VeriTrace Intelligence Limited
Privacy Notice
Last updated: July 2026
Introduction
VeriTrace Intelligence Limited (“VeriTrace”, “we”, “us” or “our”) is an independent UK intelligence and risk consultancy providing open-source intelligence (OSINT), due diligence, background checks, investigative research and risk intelligence services.
We respect individuals' privacy and recognise the importance of handling personal information lawfully, fairly and securely.
This Privacy Notice explains how we collect, use, store, share and protect personal information when individuals visit our website, contact us, participate in our professional network or are involved in an intelligence research engagement.
We process personal data in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who We Are
Data controller: VeriTrace Intelligence Limited
Company registration number: 17305629
Registered office: 61 Bridge Street, Kington, HR5 3DJ, United Kingdom
ICO registration reference: C1977686
Email: enquiries@veritraceintelligence.com
Website: www.veritraceintelligence.com
VeriTrace generally acts as a data controller when determining the purposes and means of processing personal information for its own business activities and independent research.
For particular client engagements, our role may differ. Where appropriate, we establish the respective responsibilities of VeriTrace and its clients in writing.
Personal Information We Collect
The information we process depends on the nature of our relationship with an individual and the purpose of the processing.
Website visitors and prospective clients
We may collect names, email addresses, telephone numbers, organisation details and information submitted through contact forms or correspondence.
Technical information may include IP addresses, browser information, device information and website usage data, subject to applicable cookie and privacy requirements.
Clients and business contacts
We may process contact details, professional information, contractual instructions, billing records, correspondence and information required to manage an engagement.
Subjects of intelligence research
Where necessary for a lawful engagement, we may process relevant personal information obtained from publicly available or other lawfully accessible sources.
Depending on the assignment, this may include professional affiliations, directorships, corporate records, publicly available statements, relevant financial or litigation records, and information concerning identified risks.
The collection and use of such information is assessed for necessity, proportionality and relevance.
Professional network members
Where individuals apply to join or participate in the VeriTrace Network, we may process their application details, professional interests, qualifications, organisational affiliations and relevant membership communications.
How We Use Personal Information
We process personal information for specified business and professional purposes, including:
Responding to enquiries and communicating with prospective clients.
Assessing, accepting and administering client engagements.
Conducting lawful intelligence research, due diligence and risk assessments.
Preparing and delivering agreed intelligence reports.
Managing billing, accounting and contractual obligations.
Protecting our systems, information and business operations.
Meeting applicable legal and regulatory requirements.
Managing professional network applications and participation.
Sending newsletters or professional updates where permitted by applicable marketing and privacy laws.
We do not sell personal information.
Lawful Bases for Processing
We identify an appropriate lawful basis under UK GDPR for each processing activity.
Depending on the circumstances, these may include:
Contract: Where processing is necessary to perform a contract with an individual or take requested steps before entering into one.
Legal obligation: Where processing is necessary to comply with applicable legal requirements.
Legitimate interests: Where processing is necessary for a legitimate business or third-party interest and is not overridden by the individual's rights and freedoms. Relevant purposes may include business administration, information security, proportionate due diligence and lawful investigative research.
Consent: Where consent is required, including for certain marketing activities or non-essential cookies.
Where consent is the lawful basis, individuals may withdraw it at any time.
Where applicable, VeriTrace may also consider another lawful basis permitted by UK GDPR, including recognised legitimate interests, provided the relevant statutory conditions are met.
Intelligence Research Involving Third Parties
Certain engagements involve research about individuals who are not direct clients of VeriTrace.
Such processing may be necessary for legitimate purposes including corporate due diligence, fraud prevention, litigation support, background checks and risk assessment.
Before undertaking research, we assess the lawful purpose, necessity, proportionality, relevance and applicable data protection requirements.
We distinguish factual findings from allegations and analytical assessments and seek to avoid collecting excessive or irrelevant personal information.
We do not undertake unlawful surveillance, pretexting, unauthorised access to devices or systems, or other unlawful methods of obtaining information.
Where personal information has not been obtained directly from an individual, we consider the transparency requirements of Article 14 UK GDPR.
Where an applicable legal exemption or exception is relied upon, its use is assessed and documented in accordance with the relevant statutory requirements.
We do not assume that investigative research automatically qualifies for an exemption.
Sensitive and Criminal Offence Information
Some intelligence assignments may involve information relating to criminal allegations, convictions, health, political opinions or other sensitive matters.
We process special category personal data or criminal offence data only where an appropriate legal basis, additional statutory condition and any required safeguards have been established.
We apply additional controls to such information, including access restrictions, data minimisation and appropriate retention arrangements.
Sharing Personal Information
We may share personal information where necessary and lawful with:
Clients receiving agreed intelligence deliverables.
Contracted technology, hosting and communications providers.
Approved professional advisers, insurers or specialist service providers.
Regulatory authorities, courts or law enforcement bodies where legally required or otherwise lawfully permitted.
Relevant service providers may include Squarespace and Proton.
We assess the need for confidentiality, contractual safeguards and appropriate data protection arrangements before sharing personal information.
We do not disclose confidential research findings for unrelated commercial purposes.
International Data Transfers
VeriTrace may use technology providers or professional service providers operating outside the United Kingdom.
Where personal information is transferred internationally, we assess the applicable UK data protection requirements.
Where required, transfers are supported by an applicable UK adequacy regulation, appropriate contractual safeguards or another lawful transfer mechanism.
Our use of Squarespace and Proton is subject to the relevant provider arrangements and applicable international transfer requirements.
Information Security
We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, alteration, disclosure or destruction.
These measures may include access controls, secure communications, restricted handling of investigative material and appropriate contractual safeguards.
Access to personal information is limited to individuals who require it for legitimate business purposes.
No electronic system can be guaranteed to be completely secure, but we take reasonable steps to manage and reduce relevant risks.
Data Retention
We retain personal information only for as long as necessary for the purposes for which it was collected, including applicable legal, regulatory, contractual and evidential requirements.
Our intended retention periods include:
Website enquiries: Generally up to 12 months, unless an enquiry becomes part of a client engagement or another lawful retention requirement applies.
Client and engagement records: Generally six years following completion of an engagement, subject to applicable legal requirements and documented exceptions.
Intelligence research material: Retained according to the purpose of the engagement, applicable legal requirements and our documented internal retention schedule.
Professional network records: Retained while necessary for membership administration and any applicable post-membership obligations.
Records are securely deleted, anonymised or otherwise disposed of when no longer required.
Your Data Protection Rights
Depending on the circumstances and applicable legal provisions, individuals may have the right to:
Request access to their personal information.
Request correction of inaccurate or incomplete information.
Request erasure where the relevant conditions apply.
Request restriction of processing.
Object to processing, including processing based on legitimate interests.
Request data portability where applicable.
Withdraw consent where processing relies on consent.
Exercise rights relating to solely automated decision-making where applicable.
Certain rights may be restricted where a lawful exemption or exception applies.
Requests can be sent to enquiries@veritraceintelligence.com.
We will respond in accordance with applicable legal requirements.
Cookies and Website Analytics
Our website may use cookies and similar technologies necessary for website functionality, security, performance or other permitted purposes.
Where required by law, we seek consent before using non-essential cookies or similar technologies.
Further information about the technologies used and available choices is provided in our Cookie Notice.
Marketing Communications
Where permitted by law, we may send professional updates, newsletters or information about VeriTrace services.
We respect applicable marketing consent and electronic communications requirements.
Recipients may unsubscribe from marketing communications at any time using the instructions provided or by contacting us directly.
Complaints
If you have concerns about how VeriTrace processes your personal information, please contact us so that we can investigate your concerns.
Email: enquiries@veritraceintelligence.com
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Website: www.ico.org.uk
Changes to This Notice
We may update this Privacy Notice to reflect changes in our services, operational practices, technology or applicable legal requirements.
The revision date displayed at the beginning of this notice will indicate when it was last updated.
Contact Details
VeriTrace Intelligence Limited
Registered in England and Wales
Company Registration Number: 17305629
Registered Office
61 Bridge Street
Kington
HR5 3DJ
United Kingdom
Email: enquiries@veritraceintelligence.com
Website: www.veritraceintelligence.com