo Veritas uses physical and digital security systems, two-factor authentication, AES-256 encryption for storage of sensitive data, and periodic backups on servers located in the United Arab Emirates.

11. Cookies and Tracking Tools

The Geo Veritas website uses only technical and functional cookies required for operation of the portal and request forms.
Any analytical or third-party cookies will be activated only with explicit user consent as specified in the dedicated Cookie Policy.

12. Amendments to this Policy

Geo Veritas reserves the right to amend or update this Notice at any time.
Amendments will enter into force on the date of publication on the official website.
Continued use of the services after such date implies acceptance of the updated version.

13. Governing Law and Jurisdiction

This Policy is governed by the laws of the United Arab Emirates.
Any dispute relating to its interpretation or application shall fall under the exclusive jurisdiction of the courts of the registered office of Geo Veritas in the UAE.

Last Update: 05/12/2025
Controller: LUROMA FZC – United Arab Emirates
Privacy Contact: privacy@geo-veritas.org