DataFlow Group (collectively referred as hereafter, “DataFlow”, “we” or “us” or “Company” and also indicated by “us”, “we” or “our”) and our affiliated companies worldwide, are committed to respecting your online privacy and recognize your need for appropriate protection and management of any personally identifiable information (“Personal Information”) you share with us based on applicable data protection laws and regulations.
Privacy statement –
Except as otherwise provided in this Policy, in general, you can visit/use our Sites/Apps without identifying who you are. DataFlow will provide you with the option to deal with DataFlow without identifying yourself where it is lawful and practical. However, particular sections on our Sites/Apps may require you to provide personal information in order that we may provide the products/services or information you have requested while visiting/using our Sites/Apps.
Personal Information means any information that identifies you as an individual (‘data subject’ herein referred as you/your’) and any other information we associate with it. In particular using a common identifier this includes but is not limited to: first and last name, email address, mailing and residential address, telephone number, title, birth date, gender, occupation, your profession and other information needed to provide a service you have requested.
Sensitive personal data or information means personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
We collect, use and are responsible for certain personal data about you.
When we collect data about you, we are subject to the UK General Data Protection Regulation (UK GDPR) if you are in the United Kingdom (UK). We are also subject to the EU General Data Protection Regulation (EU GDPR) in relation to services we offer to applicants in the European Economic Area (EEA). In this Policy a reference to the GDPR is to the UK or EU GDPR as applicable based on your location.
Please read this Policy carefully to understand our views and practices regarding your personal data and how we will treat it. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint and are a resident or citizen in the UK or the EEA.
Personal data we may collect from you
A. Personal Data (information you give us)
We may collect Personal Information shared by you on our Sites/Apps. Depending upon the Site(s) and context, this information may include the following:
- Information that you provide by filling in authorisation forms (online or in physical format) through our clients when we provide services to them or directly to Us including your full name, passport details, national ID details, email address, address, telephone number, Pearson VUE registration ID, staff number/employee code, seat/roll/hall ticket number, registration/enrolment/licence number, bank account details/receipt number and any personal information contained within any scanned or photographed documentation you provide to Us, such as your gender and date of birth.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
B. Information collected automatically (log information)
Depending upon the Sites/Apps or context, we automatically collect and store certain information that your browser sends whenever you visit our Sites/Apps in server logs (“Log Data”). This includes:
- Details of how you used our Sites/Apps
- Internet protocol address
- Device event information such as caches, system activity, hardware settings, browser type, browser language, the date and time of your visit, time spent on those pages and other statistics and referral URL and
- Cookies, web beacons and other similar technologies that may uniquely identify your browser or your Account. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Sites/Apps.
C. Information collected through cookies
Cookies are small text files that a website downloads onto your computer or other internet-enabled devices (such as mobile phones and tablets) when you visit a website. The cookie will help the website recognise your device the next time you visit.
We may use both session cookies (disappear after you close your browser) and persistent cookies (remain after you close your browser and may be accessed every time you use or connect to our Sites/Apps). We may collect information like user’s IP address, geographical location, browser/device type and version, operating system, referral source, device, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of user website use through “cookies”.
You can block cookies by activating the setting on your browser that allow you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies), you may not be able to access all or parts of our site, or they may not function properly.
D. Social Media Widgets
Our Sites and applications may include social media features connected with social media platforms such as Facebook, Twitter, Instagram, LinkedIn and YouTube. These features may collect information about your IP address and which page you’re visiting or features you’re using and may set a cookie or employ other tracking technologies. Social media features and widgets are either hosted by a third party or hosted directly on our Sites/Apps. Your interactions with those features are governed by the privacy policies of the companies that provide them.
Tracking code in website analytics, a tracking code is a snippet of script that tracks the activity of a website user by collecting data and sending it to the analytics module. The code is generated automatically, is different for each website, and can be installed on each page that needs tracking.
How your personal data is collected
We collect most of this personal data directly from you—in person, by telephone, text messaging systems (such as SMS or WhatsApp) or email and/or via our website and app. However, we may also collect information:
- directly from a third party (including publicly accessible sources), eg:
- sanctions screening providers;
- criminal records databases (e.g. INTERPOL, US Court Records);
- credit reference agencies;
- customer due diligence providers;
- news and media data aggregation services such as Thomsons, Reuters, Factiva, Dow Jones;
- local councils, city halls and public records archives;
- from a third party with your consent, e.g. former employers, educational institutions, professional bodies etc that you listed on your application form;
- from a third party or agency submitting the verification on your behalf;
Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
How and why we use your personal data
We can only use your personal data if we have a proper reason, e.g.:
- where you have given consent;
- to comply with our legal and regulatory obligations;
- for the performance of a contract with you or to take steps at your request before entering into a contract; or
- for our legitimate interests or those of a third party.
A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own.
The table below explains what we use your personal data for and why.
|What we use your personal data for||Our reasons|
|Where we receive information directly from you or from any third party in relation to any verification service we are providing to you, to provide these services to you.||To perform our contract with you or to take steps at your request before entering into a contract.|
|Where we receive information about you from our clients, directly from you or from any third party in relation to any verification service we are providing to our clients, to verify the personal data you provide to us (including via third parties), analyse that personal data in conjunction with the results of our searches, and report to our clients on the accuracy and authenticity of the personal data you have provided.||For our legitimate interests or those of a third party, i.e. to enable us to provide verification services to our clients.|
|To collect and compile statistical data on our user base in order to improve our services and for research and analytical purposes.||For our legitimate interests or those of a third party, i.e. to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy or to provide relevant material to support you (such as self-help articles and videos).|
|For use in contacting you with regards to the processing of your case.||In order to contact you should there be a need to collect more data to facilitate the completion of our contract with you, or to update you occasionally with the status of the case we are processing for you or our client.|
|For use of online services available on our website and for subscription to our newsletter.|
To perform our contract with you.
For our legitimate interests or those of a third party, i.e. to grow our business.
|To improve our website to ensure that content is presented in the most effective manner for you and for your computer and to measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you.||For our legitimate interests or those of a third party, i.e. to improve our website and our services to you, and ensure our advertising is effective.|
|Making disclosures as required by any applicable law, rules, regulations, codes of practice or guidelines or to assist in law enforcement purposes, investigations by police or other government or regulatory authorities in countries we operate or elsewhere.||For our legitimate interests or those of a third party i.e. to develop our products/services and grow our business.|
|Conducting searches of publicly available and private databases via our Cross-check service (https://www.crosscheck360.com/aboutus.php) to cross reference and match the personal data you provide to us to other personal data that we hold which may or may not match your details.||To comply with our legal and regulatory obligations.|
|Preventing and detecting fraud against you or us.||For the performance of our contract with you.|
Conducting checks to identify our customers and verify their identity.
Screening for financial and other sanctions or embargoes.
Other activities necessary to comply with professional, legal and regulatory obligations that apply to our business, e.g. under health and safety law or rules issued by our professional regulator.
|For our legitimate interests or those of a third party, i.e. to minimise fraud that could be damaging for you and/or us.|
|Gathering and providing information required by or relating to audits, enquiries or investigations by regulatory bodies.||To comply with our legal and regulatory obligations.|
|Ensuring business policies are adhered to, i.e. policies covering security and internet use.||To comply with our legal and regulatory obligations.|
|Operational reasons, such as improving efficiency, training and quality control.||For our legitimate interests or those of a third party, i.e. to make sure we are following our own internal procedures so we can deliver the best service to you.|
|Ensuring the confidentiality of commercially sensitive information.||For our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best service to you.|
|Statistical analysis to help us manage our business, i.e. in relation to our financial performance, customer base, product range or other efficiency measures.|
For our legitimate interests or those of a third party, i.e. to protect trade secrets and other commercially valuable information.
To comply with our legal and regulatory obligations.
|Preventing unauthorized access and modifications to systems.||For our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best service to you.|
|Updating and enhancing customer records.|
For our legitimate interests or those of a third party, i.e. to prevent and detect criminal activity that could be damaging for you and/or us.
To comply with our legal and regulatory obligations.
To perform our contract with you or to take steps at your request before entering into a contract.
To comply with our legal and regulatory obligations.
For our legitimate interests or those of a third party, i.e. making sure that we can keep in touch with our customers about existing applications and new products.
|External audits and quality checks, e.g. for ISO accreditation, data security audits and the audit of our accounts.||To comply with our legal and regulatory obligations.|
For our legitimate interests or those of a third party, i.e. to maintain our accreditations so we can demonstrate we operate at the highest standards.
To comply with our legal and regulatory obligations.
Where we process special category personal data or personal data relating to criminal convictions and offences or related security measures, we will also ensure we are permitted to do so under applicable data protection laws, such as:
- we have your explicit consent;
- the processing is necessary to establish, exercise or defend legal claims; or
- the processing is necessary in the substantial public interest, for example (in the case of criminal conviction or similar information) to protect the public against dishonesty, malpractice or other seriously improper conduct or unfitness or incompetence.
If you would like more information about the lawful basis on which we process these kinds of data and the ways we use and store it, please see our associated policy.
Transfer of personal data to third parties
To facilitate the purposes set out above, we may transfer, disclose, grant access to or share your personal data (whether within or outside the countries we operate) with:
- Any other companies in our Group, including, without limitation, CrossCheck Private Limited in connection with our CrossCheck service referred to above;
- Professional advisers including lawyers, bankers, auditors and insurers;
- Regulators and other authorities such as the licensing authority or visa processing agency to whom you may have applied to initially which required the support of the DataFlow process in order to complete your application, who require reporting of processing activities in certain circumstances;
- In the event that we are involved in a bankruptcy, merger, acquisition, reorganization or sale of assets, in which case your information may be transferred as part of that transaction. This Policy will apply to your information as transferred to the new entity;
- Third-party companies who help us provide and improve our services such as:
- to assist with our verification process where we may not be able to do it ourselves (only used in exceptional circumstances);
- to enable us to send one-time passwords via voice, to operate a ticketing tool and to make our service more efficient and easier to use in similar ways;
- to help us understand and improve the use of our Services, such as Google Analytics; and
- to Google, Inc (Global) and Amazon Web Services (Ireland and Singapore) for providing cloud-based hosting, storage and processing services.
We share your personal data with such third-party service providers subject to obligations consistent with this Policy and any other appropriate confidentiality and security measures, and on the condition that the third parties use your personal data only for specified purposes and in accordance with our instructions.
Where we store your personal data
Personal data may be held at our offices and those of our group companies, third party agencies, service providers, representatives and agents as described above (see above: ‘Transfers of data to third parties’) .
Some of these third parties may be based outside the country in which you provide the information, for example in the servers of our cloud data hosting providers in Ireland. For more information, including on how we safeguard your personal data when this happens, see below: ‘International Transfers’.
All information you provide to us is stored on our secure servers. Once we have received your information, we have put in place appropriate strict procedures and security features to prevent unauthorized access, use, alteration or disclosure of your personal data or prevent your personal data from being accidentally lost. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
As explained in the previous section, we share your personal data with other companies in our group. This will sometimes involve transferring personal data outside the country where you provided it.
We only transfer personal data out of the country where you provided it to us if we are allowed by law to do so. For example, if we transfer personal data outside the UK or EEA (European Economic Area) we may not do so unless we put appropriate safeguards in place. We may accordingly use specific contracts approved by the UK or the European Commission (such as the Standard Contractual Clauses) which are binding on the exporting and importing entities and assure personal data the same level of protection in the destination country that it has under the GDPR.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or EEA.
Use and transfer of your personal data for direct marketing
We may occasionally use your personal data to send marketing communications to you about products, services and opportunities which may be of interest to you . You may receive marketing communications from us if you have requested information from us or purchased services from us and you have not opted out of receiving that marketing.
Direct marketing may be provided to you by email, mail, fax, phone or other means.
We have a legitimate interest in using your personal data for marketing purposes (see above ‘How and why we use your personal data’). This means we do not usually need your consent to send you marketing information. However, where consent is needed, we will ask for this separately and clearly.
You can exercise your right to opt out of direct marketing or update your marketing preferences at any time by contacting our Data Security Office via the Support Page on the DataFlow Corporate website.
We may ask you to confirm or update your marketing preferences if you ask us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.
Third party links
If you interact with us on social media platforms (for example if you “Like” our Facebook Page or post on our timeline), we can interact with you and send you messages via these platforms. We will interact with you in accordance with the social media platform’s rules but we are not responsible for how the platform operators collect and handle your personal data. We are not responsible for what third parties post on our social media accounts.
We will generally retain the personal data you provide to us or which we collect for the purpose of providing a Report for a period of 15 years from the time of case completion in order to provide responses to enquiries from you, our clients, or the regulatory authorities we supply your report to, for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements, or to provide you with Report Transfer services where you may wish to use the report in order to support a transfer to an alternative or future regulator or to a future employer. We consider this to be the period which is reasonably necessary for these purposes. After this period of time the personally identifiable information related to your cases is either deleted or made anonymous. Case completion is normally at the point of producing the report, but this may vary depending upon the complexity of the case or where an appeal, a request for further review, or report transfer situation occurs.
If you would like to delete your data, please refer to the “Your Rights” section for further information.
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Access and accuracy
At DataFlow we take your privacy very seriously, and we never monetize your information; we use it to enhance your experience. When it comes to your privacy rights, we want to make sure you have everything you need to make informed decisions. You have the right to:
- Request of access – You have the right to be informed why and how we collect your personal data, how we will use this information, who we share it with, what are the security measures we take to protect this information and what your individual rights are; We will publish this information in this Privacy Notice. DataFlow shall provide a copy of the personal information undergoing processing. For any further copies requested, please note that DataFlow may charge a reasonable fee based on administrative costs.
- Right to Rectification – You have the right for inaccurate or incomplete personal data that we hold about you to be updated. This enables you to have any inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
- Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
- Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
- If you want us to establish the data’s accuracy.
- Where our use of the data is unlawful, but you do not want us to erase it.
- Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
- You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
- Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. As previously stated, if you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
At any stage, you can withdraw your consent to the retention/storage/processing of your Personal Information and DataFlow shall erase the Personal Information withdrawn by you unless there is a contractual obligation or legal requirement/obligation to retain/hold it or otherwise permitted by law to retain it. However, upon such withdrawal, the Company will not be able to communicate with you and provide you with certain information on product and/or services which are required for fulfilment of any obligation.
We process these cases without undue delay and usually aim to complete such requests within 30 working days, at which point we will confirm what actions have been taken.
How to Submit a Request –
We provide you with access to obtain a copy of their data and to ensure that maintained data is up-to-date and accurate. Most data can be updated by the individual through our online systems. Where this is not the case, you may request access to, correction, adjustment, or erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party by contacting the Data Security Office via Support/Contact Us – DataFlow Group. The Data Security Office may also be contacted in order to obtain a complete and portable set of data.
You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
Should you be unhappy with our processing of your personal data or wish to exercise any of your rights, please let us know by contacting us via the Support/Contact Us – DataFlow Group.
You have the right to make a complaint at any time to the supervisory authority in your jurisdiction for data protection issues (for example the Information Commissioner’s Office (ICO) in the UK (www.ico.org.uk)). Details of other supervisory authorities can be found here: Members | European Data Protection Board (europa.eu). We would however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance by visiting our support page at Support/Contact Us – DataFlow Group.
How we protect your information
Our Sites/Apps have stringent security practices and measures in place to protect the personal information provided to us. Our database stores Personal Information in a secure environment that is designed to safeguard it from loss, misuse, wrongful disclosure, destruction and alteration. The security measures are reviewed periodically by DataFlow to keep pace with business, technology and regulatory changes.
- The security and confidentiality of your Personal Data is important to us and DataFlow has invested significant resources to protect the safekeeping and confidentiality of your personal data. When using external service providers acting as processors, we require that they adhere to the same standards as DataFlow. Regardless of where your personal information is transferred or stored, we take all steps reasonably necessary to ensure that personal data is kept secure.
- We have physical, electronic, and procedural safeguards that comply with the applicable laws to protect personal information about you. We seek to ensure compliance with the requirements of the GDPR and other regulatory requirements to ensure the protection and preservation of your privacy.
- We take appropriate security measures to protect against unauthorized access to or unauthorized alteration, disclosure or destruction of data.
Using our app
Should you choose to use our mobile platform or Apps, you agree to the following terms.
We will access your camera in order to take photos and copies of documents. We will not access your photo library or camera roll without your explicit permission. We will only use images that you choose to share with us.
We will not access or scan your contacts stored on your mobile device without your explicit consent. We will only use the contacts that you choose to share with us which will help you with completion of the application process. We will not use the contact information for any other purpose unless we obtain your explicit permission.
We will access your calendar in order to place reminders and entries should you choose to accept them. We will not scan the calendar for any other details and will not copy data from your calendar.
We will not access your location unless you give us explicit permission. Should you choose to grant access to location facilities, we will only use this permission to access your location in order to better assist with the completion of the application process in the App.
We will access your device’s network state in order to determine the status of network connectivity to DataFlow’s on-line services. This will allow us to provide a more seamless experience in the case of varying network
Read/Write to your storage
We will Read and Write data to the internal storage on your device in order to complete the application. We will only read the information to which you give us explicit consent, and we will only write data that is used for the purposes of the application process.
We will access the wifi state of your phone to determine the most optimal method of connecting to DataFlow’s services in order to complete the application process.
We will utilise the Vibrate function to provide feedback on the application process.
The Data Protection officer shall expeditiously redress the grievances, but within reasonable time as may be provided in applicable laws.
Please note that email communications are not always secure, so please do not include credit card information or other sensitive information in any email to us.