Privacy Policy

VeraSource is a verified B2B trade directory connecting manufacturers in Sialkot, Pakistan with international buyers. It is built and run by its two founders from Sialkot, Punjab. In legal terms we are the controller of the information described here — the ones who decide what is collected and why, and the ones you hold responsible.

This policy covers verasources.com and the VeraSource platform, whether you are a buyer, a manufacturer, or simply browsing.

Grouped by the reason we hold it. Nothing is collected speculatively — if we cannot name a use, we do not ask for it.

1.1 — Everyone with an account

1.2 — If you are a buyer

1.3 — If you are a manufacturer

1.4 — If you enter someone else's details

You may add a colleague as a contact on your company profile, or name them in a message. When you do, you are responsible for having their permission first — we have no way of asking them ourselves. If someone tells us their details were added without their agreement, we will remove them and let you know.

You will not see a cookie banner here, because there is nothing to consent to. The only cookies we set keep you signed in — the one category that does not require consent under EU and UK rules. We set no advertising, analytics or profiling cookies, so there is no “reject all” to offer.

We run a directory, so some information is meant to be found. This clause covers all three: what we publish, who we pass information to, and what happens when you contact another user.

3.1 — What is public by design

This split is built into the software rather than decided case by case. Manufacturers should read the left column as the deal.

3.2 — When you contact a factory, they become responsible too

When you send an inquiry, the factory receives your name, your business contact details and whatever you write. From that moment they hold it in their own right — they decide what to do with it and they are responsible for it under their own local law. They are not acting for us and we do not control them.

3.3 — Service providers we rely on

They act on our instructions only, under written terms, and may not use your information for their own purposes:

• Hosting and storage — runs the site, the database and document storage.
• Email delivery — sends account and notification emails.
• Security and error monitoring — tells us when something breaks.

3.4 — Links to other websites

Manufacturer listings include company websites, and we link to certification bodies and public registers so you can check a credential at source. Those sites are not ours. What they collect about you is governed by their own privacy policies, not this one, and a link is not an endorsement.

3.5 — Everything else

Beyond the above we disclose information only where the law compels it — a valid court order or lawful request from an authority with jurisdiction over us — or where necessary to investigate fraud or protect someone's safety. We have received no such request to date, and this page will say so for as long as that remains true.

If VeraSource is ever sold or merged, information may transfer to the buyer. We will tell you before that happens, and this policy continues to apply until you are given notice of any change.

• Passwords are stored so nobody at VeraSource can read yours — not staff, not an attacker who obtained our database.
• Changing your password immediately signs out every other session, everywhere.
• Verification documents are held in private storage, reachable only through short-lived links issued to authorised people.
• Uploaded files are scanned before anyone can open them.
• Access is denied by default, so a new feature cannot accidentally expose information that was private.
• Traffic is encrypted in transit and stored information is encrypted at rest.

Most of what we hold is under your direct control, without asking us:

Anything you cannot change yourself, ask us — see clause 10.

We are based in Pakistan, and our servers are operated by international cloud providers. Pakistan has not been granted an adequacy decision by the European Commission, so information about buyers in the EU or UK reaching us is an international transfer under those rules.

Where a safeguard is required, the mechanism is the European Commission's Standard Contractual Clauses, which our infrastructure providers offer as part of their data processing terms. You can ask us for a copy of the relevant terms at any time.

VeraSource is a business-to-business service intended solely for people acting for a business. It is not directed at children, and we do not knowingly collect information from anyone under 18.

You must be at least 18 to hold an account. We do not ask for a date of birth, so we cannot detect a minor from the information we hold — which is precisely why we rely on you telling us.

If you believe someone under 18 has given us information, contact us and we will delete the account and everything associated with it, without asking you to prove anything first.

If you are in the UK, EU or European Economic Area, the GDPR gives you the rights below, and they apply to us because we offer this service to buyers there. We extend the same handling to everyone, wherever you are — running two standards would be harder than running one.

Exercising any of these is free, and we will not treat you differently for it. We may need to confirm who you are first — to stop someone else requesting your information.

8.1 — What survives deletion, and why

• Verification history. The record of which checks a factory passed and when is kept permanently. Buyers relied on it, and it identifies the business rather than you personally.
• Published reviews.A review stays, because a factory’s rating would be misleading if a bad review could be withdrawn by closing an account. On request we detach your name, so the review remains and you do not.

We may also keep limited records where the law requires it, or where we need them to establish or defend a legal claim — but only for as long as that reason lasts.

When we change this page we update the date at the top and add a line to the log below. For a change that materially affects you — a new category of information, a new recipient, a new purpose — we email you before it takes effect, not after.

We keep every previous version and will send you any of them on request, so you can see exactly what applied at the time.

Privacy questions go to the founders directly. There is no ticketing system and no outsourced support desk — the people who built this answer the email.