Privacy Policy

Who we are

The organisation responsible for the personal information covered by this Privacy Policy is:

For data protection purposes, ORSA VERIFY LIMITED acts as the controller for personal information processed for its own website, enquiry and service administration activities, except where a different role is required by the particular circumstances of a processing activity.

Information we may collect

The information we handle depends on how you interact with ORSA VERIFY LIMITED and the nature of the enquiry or service being discussed.

Contact and enquiry information

• Name and contact details.
• Email address and telephone number.
• Information included in an enquiry submitted through the website contact form.
• Information provided during subsequent communications relating to an enquiry or agreed service.

Business and review information

Where relevant to the agreed scope of a service, information may be supplied for the purpose of reviewing business, commercial or supporting documentation.

We only seek information that is relevant to the defined requirement. Individuals should avoid providing information that is not necessary for the enquiry or review.

Website and technical information

When you visit the website, technical information may be processed by our hosting, security and website infrastructure. This can include IP address, browser type, device information, approximate location derived from technical data, pages visited, referring information and information concerning website activity.

How we use personal information

Personal information is used only where there is a relevant purpose for doing so.

• To respond to enquiries and requests submitted through the website.
• To communicate with individuals about a proposed or agreed service.
• To establish and manage the scope of a business information or document review.
• To prepare and provide review-related communications, written summaries or agreed outputs where applicable.
• To maintain appropriate business and administrative records.
• To operate, maintain, secure and improve the website.
• To identify and address website security, technical or operational issues.
• To meet applicable legal and regulatory obligations.

Lawful basis for processing

Depending on the circumstances, ORSA VERIFY LIMITED may rely on one or more lawful bases available under applicable data protection law.

Contractual steps

Where processing is necessary to take steps at an individual’s request before entering into an arrangement, or to perform an agreed arrangement, this may provide the relevant lawful basis.

Legitimate interests

We may process information where it is necessary for our legitimate business interests, provided those interests are balanced against the individual’s rights and interests. Examples can include managing enquiries, maintaining business records, protecting website systems and managing routine business administration.

Legal obligations

Information may be retained or processed where necessary to comply with a legal obligation applicable to the organisation.

Consent

Where consent is the appropriate lawful basis, we will seek it in a clear manner. Where consent can be withdrawn, the withdrawal will not affect processing that was lawfully carried out before the withdrawal.

Information used for review services

ORSA VERIFY LIMITED provides business information review, supporting document review, commercial information review, verification consultation and related review services.

Where information or documents are supplied for an agreed review, they are handled according to the defined scope of that review.

The review process may involve considering information supplied by the person making the enquiry, information available from relevant business sources, and documents provided for the particular assignment.

Review activities do not change the ownership of documents or information supplied by a client or other individual. Information is handled only for the purposes connected with the relevant enquiry, review and associated administration, subject to applicable legal requirements.

When information may be shared

Personal information is not shared simply because it has been provided. Disclosure is considered according to the purpose for which the information was collected and the circumstances of the particular service.

Information may be shared with appropriate service providers where this is necessary to operate the website, manage communications, maintain technical systems or provide related administrative support.

Examples may include website hosting providers, website form infrastructure, email service providers, technical support providers and other organisations that process information on our behalf.

Information may also be disclosed where required by law, by a lawful request from an appropriate authority, or where disclosure is necessary to establish, exercise or defend legal rights.

Information obtained from other sources

Where information about an identifiable individual is obtained from a source other than that individual, applicable privacy information will be provided within the period required by data protection law and, where the relevant statutory rule applies, no later than one month after the information is obtained.

ICO guidance states that where personal information is obtained from another source, privacy information generally needs to be provided within a reasonable period and no later than one month, subject to applicable exceptions. :contentReference[oaicite:1]{index=1}

International data handling

Some website, hosting, communication or technical service providers may process information outside the United Kingdom.

Where personal information is transferred internationally, ORSA VERIFY LIMITED will use the transfer mechanism required by applicable data protection law and will take appropriate steps where required to maintain an appropriate level of protection.

The specific safeguards applicable to an international transfer depend on the service provider, destination and legal circumstances at the relevant time.

How long information is kept

Personal information is retained only for as long as it is reasonably necessary for the purpose for which it was collected, including applicable administrative, legal and record-keeping requirements.

Retention periods are reviewed according to the type of information and the reason it is held. Information that is no longer required will be deleted, anonymised or otherwise disposed of securely where appropriate.

Applicable data protection principles require organisations not to retain personal information for longer than needed and to review retention periods appropriately. :contentReference[oaicite:2]{index=2}

Information security

ORSA VERIFY LIMITED takes reasonable and appropriate measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

Security measures may include access controls, account restrictions, secure communication methods, appropriate website security controls and regular review of the information we hold.

Access to information is limited according to the person’s role and the purpose for which the information is required.

No website or electronic communication method can provide an absolute guarantee of security. Where an incident involving personal information occurs, ORSA VERIFY LIMITED will assess the circumstances and take the steps required under applicable data protection law.

Cookies and website technology

The website may use cookies and similar technologies to support essential website operation, security, functionality and, where applicable, website analysis.

The use of non-essential cookies or similar technologies is handled according to applicable requirements and the choices available through the website.

A separate Cookie Policy explains the types of cookies and similar technologies that may be used and how preferences can be managed.

For more information, please see our Cookie Policy .

Embedded Google Maps

The website may display an embedded Google Maps map to show the location of the ORSA VERIFY LIMITED office.

Google may process technical information when an embedded map is loaded or interacted with. Such processing is subject to Google’s own privacy information and applicable settings.

Where applicable, the website may provide controls relating to non-essential third-party technologies before they are activated.

Your data protection rights

Depending on the circumstances and subject to applicable legal conditions, individuals may have rights in relation to their personal information.

Response timeframe

We will normally respond to a valid personal information rights request without undue delay and, where the statutory one-month period applies, within one calendar month of receiving the request.

Where the request is complex or multiple requests are received, the applicable period may be extended by up to two additional months. Where an extension is necessary, information about the extension and the reason for it will be provided within the first month.

ICO guidance confirms that access requests and erasure requests generally require a response within one month, with a possible further two-month extension for complex requests or multiple requests where the relevant conditions are met. :contentReference[oaicite:3]{index=3}

Identity verification

Where reasonably necessary to protect personal information, we may request proportionate information to confirm the identity of the person making a request. The information requested will be limited to what is reasonably necessary for this purpose.

Withdrawing consent

Where processing is based on consent, an individual may withdraw that consent at any time by contacting us using the details provided below.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Where another lawful basis applies to the relevant processing, withdrawal of consent may not require that processing to stop. We will explain the applicable position where necessary.

Third-party websites and services

The website may contain links to websites or services operated by third parties.

Those organisations operate under their own privacy information and terms. ORSA VERIFY LIMITED is not responsible for the privacy practices of an external website after you leave our website.

We recommend reviewing the privacy information provided by any third-party website before submitting personal information to it.

Information relating to children

The services and website are intended for business and professional enquiries. We do not knowingly seek personal information from children for these purposes.

If you believe that a child has provided personal information through the website, please contact us so that the circumstances can be reviewed and appropriate action considered.

Changes to this Privacy Policy

This Privacy Policy may be reviewed and updated when our website, services, information handling practices or applicable legal requirements change.

Where a material change affects how personal information is processed, the updated information will be made available through this website and, where required, communicated by an appropriate method.

The version published on this page applies from the time it is made available on the website.

Contact us about privacy

If you have a question about this Privacy Policy or wish to exercise a data protection right, please contact ORSA VERIFY LIMITED using the details below.

Raising a concern

If you have concerns about how your personal information has been handled, we encourage you to contact us first so that the matter can be reviewed.

Individuals also have the right to raise a concern with the Information Commissioner’s Office where they consider that their personal information has not been handled in accordance with applicable data protection law.

Further information about individual data protection rights and how to contact the supervisory authority is available from the Information Commissioner’s Office.