MANAGED IDENTITIES LIMITED

TRUSTD PRIVACY NOTICE

Managed Identities Limited (Company No. 12044881) trading as Trustd of Newstead House, Pelham Road, Nottingham, United Kingdom NG5 1AP (“We”, “Us”, “Our”) is committed to protecting and respecting your privacy. This Privacy Notice (together with any other documents referred to herein) sets out the basis on which the personal data collected from you, or that you provide to Us through the use of Our Trustd Platform, will be processed by Us in connection with the verification of you including on behalf of an organisation with which you are associated (the “Organisation”) or a third party who requests to verify your documents (a “Verification Requester”). Please read the following carefully to understand Our views and practices regarding your personal data and how We will treat it.

For the purpose of the General Data Protection Regulation and the United Kingdom General Data Protection Regulation (collectively, the “GDPR”) the Data Controller is Managed Identities Limited.

If you are an individual (data subject) regarding whom verification is requested by an Organisation or Verification Requestor, this privacy notice is addressed to you.

YOUR PERSONAL INFORMATION

Information We collect from you, your Organisation or a Verification Requester

We collect and process some or all of the following types of information from you:

Information required to verify your identity, which may include biometric data, where you choose to provide this information to us.
Such licenses, qualifications and registrations as are relevant to your position in the Organisation.
Personal details such as name, email address, address, date of birth, visa and immigration status, qualifications, experience, information relating to your employment history, skills and experience, driving licence details, driver’s insurance and vehicle details.
If you contact Us, We may keep a record of that correspondence.
A record of your progress through any verification that we may conduct.
A record of any information received by Us in connection with you as a result of our verification checks.
Details of your visits to Trustd including, but not limited to, traffic data, location data, weblogs and other communication data, the site that referred you to Trustd and the resources that you access.

Information We Collect from Other Sources

The Trustd Platform searches various databases – some publicly available and others not, which may include your personal data, to conduct verification checks. A list of the databases that we may check your personal data against are:

Database	Data Collected
FullCircl	Company description and directors details
GBG – IDScan API	Live facial recognition checks
GBG – ID3 Global API	Driver’s date of birth, driving licence details, entitlement to drive
DVLA – MOT History API	MOT history of driver’s vehicle
DVLA ADD	Driver’s driving licence points
DBS	Criminal record checks

We may also receive your personal data from the Organisation or from a Verification Requester.

USES MADE OF YOUR INFORMATION

General information about “lawful bases for processing”

We are required to identify a legal justification (known as a lawful basis) for collecting and using your personal data. There are six legal justifications which organisations can rely on. The most relevant of these to us are where we use your personal data to:

fulfil our contract with you
pursue our legitimate interests (our justifiable business aims) but only if those interests are not outweighed by your other rights and freedoms (e.g. your right to privacy)
comply with a legal obligation that we have
do something for which you have given your consent.

In addition, where organisations such as the Organisation, the Verification Requester and Us process “special category data”, which includes (amongst other things) biometric data used for the purposes of identification, we are required to have an additional lawful basis for using this data. There are ten legal justifications that organisations can rely on. The most relevant of these to Us are where we use this special category data:

to do something for which you have given your consent
for reasons of substantial public interest. Such interests include protecting the public from fraud or dishonesty. To balance this against the rights and freedoms of Our users and safeguard your fundamental rights and interests, We have implemented specific measures, including encryption at rest and in transit, multi-factor authentication, impact assessments and strict security controls.

Our Purposes and Lawful Basis for use of your information

More specifically, we use your personal data for the purposes set out below, and have identified which legal basis applies to each purpose and use:

Where you have requested the verification on your own behalf you will enter into a contract with us to conduct such verification. We will process all your personal data provided to or collect by us to perform this contract with you to conduct such verification.
Where an Organisation has requested verification in respect of your personal data, We have a legitimate interest in processing your personal data to perform Our contract with the Organisation to provide the verification information to the Organisation. The Organisation is responsible for notifying you of their own legal basis and purpose for requiring such verification, and for informing you of any other processing of your personal data that they will carry out on their own behalf.
Where a Verification Requester has requested verification in respect of your personal data, We have a legitimate interest in processing your personal data to perform Our services to the Verification Requester (and such services provide the verification information to them). The Verification Requester is responsible for notifying you of their own legal basis and purpose for requiring such verification, and for informing you of any other processing of your personal data that they will carry out on their own behalf.
A key feature of our services (to you, Oganisations and Verification Requesters) is that we enhance any information that we receive from you with information obtained from third party data providers. The legal basis for carrying out this process is to perform a contract with you, or where we have a legitimate interest to perform or services to an Organisation or Verification Requester, as set out above.
Our verification process may include checking your criminal convictions via a check with the Disclosure and Barring Service. The legal basis for carrying out this process is to perform a contract with you, or where we have a legitimate interest to perform or services to an Organisation or Verification Requester, as set out above.
We will collect your biometric data (which is special category data) only where you have chosen to provide this to us, however, your refusal to provide such special category data may make certain of our services unavailable to you. Our use of such special category data for the purposes of enabling others to verify your identity using our services is based on substantial public interest as we use this personal information to help protect members of the public from fraud..
We have a legitimate interest in the continuing development and improvement of the Trustd Platform and Our services and may use your personal data for this purpose.
Our service providers (such as our data providers) may also use your personal data for the improvement of the services they provide to us, and to enable them to better assist with the prevention and detection of fraud, which is a matter of substantial public interest.
We may send you newsletters and promotional materials from time to time with regard to similar services because you are our customer or service user. We have a legitimate interest to market our products and services, however, you can opt out of these at any time via the “unsubscribe” link or contact address provided in each promotional email or newsletter.
Should We ever share your information with third party advertisers, We will ask for your consent before doing so. You do not have to agree and if you do, you may change your mind and opt out at a later date by means set out in such third party’s privacy policy.

Automated decision making/profiling

We use technology to capture and compile information you have provided to Us and to check this against third party databases to verify your identity and other credentials. The process of finding likely matches for your information is automatic, and results will be passed to the Organisation’s and/or the Verification Requestor’s compliance officers to decide whether your application can be validated.

DISCLOSURE OF YOUR INFORMATION

A key aspect of our services is that we share certain verification information, which includes your personal information with your Organisation and Verification Requesters, as described above.

We may also disclose your personal data to third parties:

in the event that We sell or buy any business or assets, in which case We may disclose your personal data to the prospective seller or buyer of such business or assets;
if We or substantially all of Our assets are acquired by a third party, in which case personal data held by Us about our customers will be one of the transferred assets;
if We are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply Our Terms and Conditions and other agreements;
to protect Our rights, property, or safety or that of our affiliated entities and Our users and any third party We interact with the to provide the Platforms;
in relation to selected third parties only, only to the extent that you have consented to such selected third parties notifying you about certain goods or services, which may be of interest to you.

HOW WE STORE YOUR PERSONAL DATA

Security

We take appropriate measures to ensure that all personal data is kept secure including security measures to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where We are legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although We will do Our best to protect your personal data, We cannot guarantee the security of your data transmitted through any online means, therefore any transmission remains at your own risk.

Where We store your personal data

We store your personal data in AWS servers located in Ireland (EU-west-1).

Where the data that We collect from you and process using the Trustd Platform may be transferred to, and stored at, a destination outside the United Kingdom or the European Economic Area (“EEA”). In such event We ensure that appropriate protection of your personal data is in place prior to such transfer, which includes data processor agreements approved by the European Commission or the (UK) Information Commissioner’s Office (as appropriate) designed to help safeguard your privacy rights and give you remedies in the unlikely event of a misuse of your personal data.

If you would like further information please contact Us (see ‘Contact’ below). We will not otherwise transfer your personal data outside of the United Kingdom or EEA or to any organisation (or subordinate bodies) governed by public international law or which is set up under any agreement between two or more countries.

KEEPING YOUR PERSONAL DATA UP TO DATE

It is important that the personal data we hold about you is accurate and current.

If your personal details change you should update them by accessing the relevant page on Trustd. If you have any questions about how We use data collected which relates to you, please contact Us by sending a request by email to the contact details below.

HOW LONG WE KEEP YOUR PERSONAL DATA

We will hold all the data for so long as you or the Organisation that you’re associated with, or a Verification Requester is registered to use Our services and for a period of 7 years after such registration is deleted or expires.

We may store your personal data provided to Us for an additional period as long as it is reasonably necessary taking into consideration Our need to resolve any disputes, enforce our rights and/or respond to queries.

If you have any questions about our data retention policy, please contact us.

YOUR RIGHTS

Under the General Data Protection Regulation you have a number of important rights free of charge. In summary, those include rights to:

access to your personal data and to certain other supplementary information that this Privacy Notice is already designed to address
require Us to correct any mistakes in your information which We hold
require the erasure of personal data concerning you in certain situations, including where you no longer wish to be verified by TEG.
receive the personal data concerning you which you have provided to Us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations
object at any time to processing of personal data concerning you for direct marketing
object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you
object in certain other situations to our continued processing of your personal data
otherwise restrict our processing of your personal data in certain circumstances
claim compensation for damages caused by our breach of any data protection laws.

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.

If you would like to exercise any of those rights, please:

contact Us using our Contact details below
let Us have enough information to identify you,
let Us have proof of your identity and address, and
let Us know the information to which your request relates.

Cookies and IP addresses

We may collect information about your mobile phone, computer or other device from which you access the Platforms including where available your IP address, operating system, screen size and resolution, and browser type, for systems administration and to report aggregate information to third parties affiliates. This is statistical data about our users’ browsing actions and patterns, and does not identify any individual. We may, however, use such information in conjunction with the data We have about you in order to track your usage of our services.

A cookie is a small file of letters and numbers that We store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive.

The cookies We use include:

Analytical cookies. They allow Us to recognise and count the number of visitors and to see how visitors move around the Trustd Platform when they are using it. This helps Us to improve the way our Trustd Platform works, for example, by ensuring that users are finding what they are looking for easily.
Strictly necessary cookies. These are cookies that are required for the operation of our Trustd Platform. They include, for example, cookies that enable you to log into secure areas of our Trustd Platform, or cookies that let us know you have accepted this privacy policy.
Functionality cookies. These are used to recognise you when you return to our Trustd Platform. This enables Us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
Targeting cookies. These cookies record your visit to our Trustd Platform, the pages you have visited and the links you have followed to our affiliates websites. We will use this information to make our Trustd Platform, offers e-mailed to you and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose. Please note that third party affiliates may also use cookies, over which We have no control.

More information about the cookies we include and how to manage them can be found here:

Cookies which are strictly necessary for the core functionality of the Trustd Platform are enabled by default, and set automatically at the point you access the Trustd Platform.

Any cookies which are not strictly necessary for the functioning of the Trustd Platform will not be set unless you expressly consent to them through the cookie banner by clicking “accept”.

HOW TO COMPLAIN

We hope that We can resolve any query or concern you raise about Our use of your information.

The General Data Protection Regulation also gives you right to lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws occurred. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/make-a-complaint/ or telephone: 0303 123 1113.

CONTACT

All questions, comments and requests regarding this Privacy Notice should be addressed to [email protected].

20 Northdown St, London N1 9BG

Dylan Cresswell

Dylan Cresswell