Data processing terms

When you put your clients’ details into Certaby, or collect them through it (a client link or a digital ID check), your firm is the controller of that personal data and Certaby is your processor: we process it only to provide Certaby to you. Certaby is the trading name of Amir Naghieh, 3 Pembroke Road, Ruislip, HA4 8NQ, United Kingdom, registered with the Information Commissioner’s Office as ZC273024.

These terms form part of our terms of service and set out what UK GDPR Article 28 requires. How we handle your own account details (as controller) is in our privacy notice.

Purpose: running the checks you ask for (sanctions, PEP and adverse media, company and director checks, property checks, digital ID and Right to Rent), keeping your transaction records, evidence and certificates, and the monitoring you switch on.

Whose data: your clients and the people connected with them: tenants, landlords, buyers, sellers, guarantors, payers, company directors and owners, and anyone else you add.

What data: names, dates of birth, nationality and country of residence, email addresses (for links you send), addresses and postcodes, company roles, check results, your risk and source of funds records and the files you upload, Right to Rent outcomes, and for a digital ID check the identity service’s report (the person’s photo from their selfie, an image of their ID document and the details read from it). Some results may include information about criminal offences (sanctions and adverse media). The face matching in a digital ID check (biometric data) is done by our identity partner; we keep its report, not any biometric template.

How long: while you use Certaby, and then for the periods in section 6.

• We act only on your instructions: using Certaby as it is designed, your settings, and these terms. If the law requires us to do something else, we tell you first unless the law forbids it.
• Everyone who can access your data is bound by confidentiality.
• We keep it secure: encrypted in transit and at rest, stored in London, reachable only by your signed-in team, with files downloaded through links that expire after five minutes, least-privilege access keys, and logging that alerts us to errors.
• We help you answer your clients’ requests (access, correction, deletion) and help with your security, breach and impact assessment duties.
• We tell you without undue delay, and within 48 hours of finding out, if a personal data breach affects your data.
• We give you the information you need to show these terms are kept, and allow a reasonable audit (once a year on 30 days’ notice, or after a breach).
• When you stop using Certaby, we delete or return your data as section 7 says.

You authorise us to use these companies. Each is bound by written data protection terms that protect your data as these terms do, and we stay responsible to you for them. We will email you at least 14 days before a new company starts processing your clients’ data, so you can object (and stop using the check it serves).

Where data is processed outside the UK, we rely on the UK’s adequacy regulations (the EU) or the UK International Data Transfer Agreement or Addendum (elsewhere).

You have a lawful reason for each check (usually the money-laundering rules or the Right to Rent scheme), you tell your clients that you use Certaby and its partners for these checks, you only send us the data the checks need, and your instructions to us are lawful.

• Transactions, check results, certificates, risk records and the evidence files you upload: 7 years, then deleted.
• Digital ID reports (the photo and ID image): until 5 years after you mark the transaction complete, or 6 years after the check if it is never marked complete, then deleted. You can delete one sooner once you have filed a copy. The short record of the check stays with the transaction.
• Your own record-keeping duty stays with you: the money-laundering rules ask you to keep these records for 5 years after the business relationship ends, and the Right to Rent rules for the tenancy plus one year. Download what you need for your own file.
• Deleted files leave our backups within 30 days.

You can download your records and certificates first. We then keep them for the periods in section 6 (so they remain available to you if HMRC or another regulator asks), unless you tell us in writing to delete them sooner, in which case we delete them within 30 days.

Data protection questions, requests and breach reports: dpo@certaby.com.