When we provide identity verification services to business customers, we usually act as a data processor. This means we process personal data on your behalf, under your instructions.
We also act as a data controller when we use personal data for our own legal, security, fraud prevention and service management purposes.
For example, when you report fraud to Vouchsafe, or our systems detect suspicious activity, we act as the controller of the fraud intelligence we collect or generate. We use this information to detect and prevent further fraud across our network.
What are my duties when I send customers to Vouchsafe?
If you send people to Vouchsafe, you will usually be the controller. This means you will need to:
decide why the check is needed and what your lawful basis is
tell your users about your use of Vouchsafe in your privacy notice
make sure your use of identity checks is necessary and proportionate
have the right contract terms in place with us, including our DPA
handle data rights requests where you are the controller
How can Vouchsafe help?
During setup, we can provide:
information for your ROPA
exemplar DPIA and LIA templates for you to customise to your business's context
boilerplate wording for you to insert in privacy notices and UI prompts
We cannot provide legal advice - you remain responsible for your own GDPR compliance.
Where can I find Vouchsafe’s GDPR documents?
Our GDPR documents are in our trust centre.
If you need more help, contact [email protected] or speak to your Vouchsafe customer success manager.