Privacy Policy

1. Introduction

TrustRegister Limited ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our identity verification orchestration platform.

TrustRegister is not affiliated with Companies House. We are an independent software provider that helps organizations comply with Companies House identity verification requirements.

2. Information We Collect

Account Information

• Name, email address, and contact details
• Company/firm information
• Account credentials and preferences

Verification Data

• Company and officer information from Companies House
• Email addresses and phone numbers for verification invitations
• Verification status and completion timestamps
• Evidence metadata and audit logs

What We DON'T Collect

• Biometric data or copies of identity documents
• Personal details beyond verification requirements
• Financial or sensitive personal information
• Data unrelated to identity verification

3. How We Use Your Information

• Provide identity verification orchestration services
• Send verification invitations and reminders
• Generate compliance reports and evidence packs
• Maintain audit trails for regulatory purposes
• Improve our services and customer support

4. Data Controller vs Processor

5. Data Sharing and Disclosure

We may share information:

• With identity verification providers (as instructed by you)
• With subprocessors listed in our Subprocessors List
• When required by law or court order
• To protect our rights or the safety of others

6. Data Security

• End-to-end encryption (TLS 1.3 in transit, AES-256 at rest)
• UK/EU data hosting with ISO 27001 certified facilities
• Role-based access controls and multi-factor authentication
• Regular security audits and monitoring
• Incident response procedures

7. Data Retention

• Evidence packs: 7 years (Companies House requirement)
• Account information: Duration of service + 2 years
• Audit logs: 7 years for compliance purposes
• Marketing data: Until consent withdrawn

8. Your Rights (GDPR)

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase data (subject to retention requirements)
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent

9. International Transfers

All data is processed and stored within the UK and EU. We do not transfer personal data outside the European Economic Area unless absolutely necessary and with appropriate safeguards in place.

10. Contact Information

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through our platform. The "Last updated" date at the top of this policy indicates when it was last revised.