Certified Checks Privacy Policy
This privacy notice applies strictly to the processing of personal data as part of conducting Certified Checks in the Verify 365 platform, where Lawtech is acting as the controller. All other processing activities in Verify 365 and in Lawtech are subject to our Main Privacy Policy.
This privacy notice clarifies the situations in which Lawtech is the processor or controller of this data and specifies information concerning our data protection responsibilities as controller of this data.
1. Introduction
1.1. Who Are We?
We are Lawtech 365 Limited t/a Verify 365, a provider of AML, KYC and Client Onboarding checks for legal and property professionals and the processor or controller of personal data that we process for the purposes of conducting Certified Checks in our Verify 365 platform when instructed to do so as part of a relationship with our customers, or as part of service improvement.
We can be contacted through the following means:
- Email to our Data Protection Officer at gdpr@tmgroup.co.uk
- Post to our registered office address of registration number 13107185, 1200 Delta Business Park, Swindon, Wiltshire, England, SN5 7XZ
1.2. Definitions
For definitions that apply to general data protection purposes and features of the Verify 365 platform outside of the scope of this privacy notice, see our Main Privacy Policy. In addition to those definitions, the following definitions apply to this privacy notice for the purpose of data collected as part of conducting Certified Checks:
- Client - the legal entity to whom we provide our Services under the Agreement, as defined in our Main Privacy Policy
- Certified Checks – Biometric ID checks that fall within regulation of the DIATF standard. Also, simply, referred to Right to Work and/or Right to Rent checks in the platform.
- Certified Check Data Subject – the individual about whom the data stated in the table in section 1.3 of this privacy notice is collected as part of conducting Certified Checks on behalf of clients and for service improvement; Certified Check Data Subjects have a direct relationship with Clients
- Certified Check Providers – third parties that we appoint under contract for the processing of Certified Checks; these are listed on our Third Party Products and Terms
- Main Privacy Policy – the privacy notice that applies to all other processing activities in Verify 365 and Lawtech, which can be found here: Privacy - Verify 365
- Third Party Products and Terms – a list of third party service providers that are used in Verify 365, and applicable terms, which can be found here: Third Party Products and Terms - Verify 365
2. Data Processing for the Purposes of Conducting Certified Checks
2.1. What Data Do We Collect?
We obtain the following information from Certified Check Data Subjects when we conduct Certified Checks:
| Purpose | Lawtech Role | Data Collected | Lawful Basis | How Long is the Data Retained? |
|---|---|---|---|---|
| Certified Checks | Processor | Document (doc) information, including: type of doc, doc number, issuer, name, sex, place of birth and other doc held information. Biometric information including: face, biometric comparison score, mortality status. | As the processor, we do not determine the lawful basis | Refer to the Main Privacy Policy |
| Service Improvement | Controller | We store status of check, types of checks sent and completed, and error logs. Refer to the Main Privacy Policy – this data is combined with performance metrics from Verify 365 | Legitimate Interests - this data is required for calibration of our processes and technology so that we may continue to improve our service in conjunction with our Certified Check Providers | 6 years from the date of the last task run for the Data Subject |
Note that if Certified Check Data Subjects fail to provide the personal data stated above, we may not be able to provide Certified Checks to our Clients, which may result in the inability of our Clients to provide services that Certified Check Data Subjects have requested of them. See the Main Privacy Policy for further details.
We do not employ any automated decision-making or profiling technologies. The result of Certified Checks is a validation or otherwise of the accuracy of the personal data submitted as part of Certified Checks that is provided to our Clients for them to review. See the Main Privacy Policy for further details.
2.2. Who Has Access to Your Personal Data?
2.2.1 As Controller
In our capacity as controller, the personal data that we collect is accessed by authorised Lawtech personnel as part of service improvements, strictly as required by their role. Service improvement requires the input of Certified Check Providers, who act as independent controllers of the personal data so that they may improve their products and services, ensuring that Certified Checks are able to combat sophisticated fraud, detect deepfakes, injection attacks, and AI-powered threats.
Please refer to the Third Party Products and Terms for details of these Certified Check Providers and their privacy notices or other terms that apply.
In addition, our professional advisors such as legal representation and accountants may require access to this data for legal and business administration purposes.
2.2.2 As Processor
In our capacity as processor, we also engage Certified Check Providers to conduct Certified Checks that are delivered through the Verify 365 platform. Authorised Lawtech personnel also access this data as part of their duties in delivering Certified Checks. See the Main Privacy Policy and Third Party Products and Terms for further details.
2.3. International Transfers
To provide our services it may be necessary to transfer your personal data to service providers located in a country outside of the UK. Where this occurs, we ensure a similar degree of protection of your personal data by ensuring at least one of the following safeguards is implemented:
- We will only transfer your personal data to countries that have been deemed to meet UK adequacy regulations; or
- We will ensure that we put in place approved standard data protection clauses between us any third party that processes your personal data, using either the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum (Addendum), as well as conducting a transfer risk assessment
Further details on the above are available on request, by contacting us via the methods stated in Section 1.1
2.4. Your Rights
You have the following rights:
- Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no valid reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
- Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes; note that we do not use any of the personal data collected under the circumstances stated in the privacy notice for marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
- Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
- Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. Note that we do not rely on consent as a lawful basis for processing of any personal data collected under the circumstances stated in the privacy notice
2.5. Complaints
Should you have any complaints regarding the handling of your personal data, you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns directly, so please contact us in the first instance by means of one of the methods stated in Section 1.1.
The ICO can be contacted by one of these methods: