We have set our optional cookies. By clicking any link on this page you are giving your consent for us to do this. OR: leave cookies off Read about our cookies
NewsroomCareersContact Us

Fair Processing Notices for Cifas' Databases

This page provides the full fair processing notices for Cifas' National Fraud Database and Internal Fraud Database, with further details of how your information will be used, as well as information about your data protection rights.

If you have been referred to this page when applying for services or finance then please read the full National Fraud Database notice.

If you have been referred to this page in the context of being employed by or working for an organisation, including as a contractor or director, then please read the full Internal Fraud Database notice.


National Fraud Database

The words "we", "us", and "our" relate to the organisation that referred you to this page.

GENERAL

1.    Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you.

2.    The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and money laundering, and to verify your identity.

3.    Details of the personal information that will be processed include, for example: name, address, date of birth, contact details, financial information, employment details, device identifiers including IP address and vehicle details.

4.    We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.

5A.    [This paragraph applies if the organisation that referred you to this page is not a public authority.] We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested. Cifas has published its assessment of the legitimate interests in relation to the National Fraud Database

5B.    [This paragraph applies if the organisation that referred you to this page is a public authority.] We process your personal data on the basis that it is necessary in the public interest or in exercising official authority for us to prevent fraud and money laundering, and to verify identity, in order to protect ourselves and to comply with laws that apply to us.

6.    Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.

7.    [This paragraph applies if the organisation that referred you to this page told you that they will use automated decisions.] As part of the processing of your personal data, decisions may be made by automated means. This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity. You have rights in relation to automated decision making: if you want to know more please contact the organisation that referred you to this page.

CONSEQUENCES OF PROCESSING

8.    If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or to employ you, or we may stop providing existing services to you.

9.    A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact the organisation that referred you to this page.

DATA TRANSFERS

10.    Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to "international frameworks" intended to enable secure data sharing.

YOUR RIGHTS

11.    Your personal data is protected by legal rights, which include your rights to object to our processing of your personal data, request that your personal data is erased or corrected, and request access to your personal data.

12.    For more information or to exercise your data protection rights, please contact the organisation that referred you to this page.

13.    You also have a right to complain to the Information Commissioner's Office which regulates the processing of personal data.


Internal Fraud Database

The words "we", "us", and "our" relate to the organisation that referred you to this page.

GENERAL

1.    We will check your details against the Cifas databases established for the purpose of allowing organisations to record and share data on their fraud cases, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct ("Relevant Conduct") carried out by their staff and potential staff. "Staff" means an individual engaged as an employee, director, trainee, homeworker, consultant, contractor, temporary or agency worker, or self-employed individual, whether full or part time or for a fixed-term.

2.    The personal data you have provided, we have collected from you, or we have received from third parties will be used to prevent fraud and other relevant conduct and to verify your identity.

3.    Details of the personal information that will be processed include: name, address, date of birth, any maiden or previous name, contact details, document references, National Insurance Number, and nationality. Where relevant, other data including employment details will also be processed.

4.    We and Cifas may also enable law enforcement agencies to access and use your personal data to detect, investigate, and prevent crime.

5A.    [This paragraph applies if the organisation that referred you to this page is not a public authority.] We process your personal data on the basis that we have a legitimate interest in preventing fraud and other Relevant Conduct, and to verify identity, in order to protect our business and customers and to comply with laws that apply to us. This processing of your personal data is also a requirement of your engagement with us. Cifas has published its assessment of the legitimate interests in relation to the Internal Fraud Database.

5B.    [This paragraph applies if the organisation that referred you to this page is a public authority.] We process your personal data on the basis that it is necessary in the public interest for us to prevent fraud and other Relevant Conduct, and to verify identity, in order to protect ourselves and customers and to comply with laws that apply to us. This processing of your personal data is also a requirement of your engagement with us.

6.    Cifas will hold your personal data for up to six years if you are considered to pose a fraud or Relevant Conduct risk.

CONSEQUENCES OF PROCESSING

7.    Should our investigations identify fraud or any other Relevant Conduct by you when applying for or during the course of your engagement with us, your new engagement may be refused or your existing engagement may be terminated or other disciplinary action taken (subject to your rights under your existing contract and under employment law generally).

8.    A record of any fraudulent or other Relevant Conduct by you will be retained by Cifas and may result in others refusing to employ you. If you have any questions about this, please contact the organisation that referred you to this page.

DATA TRANSFERS

9.    Should Cifas decide to transfer your personal data outside of the European Economic Area, they will impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to "international frameworks" intended to enable secure data sharing.

YOUR RIGHTS

10.    Your personal data is protected by legal rights, which include your rights to object to our processing of your personal data, request that your personal data is erased or corrected, and request access to your personal data.

11.    For more information or to exercise your data protection rights, please contact the organisation that referred you to this page.

12.    You also have a right to complain to the Information Commissioner's Office which regulates the processing of personal data.

Share:

Latest blog posts