Privacy statement

1. Who we are

TransferGuard is a trade name of PVG Technologies B.V., established in Hoef en Haag, the Netherlands, and registered with the Dutch Chamber of Commerce under number 99645939. You can reach us at info@transferguard.eu. Full company details are on the About us page.

We have not appointed a data protection officer (DPO). For privacy questions, please contact info@transferguard.eu.

2. Our roles

We process personal data in different roles. The role determines whom you should contact.

For our role as processor the data processing agreement applies. A user accepts it when creating an account. TransferGuard is only for businesses and professionals in the European Union; consumers cannot create an account.

3. Website visitors

We do not place advertising, tracking or analytics cookies on the website and do not use third party services for visitor statistics.

• Technical request data. With every visit our server receives your IP address, the requested address, time and browser details. This is needed to show the page and to limit abuse (for example by limiting the number of requests per minute). Legal basis: legitimate interest in a working and secure website (Article 6(1)(f) GDPR). Our web server does not keep a log of all visits. On errors and security events our application writes technical messages, sometimes with an IP address. These stay on our own server and only our administrators can see them. We keep these messages for 30 days.
• Statistics. To see which pages are visited and where visitors come from, we measure visitor statistics with software that runs on our own server. Nothing is sent to third parties and we set no cookies for it. We only measure visits to our public pages, such as the home page, pricing and the blog, and not the pages where you open files or use your account. For each visit we store: the page visited, the referring website (for another site only the domain), time, browser, operating system, device type, screen size, language, and the country, region and city our server derives from your IP address. We do not store your IP address itself. To count visits within a month, the software creates an irreversible hash of your IP address and browser, with a key that changes every month. If your browser sends a 'Do Not Track' signal, we measure nothing. Legal basis: legitimate interest in improving the website (Art. 6(1)(f) GDPR). We keep this data for 25 months.
• Contact. If you send us a message through the contact form or by email, we use your name, email address, your company if you give it, the subject and your message to reply. If you are signed in, we also see which account and office the message belongs to. To limit misuse of the form, we keep an irreversible key value of your IP address, not the address itself. Legal basis: legitimate interest, or performance of a contract if you are a customer. We keep the correspondence for up to 2 years after the last message.

See section 13 for the data the website stores in your browser.

Asking for feedback. If you have a free account, we ask you a few times at most in the first weeks by email what you think of TransferGuard, or what held you back: one day after signing up, after 3 days if you have not sent anything yet, and after 30 days without use. At most one email every 14 days. We use your answer to improve the service. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Every email contains a link to unsubscribe.

Short survey. Sometimes we ask on the website or in the app whether you want to answer three short questions, for example what you are looking for or how likely you are to recommend us. Taking part is voluntary. We keep your answers, any comment, the page, the reason the survey was shown, whether you use a phone or a computer, the language and a random number from your browser. We do not keep an IP address and do not ask for a name or email address. If you are signed in, we link the answers to your account so that we do not ask you again. We keep the answers for 24 months. Legal basis: legitimate interest in improving the service (Article 6(1)(f) GDPR).

4. Users and staff members

As controller we process the following data of users and of staff members of company accounts:

• Account: first name, last name, email address, whether the email address has been confirmed, optionally company name, password (only as a bcrypt hash), language preference and, for a company account, your role and invitations.
• Company account: legal name, optionally the Chamber of Commerce number, display name, its own address (subdomain), logo and brand colour.
• Two-step verification: authenticator app (TOTP) data, passkeys (public key) and recovery codes. Two-step verification is mandatory for every staff member of a company account.
• Sign-in and sessions: time, IP address, user agent, browser, operating system, device type, success or failure, reason for failure and whether two-step verification was used. We do not determine a location: no IP address is sent to a geolocation service and we do not derive a country or city. We read browser, operating system and device type from the user agent on our own server. For active sessions we also keep IP address, user agent and last use. To warn you about a sign in from a new device, we keep per account an irreversible key value (HMAC) of a random code from a cookie in your browser, with browser and operating system without version and the dates of first and last use; it expires after 400 days without use. We keep the sign-in log for 24 months.
• Acceptance: time, IP address and versions of the terms, the data processing agreement and this statement that you accepted when creating your account.
• Usage: per calendar month the number of transfers, the upload volume, the active storage and the identity checks used, to apply the limits of your plan.
• Actions: the log records which user (by internal number) created, sent or revoked a transfer, requested a report or changed a setting.
• Verified sender badge: if you have your own identity checked (free, once per validity period), we keep your name as shown on your identity document, the date of the check, the expiry date of the badge and the status of failed attempts. We do not keep photos, the document number, your date of birth or your citizen service number. Your recipients see the name from your identity document and the month of the check, in the invitation and on the page where they open your files. You read this before the check. You can remove the badge yourself. The report of a transfer shows the date of your check if you had a valid badge when you sent it. The check itself is carried out by our verification partner Didit, as described in section 6.
• Email: service emails (such as a confirmation code, a notice that your files were received, invitations and reminders) and a send log with time, type of email, language, status and the sender's message number, without content.

Purposes and legal bases: providing the service and managing the account (performance of a contract, Article 6(1)(b) GDPR); security, preventing abuse and being able to show who did what (legitimate interest, Article 6(1)(f) GDPR). For the Verified sender badge, see section 7.

5. Subscription and payments

For the Certified Delivery subscription we charge monthly in advance, per company account. For this we process:

• Payment method: customer number and mandate at our payment service provider, type of payment method, brand and the last four digits of the card or a masked account number or email address. We do not receive or store full card details; the payment service provider processes those.
• Billing details: name, address, postcode, city, country, Chamber of Commerce or trade register number and VAT number, with the result of the VAT number check in the European Commission's VIES system (status, date, consultation number and registered name).
• Subscription and payments: your consent to the subscription (who and when), whether the subscription renews automatically, per paid month the start and end date, amount, VAT treatment and payment status, and any free period (such as the launch offer) with its start and end date.

Legal bases: performance of the contract (Article 6(1)(b) GDPR) and the statutory obligation to keep records (Article 6(1)(c) GDPR, Article 52 of the Dutch General Tax Act).

6. Recipients of files

If someone sends you files through TransferGuard, or asks you for files, that sender is the controller. The sender decides how you get access and whether an identity check is needed. TransferGuard processes your data on behalf of the sender. For the reusable identity, the passkey and the Verified badge, further on in this section, we are the controller ourselves, with your consent (see section 2).

What the sender enters

• Your email address, if the sender chooses an email code or an identity check. With access for anyone with the link, the sender enters no data about you.
• Your mobile number, if the sender chooses Email and text message. You then get the link by email and the code by text message on that number. We store the number encrypted and only show it masked (for example +31 6 •••• 12 34).
• For an identity check: your name and optionally your date of birth, to compare them with your identity document. We store the date of birth the sender enters encrypted and erase it after the outcome, or when the transfer is revoked or expires.
• Optionally a short note for you (at most 300 characters, without links or phone numbers). That note is not encrypted in the browser; we show it in the invitation and on the page where you open the files. We erase the note together with the report.

Receiving and downloading files

Files and file names are encrypted in the sender's browser. By default we email you the link and keep the key encrypted on our server until you confirm with the email code or the identity check. If the sender chooses to share the link personally, the key is only in that link and never reaches our server; only that route is end-to-end encrypted. We do not see the content or the names of the files.

We do process: your email address, the times of the steps, the file sizes and a SHA-256 fingerprint per file. When your browser has fully decrypted and checked a file, we keep, encrypted, your IP address and your browser and device type (such as Safari on an iPhone). These details are in the report for the sender.

Delivering files

If a company asks you for files, you confirm your email address with a code and upload the files on a page in that company's branding. Here too the files and file names are encrypted in your browser before they reach our server.

Identity check

If the sender asks for an identity check, you take a photo of your identity document and a selfie in the browser. Our verification partner Didit checks the identity document, whether a live person is in front of the camera (liveness check) and whether your face matches the photo on the document, and analyses device and IP address. Before the check starts you see a consent step that explains what happens and links to this privacy statement. For the purposes for which Didit is itself responsible, Didit's privacy notice applies. You have at most 3 attempts per transfer.

The face match processes biometric data. That is a special category of personal data (Article 9 GDPR). This only happens with your explicit consent (Article 9(2)(a) GDPR). We ask for it on behalf of the sender in the consent step before the check. Without your consent the check does not start; you can then ask the sender to send the files another way.

After a successful check we keep, encrypted: your name, your date of birth, the type of your ID document, the document number and the country of issue, as shown on the document. These details are in the report the sender can download. With the document number, the sender can report fraud to the police. We do not keep your citizen service number (BSN), your nationality or the photos of your document and face. You can also read this before the check. As soon as the final result is in, we have the session at Didit deleted.

Reusable identity and passkey

After a successful check we ask separately whether you want to keep your identity for next time. This is voluntary: without that choice you simply open the current file. If you choose it, we keep your name, your date of birth, the type of your ID document and the country of issue encrypted with your email address for 1 year, and you set up a passkey. We do not keep the document number for this. We do this as controller, with your consent (Art. 6(1)(a) GDPR), because you can use these details with several senders. Your email address is not stored readably there, only as an irreversible key value (HMAC). For the passkey your fingerprint or face stays on your own device; we do not receive it. If you then open a transfer from another sender, that sender sees your name, date of birth, the type of document, the country of issue and the date of your check in the report. You can withdraw your consent at any time: through the link Delete saved identity at the bottom of our emails to you, or on the page where you open files. We then erase the details and your passkeys straight away.

Verified badge for recipients

If your identity check for a transfer succeeds, your email address gets the Verified badge. If another sender later enters your email address, that sender sees the badge and the month of your latest check. That sender does not see your name, date of birth or other details. The badge also appears next to your email address in the sender's list of their own transfers.

If you choose to keep your identity, you can also tick the box Show senders that you are verified. It is unticked by default; without your choice no other sender sees the badge. Later you can also use the Hide badge link at the bottom of our emails to you. That link works without an account and lets you turn the badge back on. We keep whether the badge is on or off and when you changed it. To limit mass lookups of addresses, a sender can look up at most 60 addresses per hour. We show the badge to other senders as controller, based on your consent. You can withdraw it at any time by hiding the badge.

Log and email

Every step is logged with timestamps, without names or email addresses (only internal numbers). Emails to you, such as an invitation or a code, are sent through our email service; the send log only contains a masked email address. A code by text message is sent through the same service. Our own text message log contains no phone number and no code, only the time and whether the message was sent.

7. Purposes and legal bases as controller

Where we rely on legitimate interest, you can object (see section 14). Where you gave consent, you can withdraw it.

8. Automated decision-making

The identity check is automated: the result from our verification partner determines whether you get the files. That is an automated decision within the meaning of Article 22 GDPR. It only takes place with your explicit consent, which you give in the consent step before the check (Article 22(2)(c) GDPR).

If the check is rejected, you can try again, up to 3 times per transfer. If you think the result is wrong, you can ask for a review by a person directly on the page. The sender receives that request, looks at your situation personally and can give you the files another way. So a person always decides on an alternative. You can also contest the result and give your point of view through info@transferguard.eu.

We take no other decision about you. A badge is not a judgement about a person.

9. Recipients and sub-processors

We do not sell personal data. We only share data with parties needed for the service:

For senders, Didit, Hetzner, Cloudflare and Brevo are sub-processors for recipients' data. Sectigo receives no personal data. Mollie is not a sub-processor: Mollie acts as independent controller for payment data and only processes data of the company itself. We create invoices in our bookkeeping at Moneybird and send them to you by email. Moneybird only processes data of paying companies, not of recipients.

According to its own privacy notice, Didit acts as independent controller for a number of its own purposes: security, abuse prevention, the integrity of its service, audit logs, legal obligations, training fraud models and legal claims. We have switched off the use of our verification data for training.

We may disclose data where a law or a competent authority requires it.

10. Data outside the European Economic Area

Our server, database, file storage and backups are in the EU. Data may still reach countries outside the EEA:

• Cloudflare. Files are stored in the R2 EU jurisdiction. Cloudflare, Inc. is a US company and requests to the storage may be handled outside the EU. We therefore promise EU storage, not processing exclusively within the EU. The files and backups we store there are encrypted. Cloudflare is certified under the EU-US Data Privacy Framework; the European Commission's standard contractual clauses also apply.
• Didit. Didit processes in the EU, in Ireland. If Didit engages a sub-processor outside the EEA, the European Commission's 2021 standard contractual clauses apply where required.
• Brevo. Brevo hosts email and text messages in the EU, but Brevo's sub-processors may process data in the United States. The EU-US Data Privacy Framework and standard contractual clauses apply to this.

11. Retention periods

12. Security

Our measures include:

• All connections to the website and the service use TLS.
• Files and file names are encrypted in the browser. With automatic delivery we keep the key encrypted on our server, bound to one transfer, until the recipient confirms; if the sender shares the link personally, the key never reaches our server and the handover is end-to-end encrypted.
• Sensitive data of a transfer (identity check data, the mobile number for a code by text message, IP address and device at receipt, and the stored key) is encrypted on the server with AES-256-GCM. This is server-side encryption, not end-to-end encryption: our systems can decrypt this data to provide the service.
• Two-step verification (authenticator app or passkey) is mandatory for every staff member of a company account and for our administrators.
• Passwords are only stored as bcrypt hashes; after repeated failed sign-ins an account is locked temporarily and the number of requests is limited.
• Company accounts are separated in the application: a staff member only sees transfers of their own company.
• The log is a hash chain that the database only allows to be appended to, with independent RFC 3161 timestamps.
• Our admin screen shows no recipient data; a technical check refuses responses containing such data.

No measure is completely watertight. If you suspect a security issue, please report it to info@transferguard.eu.

13. Cookies and storage in your browser

On our own pages we only use functional cookies and browser storage needed for the service. No consent is required for these. There are no advertising or tracking cookies. Didit's verification window falls outside this; see below.

On the identity check page we load Didit's verification window. In that window Didit sets its own cookies and browser storage: a device ID and a device characteristic to prevent fraud, and for Didit's own purposes also product analytics (PostHog, possibly including a recording of the session and short surveys) and error monitoring (Sentry, also processed in the United States). We have no control over this; Didit is responsible for it. Read more in Didit's privacy statement.

14. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. Where you gave consent, you can withdraw it.

• Has someone sent you files or asked you for files? Please address your request to that sender; they are responsible. If your request reaches us, we forward it to the sender without undue delay and help with handling it. We are responsible ourselves for your reusable identity, passkey and Verified badge; for those, email us. You can also hide the badge yourself through the link in our emails.
• Deleting your account. Sign in, click your name at the bottom left, choose Your account and then Delete account. We then erase your data within 30 days, except invoices and payment records, which we must keep for 7 years.
• In all other cases email info@transferguard.eu. We respond within one month. We may ask you to show who you are, so that we do not give data to the wrong person.

15. Complaints

If you are not satisfied with how we handle your data, please let us know first. You can also lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

16. Changes

We update this statement when the service or the law changes. The date at the top shows the latest version. We inform users by email about important changes.