NOTICE ON THE PROCESSING OF PERSONAL DATA OBTAINED FROM OPEN SOURCES AND THIRD PARTIES
OSINT PRIVACY NOTICE — VERILYZE
Version dated September 11, 2026
1. General Provisions
1.1. This Notice describes how personal data of individuals may be processed where such data is obtained not directly from the data subject, but instead:
- from open sources;
- from publicly accessible Internet resources;
- from Verilyze users and clients;
- from files and documents provided by users;
- through information systems and APIs;
- from other sources where an appropriate lawful basis exists.
1.2. This Notice applies to the websites, software products, and services of Verilyze, including:
https://verilyze.ru;https://demo.verilyze.ru;https://app.verilyze.ru;- other subdomains of
verilyze.ru; - the Verilyze API;
- related analytical services and software components
(collectively, “Verilyze” or the “Service”).
1.3. Verilyze is an information and analytical system intended, among other things, for:
- searching for and analyzing information;
- monitoring the information environment;
- reputation analysis;
- event detection;
- risk analysis;
- identifying relationships between objects;
- publication analysis;
- market and information environment research;
- generating analytical reports;
- processing open-source information;
- performing other analytical tasks.
1.4. Performing such tasks may involve processing information relating to individuals who are not themselves Verilyze users.
2. Operator
2.1. Where the purposes and means of the relevant personal data processing are determined directly by Verilyze, the personal data operator is:
Individual Entrepreneur Denis Anatolyevich Denisov
Taxpayer Identification Number (INN): 525813258650
Primary State Registration Number of Individual Entrepreneur (OGRNIP): 325527500044492
Region of state registration: Russian Federation, Nizhny Novgorod Region
Email for personal data matters: [email protected]
hereinafter referred to as the “Operator”.
2.2. In certain cases, Verilyze may process personal data on behalf of a corporate client.
2.3. If a client independently:
- determines the subject of the research;
- determines the purposes of processing;
- selects the categories of persons to be analyzed;
- provides the source personal data;
- determines the intended use of the resulting output,
such client may act as the personal data operator or controller of the relevant processing, while Verilyze may act as the person processing data on its behalf, depending on applicable law and the actual nature of the relationship.
2.4. In such cases, certain obligations toward the data subject may be fulfilled by the relevant client.
3. Purpose of this Notice
3.1. This Notice is intended to provide transparency regarding the processing of data relating to individuals whose information may be analyzed by Verilyze.
3.2. It explains:
- who may process the data;
- where the data may be obtained from;
- what categories of data may be processed;
- for what purposes the processing is carried out;
- how automated analysis is used;
- to whom the data may be disclosed;
- how long the data may be retained;
- what rights the data subject may have;
- how to contact Verilyze.
3.3. Publication of this Notice is not treated by the Operator as a universal substitute for individual notice to a data subject where applicable law requires that information be provided directly to that person.
3.4. Where the law requires separate notification of a data subject and no applicable exemption is available, the relevant obligation must be fulfilled separately.
4. Sources of Personal Data
4.1. Verilyze may obtain information from different sources depending on the specific analytical task.
4.2. Such sources may include:
4.2.1. Mass Media
Including:
- online media outlets;
- news websites;
- industry publications;
- regional publications;
- news agencies;
- official media publications.
4.2.2. Social Platforms and Public Communities
Including information published in sections available for analysis on:
- social networks;
- public groups;
- communities;
- public pages;
- other social platforms.
4.2.3. Messaging Platforms and Public Channels
Including:
- public Telegram channels;
- public groups;
- open communities;
- other sources accessible without unlawful circumvention of restrictions.
4.2.4. Websites
Including:
- corporate websites;
- personal websites;
- blogs;
- forums;
- organization pages;
- event pages;
- information portals;
- other web resources.
4.2.5. Official Sources
Where a lawful basis exists, sources may include:
- websites of public authorities;
- official publications;
- open government information resources;
- official registers;
- other officially accessible sources.
4.2.6. Verilyze Users
A user or client may provide:
- full name;
- link to a profile;
- link to a publication;
- document;
- spreadsheet;
- text;
- file;
- list of individuals or organizations;
- username;
- other material for analysis.
4.2.7. Third-Party Data Providers
Where permitted by law and the applicable contractual terms, information may be obtained:
- through APIs;
- from information providers;
- from monitoring services;
- from licensed information databases;
- from other information providers.
5. Public Availability of Information
5.1. Verilyze proceeds on the basis that the mere technical availability of information on the Internet does not automatically authorize its unrestricted collection, storage, dissemination, or use for any purpose.
5.2. When determining whether processing is permissible, the following may be taken into account:
- the source of the information;
- the nature of access to the source;
- the category of data;
- the purpose of processing;
- the legitimate interests of the parties;
- the rights and interests of the data subject;
- restrictions applicable to processing;
- applicable law;
- contractual terms governing access to the source;
- other relevant circumstances.
5.3. Verilyze does not treat information as freely distributable solely because it was found on the Internet.
6. Personal Data That May Be Processed
6.1. The categories of data depend on the specific source and analytical task.
6.2. Verilyze may process, in particular:
Identification Information
- surname;
- first name;
- patronymic;
- pseudonym;
- username;
- public profile identifier.
Professional Information
- job title;
- profession;
- place of employment;
- organization;
- information about professional activities;
- publicly stated business biography;
- professional relationships.
Public Contact Information
Where a lawful basis exists:
- professional email address;
- publicly listed business telephone number;
- links to public profiles;
- official page address.
Publications and Information Activity
- authorship of publications;
- texts of public messages;
- comments;
- quotations;
- mentions;
- participation in public discussions;
- information concerning publications associated with the data subject.
Event-Related Information
- participation in publicly described events;
- mentions in connection with an organization or event;
- dates and context of public events;
- professional appointments and job changes;
- other event-related information.
Relationships
Verilyze may analyze publicly identifiable or inferred relationships between:
- individuals;
- organizations;
- events;
- publications;
- information sources.
6.3. Identification of a relationship does not by itself confirm that a legally, financially, or factually established relationship exists.
7. Derived and Analytical Data
7.1. Based on source information, Verilyze may generate new analytical information.
7.2. This may include:
- publication classification;
- sentiment assessment;
- thematic classification;
- entity identification;
- consolidation of mentions relating to the same object;
- identification of information events;
- inferred relationships;
- information activity indicators;
- reputation indicators;
- risk assessments;
- signals;
- anomaly indicators;
- forecasts;
- analytical summaries;
- other outputs generated by models and algorithms.
7.3. Where such a result relates to an identified or identifiable individual, the result may itself be treated as information relating to that person under applicable law.
8. Purposes of Processing
8.1. Depending on the specific scenario, personal data may be processed for:
- monitoring the information environment;
- identifying publications and mentions;
- reputation research;
- analyzing the public information environment;
- risk analysis;
- identifying significant events;
- identifying relationships between objects;
- conducting corporate research;
- verification and analysis of available information;
- market research;
- preparing analytical reports;
- performing monitoring requested by a client;
- analyzing sources and publications;
- information security purposes;
- performing other lawful analytical tasks.
8.2. Verilyze must not use collected data for purposes incompatible with the original lawful purpose of processing unless an appropriate lawful basis exists.
9. Lawful Bases for Processing
9.1. The specific lawful basis is determined separately for each type of processing, taking into account:
- the category of personal data;
- the source;
- the purpose of processing;
- the location of the data subject;
- the role of Verilyze;
- the role of the client;
- other relevant circumstances.
9.2. Depending on applicable law, lawful bases may include, in particular:
- consent of the data subject;
- compliance with legal requirements;
- performance of a contract;
- legitimate interests of the Operator or a third party where such basis is permitted by applicable law;
- processing on behalf of a client where the client has an appropriate lawful basis;
- other grounds expressly permitted by law.
9.3. The availability of data in an open source is not itself treated as a universal lawful basis for any subsequent processing.
10. Client Analytical Tasks
10.1. A corporate client may independently provide Verilyze with:
- personal data;
- links;
- documents;
- lists of individuals;
- other materials
and request that such information be processed.
10.2. The Client must independently ensure that there is a lawful basis for:
- obtaining the data;
- storing it;
- transferring it to Verilyze;
- assigning the relevant analytical task;
- subsequently using the Results.
10.3. Verilyze may refuse to perform a Task where there are reasonable grounds to believe that:
- the Task is unlawful;
- the data was obtained unlawfully;
- the Task is intended to violate human rights;
- the Task involves unlawful surveillance or harassment;
- the processing creates an unacceptable risk of violating applicable law.
11. Special Categories of Personal Data
11.1. Verilyze is not intended for the targeted collection or profiling of individuals on the basis of special categories of personal data.
11.2. Such information may include, in particular, data concerning:
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- health;
- intimate life;
as well as other categories subject to a special processing regime under applicable law.
11.3. Such information may incidentally appear:
- in a media publication;
- in a message from an open source;
- in a document provided by a client;
- in other analyzed materials.
11.4. Further processing of such information is permitted only where an applicable special lawful basis exists.
11.5. If no such basis exists, the information should be excluded from processing, restricted, or deleted to the extent technically and legally possible.
11.6. Special categories of data must not be used by Verilyze as an independent basis for discrimination or legally significant decision-making concerning an individual.
12. Information Concerning Criminal Convictions and Offences
12.1. The information environment may contain publications concerning:
- court proceedings;
- criminal cases;
- administrative proceedings;
- allegations;
- investigations;
- alleged violations of law.
12.2. Verilyze must not automatically interpret a publication, allegation, media report, or other informational material as proof of a person’s guilt.
12.3. Processing information concerning criminal convictions and other data subject to a special legal regime is permitted only in cases and in the manner allowed by applicable law.
13. Minors
13.1. Verilyze is not intended for targeted profiling of minors.
13.2. Information about a minor may incidentally appear in an open source or User Material.
13.3. Where such processing is identified, the Operator may restrict or discontinue it if there is no sufficient lawful necessity and basis for continued processing.
14. Artificial Intelligence and Automated Analysis
14.1. To analyze information, Verilyze uses:
- artificial intelligence models;
- machine learning models;
- natural language processing systems;
- statistical algorithms;
- other automated methods.
14.2. Such technologies may automatically:
- classify information;
- match entities;
- identify relationships;
- analyze sentiment;
- generate summaries;
- identify potential risks;
- identify events;
- generate forecasts.
14.3. Automated models are probabilistic in nature and may make errors.
14.4. Results may be:
- inaccurate;
- incomplete;
- incorrectly interpreted;
- outdated;
- based on an inaccurate source publication;
- incorrectly attributed to a particular individual.
14.5. The presence of an analytical indicator, risk assessment, relationship, rating, or other conclusion does not mean that the relevant conclusion is an established fact.
15. Risk of Misidentification
15.1. Automated analysis may create a risk of combining information relating to different individuals who have:
- identical names;
- similar names;
- identical usernames;
- similar professional characteristics;
- other matching characteristics.
15.2. The Operator seeks to use additional indicators to reduce the risk of misidentification.
15.3. However, it is not technically possible to eliminate this risk completely.
15.4. A data subject may contact the Operator if they believe that information relating to them:
- has been incorrectly combined with information about another person;
- contains inaccuracies;
- has been incorrectly interpreted;
- does not relate to them.
16. Advisory Nature of Analytical Results
16.1. Reputation indicators, risk assessments, forecasts, relationships, events, and other Verilyze conclusions are informational and analytical in nature.
16.2. They are not, by themselves:
- proof of a violation of law;
- proof of guilt;
- an official conclusion;
- a legal opinion;
- a forensic examination;
- an employment assessment;
- a medical opinion;
- a final assessment of trustworthiness.
16.3. Material conclusions should be verified against primary sources and reviewed by a human.
17. Legally Significant Decisions
17.1. The Operator does not use Verilyze to make decisions based solely on automated processing where such decisions themselves produce legal effects concerning an individual or otherwise directly and significantly affect that person’s rights, unless a separate lawful basis exists.
17.2. Clients should likewise not use an automated Verilyze indicator as the sole basis for a legally significant decision concerning an individual where such use is prohibited by applicable law.
17.3. Material decisions should include appropriate human review.
18. No Model Training on Client Materials
18.1. Verilyze does not use files, documents, texts, links, or personal data contained in them that are provided by clients to train its own artificial intelligence or machine learning models.
18.2. Such materials are not used for independent fine-tuning of third-party models for purposes unrelated to the Client’s Task.
18.3. Anonymized and aggregated statistical information may be used to improve the technical operation of the Service.
19. Recipients of Data
19.1. Depending on the nature of the processing, access to personal data may be provided to:
- the relevant Verilyze Client;
- authorized users of the Client’s Organization;
- the Operator;
- persons necessary for technical operation of the Service;
- server infrastructure providers;
- other processors lawfully engaged in the processing.
19.2. Verilyze does not make personal data available to an indefinite number of persons solely because the information was obtained from an open source.
19.3. Access to Results may be restricted by:
- specific User;
- Organization;
- role;
- project;
- case;
- other access settings.
20. Publication of Analytical Results
20.1. By default, a restricted analytical Result created for a particular Client does not become public merely because it was generated by Verilyze.
20.2. Whether a report or individual Result may be made publicly available depends on:
- Service settings;
- actions taken by the User;
- the applicable agreement;
- the nature of the source information;
- applicable law.
20.3. Public dissemination of personal data is carried out only where an appropriate lawful basis exists.
21. Retention Periods
21.1. Personal data is retained no longer than necessary for the relevant processing purpose unless a longer period is required by law or contract.
21.2. The retention period may depend on:
- the duration of monitoring;
- the duration of the Client project;
- the nature of the analytical Task;
- Client requirements;
- the need to update information;
- mandatory legal requirements.
21.3. Materials provided by a Client for a one-time Task may be retained until:
- completion of the Task;
- expiry of the period specified in the contract;
- deletion by the Client;
- another basis for deletion arises.
21.4. Following deletion, certain technical copies may remain temporarily in backups until scheduled overwrite.
21.5. Outdated information may be:
- updated;
- marked as outdated;
- restricted from further use;
- deleted,
depending on the nature of the information and purpose of processing.
22. Updating Information
22.1. Information contained in open sources may:
- change;
- be deleted;
- be supplemented;
- be refuted;
- become outdated.
22.2. Verilyze cannot guarantee immediate reflection of every change made to a source.
22.3. If a material inaccuracy is identified, the Operator may:
- update the information;
- correct the Result;
- remove an incorrect relationship;
- add information concerning a correction or refutation;
- restrict further use of the data;
- take other reasonable measures.
23. Rights of the Data Subject
23.1. Subject to applicable law, a data subject may contact the Operator regarding the processing of personal data relating to them.
23.2. In particular, the data subject may have the right to:
- find out whether their data is being processed;
- obtain information about the processing;
- obtain information about the source of the data where provided by law;
- obtain a list of processed data;
- request correction of inaccurate data;
- request correction of incorrectly matched information;
- request blocking of data;
- request deletion where a lawful basis exists;
- object to certain types of processing;
- request restriction of processing where provided by law;
- withdraw previously provided consent;
- lodge a complaint with a competent supervisory authority;
- protect their rights by other means provided by law.
23.3. Whether a particular right applies and how it may be exercised depends on applicable law and the lawful basis for the relevant processing.
24. Objection to Processing
24.1. A data subject may notify the Operator that they object to processing of personal data relating to them.
24.2. The Operator considers such an objection taking into account:
- the lawful basis for processing;
- the purpose;
- the category of information;
- the rights of the data subject;
- the rights of other persons;
- the legitimate interests of the parties;
- mandatory legal requirements.
24.3. Receipt of an objection does not automatically require deletion of the information in every case where an independent lawful basis for continued processing exists.
25. Correction of Information
25.1. If a data subject believes that information in Verilyze:
- is inaccurate;
- is outdated;
- relates to another person;
- has been taken out of context;
- contains an incorrectly identified relationship,
the data subject may contact the Operator.
25.2. To facilitate review, it is recommended to provide:
- full name;
- a description of the disputed information;
- a link or other identifier of the Result;
- correct information;
- a source supporting the correction, where available.
25.3. The Operator may verify the information against available sources.
26. Deletion of Information
26.1. A data subject may request deletion of personal data in cases provided by applicable law.
26.2. When considering such a request, the following may be taken into account:
- the lawful basis for processing;
- whether the data is needed for an active Client Task;
- legal obligations;
- the need to establish, exercise, or defend legal claims;
- public interest, where applicable;
- other lawful grounds for retention.
26.3. If there is no lawful basis for continued processing, the relevant data is subject to deletion or other treatment required by law.
27. How to Submit a Request
27.1. Data subject requests may be sent to:
27.2. It is recommended to use the following subject line:
“Personal Data / OSINT”
27.3. To help locate the relevant information, it is recommended to provide:
- full name;
- link to the relevant page or report, if known;
- description of the data;
- nature of the request.
27.4. Users should not send a copy of a passport or another document containing excessive personal data unless the Operator separately requests additional verification.
27.5. Where there are reasonable doubts regarding the identity of the applicant, the Operator may request additional information limited to what is necessary to prevent unauthorized disclosure or deletion of another person’s data.
28. Timeframe for Handling Requests
28.1. Requests are handled within the periods established by applicable law.
28.2. If additional verification is required, the Operator acts within the procedures and time limits permitted by law.
29. Information Obtained from a Client
29.1. If disputed personal data was provided by a corporate Client and Verilyze processes such data solely on the Client’s behalf, the Operator may:
- forward the relevant request to the Client;
- provide the data subject with information necessary to contact the Client;
- fulfill the request jointly with the Client;
- take other actions permitted by contract and law.
29.2. Verilyze does not use its status as a processor acting on behalf of a Client as a basis for ignoring data subject requests.
30. Individual Notice
30.1. Where personal data is obtained other than directly from the data subject and applicable law requires the data subject to be individually informed about the processing, the Operator or the relevant Client ensures that such obligation is fulfilled.
30.2. The determination of whether individual notice is required takes into account the grounds and exemptions provided by applicable law.
30.3. This public Notice may serve as an additional source of detailed information but does not replace mandatory individual notification where such notification is required by law.
31. Processing for Research Purposes
31.1. Certain analytical operations may be carried out for statistical or research purposes.
31.2. In such cases, the Operator seeks to:
- minimize the amount of identifying information;
- use aggregation;
- use anonymization where applicable;
- avoid creating unjustified risks to the rights and interests of data subjects.
31.3. Any exemptions provided by applicable law are assessed in relation to the specific processing and are not presumed to apply automatically.
32. International Users and GDPR
32.1. Where the GDPR or similar foreign legislation applies to specific processing, the Operator takes into account the additional requirements of such law.
32.2. For data obtained other than directly from the data subject, additional information may be provided, including:
- details of the controller;
- purposes of processing;
- lawful basis;
- categories of data;
- categories of recipients;
- source of the data;
- retention periods or criteria for determining them;
- data subject rights;
- information about international transfers;
- information about automated processing where required.
32.3. Where processing is based on legitimate interests and applicable law grants the data subject a right to object, the data subject may exercise that right by contacting the Operator.
33. Cross-Border Transfers
33.1. The primary database containing Verilyze users’ personal data is located in the Russian Federation.
33.2. The use of certain foreign infrastructure providers may, in some cases, involve cross-border transfer of certain data.
33.3. Such transfers are carried out only where an appropriate lawful basis exists and applicable legal requirements are satisfied.
34. Security
34.1. The Operator takes legal, organizational, and technical measures to protect personal data.
34.2. Depending on the nature of the system, such measures may include:
- access controls;
- authentication;
- role management;
- encryption of network traffic;
- logging;
- backups;
- infrastructure protection measures;
- monitoring of suspicious activity;
- restricted administrative access;
- other necessary measures.
35. Distribution and Sale of Data
35.1. Verilyze does not sell personal data of individuals as a standalone product.
35.2. Commercial provision of an analytical service or report to a Client does not automatically create a right to freely distribute personal data contained in the underlying source materials.
35.3. Dissemination of personal data is carried out only where an appropriate lawful basis exists.
36. Changes to this Notice
36.1. The Operator may update this Notice due to:
- changes in legislation;
- development of Verilyze;
- introduction of new sources;
- changes in processing methods;
- changes in technologies used;
- clarification of processing practices.
36.2. The current version is published on the Verilyze website.
36.3. Amendment of this Notice does not by itself create a new lawful basis for processing where applicable law requires separate consent or another lawful basis for the relevant processing.
37. Relationship with Other Documents
37.1. This Notice applies together with:
- the Verilyze Personal Data Processing Policy;
- the Verilyze Terms of Use;
- the Consent to Personal Data Processing;
- the Cookie and Similar Technologies Policy;
- agreements with Clients;
- personal data processing instructions;
- other applicable documents.
37.2. This Notice primarily applies to individuals whose information Verilyze obtains not directly from those individuals themselves.
38. Contact Information
For questions concerning personal data obtained from open sources or third parties, including requests to verify, correct, or delete information:
Individual Entrepreneur Denis Anatolyevich Denisov
Taxpayer Identification Number (INN): 525813258650
Primary State Registration Number of Individual Entrepreneur (OGRNIP): 325527500044492
Russian Federation, Nizhny Novgorod Region
Recommended email subject:
“Personal Data / OSINT”
Document: Notice on the Processing of Personal Data Obtained from Open Sources and Third Parties / OSINT Privacy Notice
Version: 1.0
Revision date: September 11, 2026
Operator: Individual Entrepreneur Denis Anatolyevich Denisov