Privacy Policy

1. Introduction

Verify Client LTD ("Verify Client", "we", "us", "our") is committed to protecting the privacy of individuals who use our client onboarding platform. This Privacy Policy explains how we collect, use, store, and protect personal information in connection with our services.

We operate as a data processor for law firms that use Verify Client. Those firms are the data controllers for information collected during client onboarding. We may also act as a data controller for our own business records and website enquiries.

2. Information We Collect

2.1 Information Collected During Client Onboarding

When a client completes onboarding, we collect information for the law firm that sent the request. Depending on the matter, this may include:

• Full name, date of birth, and contact details
• Identity documents (passport, driving licence)
• Proof of address documents
• Source of funds information and supporting documentation
• Completed forms, uploaded documents, and electronic signatures
• Declarations and consent records
• Photographs for identity verification

2.2 Information from Law Firms

From law firms that use Verify Client, we collect:

• Business contact information
• User account details for platform access
• Billing and payment information
• Usage data and platform activity logs

2.3 Technical Information

We automatically collect certain technical information including IP addresses, browser type, device information, and usage patterns to ensure platform security and improve our services.

2.4 Pricing enquiries

When you continue past the first step of the pricing form, we save your name, work email and business name. Continuing past the estimate step also saves your expected monthly volume. Our authorised team can see unfinished enquiries and distinguish them from requests for a conversation. We use this information to manage pricing enquiries and understand where the enquiry process is left unfinished, not to subscribe you to marketing. Optional requirements and notes are sent only when you request a conversation. You can object to this use by contacting us using the details below.

When you submit an enquiry or access request, Google reCAPTCHA helps us prevent automated abuse. It receives technical browser and interaction information for that security check. We do not include your contact fields in analytics events.

3. How We Use Information

3.1 Client Onboarding Data

Personal information collected during onboarding is processed to:

• Facilitate identity verification checks
• Support anti-money laundering screening
• Document source of funds for compliance purposes
• Generate evidence packs for the law firm's matter records
• Maintain audit trails as required by regulation

3.2 Business Purposes

We use business information to provide our services, process payments, communicate with customers, improve our platform, and comply with legal obligations.

4. Legal Basis for Processing

We process personal information on the following legal bases under UK GDPR:

• Contract performance: Processing necessary to provide our services
• Legal obligation: Processing required by anti-money laundering regulations
• Legitimate interests: Processing for platform security and service improvement
• Consent: Where specific consent has been obtained

5. Data Sharing

We share personal information only as necessary:

• With law firms: Client onboarding data is available to the firm that sent the onboarding request
• Service providers: We use contracted third-party providers for identity verification, AML screening, communications and cloud hosting
• Legal requirements: We may disclose information when required by law or to protect our legal rights

We do not sell personal information to third parties.

Where a firm requests identity, biometric or AML checks, selected information is processed by Didit as our verification service provider. Didit may also process limited information for security, abuse prevention, legal compliance and audit purposes. You can read Didit's verification privacy notice.

5.1 Processing locations and transfers

Core Verify Client application and evidence records are hosted in Amazon Web Services' Ireland region. Didit states that its default verification processing is in the European Union. Where information is processed outside the United Kingdom, we require an applicable adequacy decision or contractual and organisational safeguards under UK data-protection law.

6. Data Security

We implement appropriate technical and organisational measures to protect personal information, including:

• Encryption of data in transit and at rest
• Secure access controls and authentication
• Regular security assessments and monitoring
• Staff training on data protection
• Region-controlled cloud hosting and supplier access controls

7. Data Retention

We retain personal information in accordance with legal requirements and our data retention policy:

• Client onboarding data is retained as directed by the law firm, in line with its legal and regulatory obligations
• Audit logs are retained for the period required by applicable regulations
• Business records are retained as required for accounting and legal purposes
• Unfinished pricing enquiries leave the active lead queue after 30 days and are scheduled for deletion. Backup copies can remain for the existing 35-day recovery window. If you request a conversation, we retain that pricing enquiry for 365 days from your request, then schedule it for deletion. Any subsequent customer agreement and billing records follow their separate retention rules. The form’s update token expires after 24 hours and is not saved in your browser storage.
• Verification-provider copies are retained according to the provider settings and our documented instructions, and can be deleted when appropriate

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal information:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Restriction: Request limitation of processing
• Portability: Request transfer of your data
• Objection: Object to certain types of processing

For information collected during your onboarding, contact your solicitor or law firm first because they are the data controller. For other enquiries, use the contact details below.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be shown here with a new effective date. Where a change materially affects how we use your information, we will provide an appropriate notice through the platform or by email.

11. Contact Us

For questions about this Privacy Policy or our data practices, please contact us: