Privacy notice

This notice covers personal data about you, as somebody who visits or writes to monivero.com. Six things on this website involve personal data, and all six are set out in section 3.

• The launch waitlist on the home page.
• The free-report enquiry form.
• Email you send to hello@monivero.com.
• Measurement of how the website itself is performing.
• The check that stops the forms being flooded.
• The free company check on /lustration and on the pages that embed it.

It does not cover the people who appear inside a report Monivero prepares for a business — company directors, beneficial owners and sole traders who never visited this website. They are owed information too, and section 12 says what we can tell them today and what we cannot yet. The free company check is different: for it we are the controller, and section 12 also says what it does with anybody else’s data.

Monivero is a product of Tolaron s.r.o. That company is the controller of the personal data described here, and it is the company to write to about any of it.

Monivero has been built and run under the Tolaron name from the start. Tolaron s.r.o. became a registered company on 8 September 2026 and is named as the controller here from that date; until then this notice named AtletiLabs Europe s.r.o. (IČO 24381977). If you gave us personal data before 8 September 2026, write to the address above with any question about it.

We have not appointed a data protection officer. Questions about this notice, and requests about your own data, go to the address above and are read by a person.

Six things on this website involve personal data. Here is each one, in full.

The enquiry form asks for a company identification number. In Czechia the same kind of number is also issued to sole traders — a natural person in business under their own name. So if the number you enter is a sole trader's, you have handed us personal data about somebody who is not you.

What happens to it is exactly what happens to a company's number: nothing automatic. It arrives in our mailbox and a person reads it. No register is searched and no list is checked when the form is submitted.

The free company check works differently: it asks the public registers as soon as you run it. If the number belongs to a natural person — a sole trader, for example — the check stops there. Nobody is compared with any list, the page shows only that the check covers companies, and we keep nothing about that person from it.

If you are that person, section 12 is written for you.

No. Nothing on this website is required of you by law or by any contract, and you can read every page without giving us anything at all. If you leave the waitlist form empty we cannot tell you when we launch; if you leave the enquiry form empty we cannot send you a report. Those are the only consequences, and there are no others.

This website sets one cookie.

The free company check uses Cloudflare Turnstile to tell people from automated programs. It runs in your browser while the check’s form is on the page, and the check you ask for does not work without it. Monivero sets no cookie for it: Turnstile hands the form a single-use token, which our server confirms with Cloudflare. Any cookies Cloudflare itself uses for its challenge services are described in Cloudflare’s cookie policy.

There are no advertising cookies, no tracking cookies and no analytics cookies. Nothing here is shared with an advertising network. Signing in to the Monivero application would set a session cookie, but account sign-in is not open on this website today.

The companies that run this website, and the companies on our mail path. Vercel, Supabase, Resend and Railway process personal data on our instructions and for no purpose of their own. So does Cloudflare when it forwards our mail and when it protects the free company check; in addition, it uses the same Turnstile signals, as a controller in its own right, to improve its detection of automated programs. Its Turnstile privacy addendum describes that use, and questions about it go to Cloudflare. For Google, on our mail path, we are still establishing the contractual footing and where it is established; section 8 says exactly where that stands, and we would rather tell you that than write something tidier we have not checked.

That is the list. We do not sell personal data and we do not share it for anybody else's marketing. No advertising network, no data broker, and no analytics company other than the one named above receives anything from this website.

The database that holds the waitlist and the free company check sits in Ireland, and the server that runs the check sits in Railway’s European region. Vercel, Resend, Railway and Cloudflare are established in the United States and Supabase in Singapore, so some of the processing they do happens outside the EEA. For Google, on our mail path, we have not yet established where it is established, and we are not going to guess: section 7 names it and this section says what is still open.

For Vercel, Supabase and Resend the safeguard is the European Commission's standard contractual clauses, which form part of that provider's own data processing terms and take effect when the service agreement is entered into. We read those providers' published terms on 22 August 2026 to confirm this. For Cloudflare the safeguard is the EU–U.S. Data Privacy Framework, under which Cloudflare states it is certified, with the standard contractual clauses as the fallback its data processing terms provide; those terms form part of its service agreement. For Railway the safeguard is the Data Privacy Framework, under which Railway states it is certified; its data processing addendum, signed by both parties on 23 September 2026, adds the standard contractual clauses. We read Cloudflare’s and Railway’s published terms on 22 September 2026. For Google, on our mail path, we have not yet established the contracting entity, the safeguard, or whether a data processing agreement is in place at all. That work is in hand, and until it is done this section says so rather than implying a safeguard we have not checked. Write to hello@monivero.com and we will point you to the current version of any of them, or tell you where the outstanding items stand.

Nothing you submit on this website is used to evaluate you, and none of the flows in section 3 involves automated decision-making of the kind Article 22 GDPR is about. The free company check applies fixed rules to what the registers say about the company and compares the company’s name with sanctions lists — only with entries that are not people. That concerns the company, not you, and not the people who run it: nobody in the company’s bodies is compared with any list. A similar name is recorded as a candidate, which is not an identification. No score is shown on the free check.

The GDPR gives you the following rights over your personal data. They apply to everything in this notice, and they apply whether or not you are a customer.

Access

Ask what we hold about you, and get a copy of it.

Rectification

Have anything inaccurate corrected.

Erasure

Have it deleted. For the waitlist this is immediate and unconditional — ask, and the entry goes.

Restriction of processing

Have us stop using it while something about it is being resolved.

Objection

Object to any processing we base on legitimate interest. That is the measurement, the protection against automated and flooding use, the free company check, and our handling of your correspondence.

Portability

Receive the data you gave us in a structured, machine-readable form.

Withdrawing consent

Where we rely on your consent — the waitlist — take it back at any time. Doing so does not make what happened before it unlawful.

Complaint

Complain to a data protection authority. Section 11 has the details.

To use any of them, write to hello@monivero.com. You do not have to give a reason and there is no charge. We answer within one month of receiving the request; if it turns out to be complicated we may take up to two further months, and we will tell you inside the first month if that happens.

We may ask you to confirm which email address a request concerns, so that we do not hand your data to somebody else.

If you think we have handled your personal data wrongly we would rather you told us first, but you are under no obligation to. You can go straight to a data protection authority, and nothing in this notice limits that right.

You may also complain to the supervisory authority of the EU country where you live, where you work, or where you think the problem happened.

Monivero's product looks companies up for businesses that have their own legal duties to check who they are dealing with. A report can name the company's current directors and other officers, with dates of birth, and can record whether those names produced any candidate match against sanctions and politically-exposed-person lists. Those people did not visit this website and gave us nothing. This section is for them.

Where the data comes from

From the Czech public registers — principally ARES, the commercial register, the insolvency register and the VAT register — and from sanctions and politically-exposed-person lists published by public bodies. Nothing is collected from the person concerned, and nothing is bought from a data broker.

Why it is processed

Because a business asked for a check on a company, and in most cases because that business has a legal duty of its own to carry one out. Monivero prepares the material; the business decides what to do with it. Monivero makes no decision about anybody.

What we cannot tell you yet, and why we are not guessing

For reports we prepare for a business, a complete notice has to say who the controller is. Whether that is Monivero, or the business that asked for the report with Monivero acting on its instructions, is a question we are putting to external counsel and have not yet answered. It decides who owes these people what, and in what terms. Publishing a position before we hold one would be a guess wearing the clothes of a fact, and this is a document that should contain neither. When the answer comes, the notice for these people is written and published, and it will not be a paragraph in this one.

What you can do now

Write to hello@monivero.com. A person reads every message of this kind and answers it. If the law restricts what we may tell you about a particular case — Czech anti-money-laundering rules do restrict this in some circumstances — we will say that a restriction applies rather than leave you without a reply. You can also complain to the supervisory authority in section 11 at any time, and you do not have to come to us first.

If your company, your name or your home appears in a free company check

Anyone may run the free company check on this website without an account. It looks a Czech company up in the public registers — ARES, the commercial register, the insolvency register, the VAT register and the trade licence register — and compares the company itself with sanctions lists published by the EU, the UN, the United Kingdom, the United States and the Czech Republic. For this check Tolaron s.r.o. is the controller.

If you sit in one of the company’s bodies, or hold a share in it: the commercial register’s answer names you, so our server reads it. We keep, and show, at most a count — how many current members each body has, and how many shareholders are people — for example, “3 members of the statutory body”. Your name, date of birth and address are not shown, are not compared with any list, and are not kept.

If the company’s name is your name, or its registered seat is your home: the check shows the name and the seat as the registers publish them, and keeps them with the check, because they are the company’s.

Why, and on what basis: to show the person running the check what the public registers say about a company before they deal with it — our legitimate interest, and theirs, in being able to check a company, Article 6(1)(f) GDPR.

How long: the check is deleted 365 days after it ran.

We have no way of contacting you when a company you are part of is checked, so we publish this information here instead of writing to you.

Your rights: everything in section 10 applies, including the right to object at any time on grounds relating to your particular situation. Write to hello@monivero.com. You may also complain to the authority in section 11.

This is version 1.3, in effect from 22 September 2026. It replaces version 1.2 of 8 September 2026 and adds the free company check: section 3 describes what we record when you run it, section 4 what happens when the number belongs to a person, sections 6 to 8 the Cloudflare check that keeps it free of automated use, and section 12 what the check does with anybody else’s data. This version is published before the free company check is switched on, so that the notice is in place first; until then the check does not run. Apart from that, this notice describes the website as it stands today. When the website changes — when accounts open, or when the full site returns from its launch hold — this notice is updated before the change goes live, and the version and date at the top of the page change with it.

Section 12 is written to be replaced. When the question it names has been answered, the people it is addressed to get a notice of their own rather than a section in this one. It is not a placeholder we intend to leave standing.