Privacy
Who holds what, and who you go to about it.
The distinction that matters
If you are a client of a law firm and have been asked to complete an identity check, that firm is the controller of your personal data. They decide what is collected and why. Falcon Creative Ltd processes it on their instructions only. To exercise your rights, or to ask why you are being asked for something, contact the firm handling your matter — not us. We could not lawfully answer for them.
If you are a law firm, or someone who works at one, Falcon Creative Ltd is the controller of your account data.
What passes through the software
For an identity check: name, date of birth and address; images of the identity document provided; a photograph of the person's face used to match against that document; a proof of address document; and the result of screening against sanctions, politically exposed person and adverse media sources.
The facial image is biometric data and is treated as a special category of personal data. It is used solely to check the person presenting the document is the person it belongs to. It is not sold, and it is not used to train machine learning systems.
How long it is kept
Retention is configured by each law firm, because the firm is the controller and has its own record-keeping obligations under the Money Laundering Regulations 2017. Falcon Creative Ltd does not apply a default retention period and does not delete anything on its own initiative.
Where it is held
Documents are stored in private storage that is not publicly accessible, and can only be retrieved by a signed-in member of the firm that requested the check. The current list of infrastructure and screening providers, where each processes data, and the safeguard relied on for any transfer outside the UK, will be published before the service is available to firms.
Complaints
You can complain to the Information Commissioner's Office at any time — ico.org.uk/make-a-complaint. We would rather you told us first, via our contact page, so we can put it right.
A fuller notice, and the data processing agreement offered to firms, are drafted and awaiting legal review. See docs/legal/ in the project repository.