SureScore Privacy Policy V1.0
Introduction
This Privacy Notice outlines how CDS New Ventures T/A SureCert ("we", "our") handles personal information through our SureScore service, in line with GDPR. Our service involves comprehensive identity verification checks for individuals and organisations on behalf of our Client, Invest Northern Ireland.
| Data Controller | Data Processor |
|---|---|
| Invest Northern Ireland | CDS New Ventures |
| Data Protection Officer | T/A SureCert |
| Information Governance Team | Catalyst, |
| Invest NI | Queens Rd, |
| Bedford Square, | Belfast BT3 9DT |
| 1 Bedford Street, | |
| Belfast BT2 7ES |
This privacy notice explains how the SureScore service uses information about you and the ways in which we will safeguard your data.
Why do we collect your personal information?
As the Data Processor, we process personal data on behalf of our Clients, operating under their guidance specifically for conducting Know Your Customer (KYC) checks and identity assurance through SureScore. This involves confirming the identities of individuals, directors, and organisations, while also maintaining the integrity and security of the verification process. This process is conducted so that the entity being verified may be eligible to avail of specific services.
| Purpose of Check | Type of Check |
|---|---|
| Assess an individual is who they say they are | Identity |
| Identity with Document | |
| Global Identity | |
| Document | |
| Document Analyser | |
| The individual can act on behalf of the company they are representing | Company Profile |
| There is nothing about the individual that would prevent a grant being awarded | Adverse Financial |
| Mobile Number | |
| PEPs, Sanctions, Adverse Media | |
| Disqualified Director | |
| There is nothing about the company that would prevent a grant being awarded | Company Credit Report |
| Bank Account Check | |
| Advanced Corporate Check |
What Information do we process?
To create an account/verify identity, we need personal details including your email address, name, address, contact telephone number and date of birth. If your account needs to be verified; we will also need to collect information that supports your identity, e.g. a photograph of your passport or driving licence and other documents such as utility bills or birth certificate.
SureScore uses software to capture images of your photo-ID (passport or driving licence) and a self-portrait photograph (“selfie”).
SureScore uses AI software and biometric algorithms to make facial comparison between the image of your photo-ID (passport or driving licence) and your selfie. The personal information recorded on your SureScore account is then used to perform background checks to establish your real-world existence. This process is fast and, for most people, will not need any other documentation.
Where it is not possible to use this method to get verified, you will be able to upload copies of your documents to our 'Last Mile’ automated document checking service, e.g. bank statement, utility bill, or birth certificate) as well as a “selfie” photograph. Alternatively, you will be able to take your documents to Invest Northern Ireland, Bedford Square, 1 Bedford Street, Belfast BT2 7ES.
Data fields collected include, but are not limited to, names, date of birth, address history, contact details, company information, and financial data. These are necessary for identity verification, company checks, and compliance.
| What We Collect | Why We Need It |
|---|---|
| First and Last Name | To identify you for various checks like identity confirmation and financial background assessments. |
| Date of Birth | Helps verify your age and identity. |
| Address Details | Used to confirm your location and past addresses for thorough checks. |
| Gender, Title | Needed for some financial and identity checks. |
| Financial Information | To conduct financial assessments and verify bank account details. |
| Contact Details | To verify your contact information. |
| Company Information | For verifying your association and the company background. |
| Email Address, Phone Number | To verify the validity and reliability of your digital contact data. |
Use of cookies
Cookies are small files saved on your phone, tablet or computer when you visit a website. We use cookies to make SureScore work and collect information about how you use our service.
Essential cookies
Essential cookies keep your information secure while you use SureScore. We do not need to ask permission to use them. The following are essential cookies used in SureScore.
| Name | Purpose | Expires |
|---|---|---|
| .SureScore.Antiforgery.C | This cookie is for security. To prevent unauthenticated attacks on the system. | When your session ends |
| .SureScore.Session.C | This helps us manage your session activity. | When your session ends |
| ARRAffinity | Used for load balancing to make sure the visitor page requests are routed to the same server in any browsing session. | When your session ends |
| ARRAffinitySameSite | Used for load balancing to make sure the visitor page requests are routed to the same server in any browsing session. | When your session ends |
| CitizenApplicationCookie | This helps us manage your session activity. | When your session ends |
How is my Personal Information Stored?
Your personal information is collected during the SureScore account creation and verification process. It is encrypted and stored in a protected database which is not accessible by other bodies and there are strict controls in place to ensure only authorised individuals can manage/administer the technical infrastructure supporting it.
Do you share my personal data with anyone?
SureScore collects personal information from the user and shares this with Invest Northern Ireland for the purpose of (i) matching to the services they want to use and, for services which require a higher level of assurance, (ii) verifying their identity.
We use a third-party processor called Civica, who have been contracted to provide the SureScore service to enable you to use certain Invest Northern Ireland facilities. The data is processed securely, and they will not process the data for any other purpose.
Data Sharing, Disclosure, and Algorithmic Improvements
For verification purposes, we share personal data with third-party suppliers, including Experian (and partners), Mitek, First Advantage, and Companies House. The outcomes of the verification checks are shared with our client, Invest Northern Ireland.
Experian: Privacy Policy
Mitek: Privacy Policy
First Advantage: Privacy Policy
Companies House: Privacy Policy
Experian data checks are used for identity checking and contact information verification including email and phone number. Experian may share this information with their own data providers including Prove and LexisNexis.
Data shared with Experian is not used to retrieve credit information. It does not have any impact on your credit rating or history. SureCert may appear as an audit footprint on a credit report. Audit footprints do not affect your credit score.
The data is processed securely, retained for 30 days to provide support, and we will not process the data for any other purpose than those explicitly outlined in this policy. We share the images of your documents with our third-party Data Verification Suppliers for the purpose of checking the validity of the document and carrying out facial comparison between a photo ID and the selfie, and to extend the numbers and types of documents we can accept.
AI Algorithm Data Usage: Additionally, to maintain accuracy and improve the efficiency of our identity verification services, we use personal information collected during the SureScore verification process to enhance our AI models and machine learning algorithms. This occurs within the 30-day retention period, primarily to ensure our technology stays up-to-date and adapts to new types of fraud attacks, variations in ID documents, and emerging patterns in data.
Our objective is to improve the quality and reliability of our services by continuously training our algorithms to recognise specific patterns and accurately predict verification outcomes. This approach helps us to better detect fraud, reduce bias, and develop new features that enhance our overall service quality.
We rely on the legitimate interests of our clients, and the wider public to effectively combat fraud and ensure secure digital identification. We process sensitive information based on substantial public interest, including safeguarding against identity fraud. Specific safeguards like pseudonymisation, impact assessments, and security controls protect personal data and uphold individual rights.
Aggregated and pseudonymised data may also be used for statistical analysis, benchmarking, and insights to identify fraud trends and inform product improvements.
What is the lawful basis for processing your data?
You will create a SureScore account in order to access some specific services from Invest Northern Ireland. Your personal data is processed for the performance of a task carried out in the public interest, or the exercise of official authority vested in the data controller, in line with Article 6(1)(e) of the UK GDPR. We process biometric data to fulfil our duties in the public interest in our function as a government department under Article 9(2)(g) of the UK GDPR.
Access to your information
Should you wish to receive a detailed report of the personal data we hold pertaining to you, please direct your request to Invest Northern Ireland.
Requests can be made in the following ways:
- By contacting Invest Northern Ireland directly via email dpo@investni.com.
- By telephone, reaching out to Invest Northern Ireland's dedicated support team at 0800 181 4422, available from 9:00am to 5:00pm on standard working days.
We are committed to providing you with complete access to your information in compliance with data protection legislation, ensuring transparency and empowerment in managing your privacy.
How long do you keep my personal data?
We take steps to ensure data accuracy and retain personal information as required by law or as necessary for the services provided.
Documentary evidence uploaded during the online verification process is retained for 30 days after an account has been verified and is then permanently deleted. Verification decisions are retained for a minimum of three years.
Data Protection
We implement robust security measures to protect personal data against unauthorised access, alteration, or destruction.
What We Don't Do
We uphold the highest standards of privacy. Under no circumstances do we sell your personal data. We are committed to protecting your information from unauthorised disclosure. However, there are certain legal circumstances under which we may be required to share your data. For instance, we may need to disclose specific details to law enforcement if compelled by a court order or as part of legal proceedings. Rest assured, such disclosures are strictly governed by legal processes, and we ensure transparency with our users wherever possible.
Cross-Border Data Transfers
Personal data may be transferred internationally as necessary for the International ID Verification services we provide, with appropriate safeguards.
Privacy Mission Statement
We are committed to the highest standards of privacy, incorporating GDPR's six data protection principles into our operations.
-
Lawfulness, Fairness, and Transparency: Processing of personal data must be lawful, fair, and transparent to the data subject.
-
Purpose Limitation: Data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
-
Data Minimisation: Only data that is necessary for the purposes for which it is processed should be collected and maintained.
-
Accuracy: Personal data must be accurate and kept up to date.
-
Storage Limitation: Personal data should be kept in a form that permits identification of data subjects for no longer than necessary for the purposes for which the personal data are processed.
-
Integrity and Confidentiality (Security): Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
Your Rights
You have rights over your personal data, including access, correction, and deletion. Requests should be directed to the organisation that engaged our services.
Under data protection legislation, you have rights as an individual which you can exercise in relation to the information we process.
To make a request for any personal information we may hold, or to raise an objection about the processing we carry out, you should put the request in writing and email it to dpo@investni.com.
If, at any point, you believe the information we process on you is incorrect, you can ask to have this information corrected.
If you decide you would like to have your Invest NI account deleted from the SureScore service, you can request its removal either by phone call to 0800 181 4422 during working hours, 9:00am to 5:00pm or by email to enquiry@investni.com.
If you wish to raise a complaint about how we have handled your data, you can contact Invest Northern Ireland's Data Protection Officer via dpo@investni.com who will investigate the matter.
If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law, you can complain to the Information Commissioner at: casework@ico.org.uk or:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Statement of Fair Processing
When using SureScore for verification purposes, we utilise information provided by third-party suppliers to verify your identity. If false or inaccurate information is detected, it may be recorded and shared with relevant authorities for fraud prevention.
We may collaborate with credit reference agencies and fraud prevention agencies to access public information. Note that a search "footprint" may be recorded on your credit report, which will not impact your future credit eligibility.
If you engage with overseas entities, your information may be transferred to them. By using SureScore, you acknowledge and agree to these data processing practices.
By proceeding, you confirm your understanding of the above statement of fair processing and agree to use SureScore.
Changes to This Policy
This Privacy Policy may be updated periodically. Current version: V1.0, last reviewed 30/10/2024.
For any inquiries or concerns regarding our privacy practices, please contact us at support@surecert.com.