Privacy Notice

About this notice

This Privacy Notice explains how Integri Limited collects, uses, stores, and protects your personal data when you use our services or interact with us. If you have any questions, contact us at office@integri.uk.

1. Who We Are

Integri Limited is registered with the Information Commissioner's Office as a data controller, registration number ZC029967. We provide governance and compliance services to organisations responsible for appointments, selection and public standards, and to individuals preparing to enter positions of greater responsibility, visibility or professional scrutiny.

• Company name: Integri Limited
• Registered address: 124 City Road, London, EC1V 2NX
• Registered in: England and Wales
• ICO registration: ZC029967
• Contact email: office@integri.uk
• Website: integri.uk

2. What Personal Data We Collect

The personal data we collect depends on which of our services you use or enquire about.

2.1 Data collected from clients and enquirers

• Name, job title, and contact details (email address, telephone number, postal address)
• Organisation name and role
• Information provided in the course of commissioning, enquiring about, or subscribing to our services
• Payment and billing information where applicable
• Communications between you and Integri

2.2 Data collected in connection with Verify assessments

When Integri conducts a Verify assessment, we process personal data about the subject of the assessment. This data is collected from publicly accessible sources only. Assessment material is held on a dedicated system. Commission material is transferred to and from that system using encrypted removable media rather than by internet transfer to or from the system. Where third-party research services are used, Integri uses an internal matter reference rather than the subject's name as the matter reference.

• Name, date of birth (year), occupation, and role sought
• Publicly accessible social media content
• Press coverage and news archive content
• Public records including Companies House data and planning register entries
• Council committee minutes and other publicly available official records

Verify assessments may involve processing of special category data, including data relating to political opinions, religious or philosophical beliefs, and other Article 9 characteristics where such data appears in publicly accessible content. Such information is substantively processed only where an applicable Article 9 condition, and any required condition under Schedule 1 to the Data Protection Act 2018, has been identified and documented. The approach taken where such information is encountered unexpectedly is described at Section 3.1.

2.3 Data collected through Sustain

Sustain audit trail data is pseudonymised at the point of creation. All submissions are logged against a pseudonymised identifier. The key linking pseudonymised IDs to real individuals is held separately under strict access controls and is never stored alongside the audit data.

• Draft social media content submitted by you for screening
• Pseudonymised audit trail data, submission timestamps, screening outputs, and override records
• Account and subscription information

2.4 Data collected through Induct

• Questionnaire responses submitted during the Induct programme
• Information about your elected role, governance history, and declared interests
• Contact details and account information

2.5 Data collected in connection with the Public Profile Readiness Review

A Readiness Review is commissioned by an individual in respect of themselves. Data falls into three categories.

Administrative and identity data. Name, contact details, the role or type of role being prepared for, payment and billing information, and a record confirming that identity confirmation was completed, the method used, the date, and the type of document displayed. Identity is confirmed during a live, unrecorded video call at which you display a current passport or driving licence to the camera. Integri does not request or retain a copy, scan, photograph or document file, and no document number or other identifying detail taken from the document is recorded.

Assessment working material. Identifiers supplied by you for the purpose of the review, including account names, previous names and other identifiers; and publicly accessible material associated with you gathered during the assessment, including social media content, press coverage, public records and other publicly available sources within the agreed scope.

Report and quality assurance record. The completed report and the minimum record necessary to evidence proper delivery of the service.

Readiness Reviews may involve processing of special category data, including data relating to political opinions, religious or philosophical beliefs, racial or ethnic origin, trade union membership, health, sex life or sexual orientation, where such data appears in publicly accessible material attributable to you. Reviews may also encounter information relating to criminal allegations, investigations, proceedings, convictions or related security measures where that information is publicly available.

2.6 Information relating to other people

Publicly accessible sources may incidentally contain information relating to individuals other than the subject of an assessment. Integri does not seek to identify, assess or profile those individuals. Their information is excluded, redacted or deleted unless it is necessary to understand material properly attributable to the subject, and any proposed retention or reporting of identifiable third party information requires a documented necessity review.

3. Legal Basis for Processing

Article 6(1)(b) Contract performance. Processing necessary to perform the service agreement between Integri and the client. This includes personal data necessary to accept, administer and deliver a Public Profile Readiness Review commissioned by you, including the identity confirmation necessary to establish that the review is self-commissioned.

Article 6(1)(f) Legitimate interests. Processing necessary for Integri's legitimate interests in providing governance risk assessment services and maintaining platform security, and where it is necessary and proportionate to retain minimum records for quality assurance, complaints handling, enforcement of contractual rights, insurance matters, or the establishment, exercise or defence of legal claims, where not overridden by your rights.

Article 6(1)(c) Legal obligation. Processing necessary to comply with UK GDPR, the Data Protection Act 2018, and other applicable law.

Article 6(1)(a) Consent. Where relied upon for special category data or criminal offence data. You may withdraw consent at any time by contacting office@integri.uk.

3.1 Special category data, Article 9 conditions

• Article 9(2)(e) data manifestly made public by the data subject. This condition applies only where the relevant special category information has been manifestly made public by the individual to whom it relates. Information does not fall within this condition merely because it is publicly accessible, or because it has been published by a newspaper, public body or other third party.
• Article 9(2)(a) explicit consent. Applies to special category data processed to administer, conduct, quality-assure and deliver a Public Profile Readiness Review, and to retain the relevant review records for the purposes and periods described in this Privacy Notice, where you have given explicit consent to that processing. Also applies to special category data processed through Sustain where the subscriber submits such content for screening.
• Article 9(2)(f) legal claims. Where retained material contains special category data, Integri may process the minimum information necessary for the establishment, exercise or defence of legal claims.

Special category information is substantively processed only where an applicable Article 9 condition, and any required condition under Schedule 1 to the Data Protection Act 2018, has been identified and documented. Where potentially relevant special category information is encountered unexpectedly, Integri limits its processing to the minimum necessary to determine whether an applicable condition exists. If no condition applies, the information is not copied into the assessment record, retained, substantively assessed or reported, and any temporary copy created during that assessment is deleted promptly.

3.2 Criminal offence data

Article 10 UK GDPR, section 10(5) and Schedule 1, Part 3, paragraph 29 of the Data Protection Act 2018, consent.

Where the review involves personal data relating to criminal allegations, investigations, proceedings, convictions or related security measures concerning you, Integri processes that information only where it is necessary to administer, conduct, quality-assure and deliver the review, and to retain the relevant review records for the purposes and periods described in this Privacy Notice, and where you have given specific, informed and affirmative consent.

Article 10 UK GDPR, section 10(5) and Schedule 1, Part 3, paragraph 33 of the Data Protection Act 2018, legal claims.

Where retained material contains criminal offence data, Integri may process the minimum information necessary in connection with legal proceedings, obtaining legal advice, or establishing, exercising or defending legal rights.

In every other case, criminal offence data is substantively processed only where an applicable condition under Schedule 1 to the Data Protection Act 2018 has been identified and documented, together with any appropriate policy document required by that Schedule. Where information relating to criminal allegations, proceedings or convictions is encountered unexpectedly, Integri limits its processing to the minimum necessary to determine whether an applicable condition exists. If no condition applies, the information is not copied into the assessment record, retained, substantively assessed or reported, and any temporary copy created during that assessment is deleted promptly.

3.3 Withdrawal of consent

You may withdraw either consent at any time. Withdrawal does not affect processing lawfully carried out before withdrawal. Because the relevant processing may be necessary to complete the review, withdrawal will normally require Integri to stop the assessment and may prevent issue of the report.

Integri will delete personal data for which it no longer has a lawful basis, except where limited retention remains necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

4. How We Use Your Personal Data

Providing services. To deliver Verify assessments, Induct programmes, Sustain screening and Readiness Reviews in accordance with our service agreements.

Readiness Reviews. To confirm your identity, conduct the assessment you have commissioned, produce and quality-assure the report, and maintain the minimum records necessary to evidence proper delivery of the service.

Communications. To respond to enquiries, provide service updates, and communicate about your account or commission.

Quality assurance. To maintain and improve the quality of our assessments and services.

Audit trails. To maintain pseudonymised records of Sustain screening submissions, results, and workflow actions.

Legal compliance. To comply with UK GDPR, the Data Protection Act 2018, and other applicable law.

Complaints handling. To receive, investigate, and respond to data protection complaints.

Platform security. To protect the security and integrity of our systems and services.

5. Who We Share Your Data With

Integri does not sell personal data. We may share personal data in the following limited circumstances:

Service providers. Integri uses selected third party providers in connection with secure storage, communications and payment processing. Some providers process personal data solely on Integri's documented instructions as data processors. Others may act as independent controllers for limited purposes specified in their own privacy information, including payment security, fraud prevention or compliance with legal obligations.

AI service providers. Personal data submitted for Sustain screening may be processed by our AI service provider(s) as data processors acting on our instructions, under appropriate data processing agreements.

Legal obligation. Where required by law, court order, or lawful request from the ICO or other regulatory authority.

Professional advisers. Where necessary, subject to appropriate confidentiality obligations.

Business transfer. In the event of a merger or acquisition, subject to the same protections as set out in this notice.

Readiness Review confidentiality

Readiness Review reports are issued to the client alone. Other than processing by service providers necessary to operate and deliver the service, or limited disclosure to professional advisers, insurers or public authorities where lawfully necessary, Integri does not disclose the existence or content of a Readiness Review to any employer, appointing body, regulator or other third party.

No selling of data

Integri does not sell, rent, or otherwise commercially exploit personal data. We do not share personal data with third parties for advertising, profiling, or political targeting purposes.

6. International Data Transfers

Where Integri uses service providers that transfer personal data outside the UK, we ensure that appropriate safeguards are in place, including standard contractual clauses, adequacy decisions, or other approved transfer mechanisms. We will update this notice to identify specific providers and transfer mechanisms when these arrangements are finalised.

7. How Long We Keep Your Data

Verify assessment data. Up to three years from the date of issue of the relevant report. This period is under review and will be replaced by separate periods for raw search material, working assessment material, the issued report and the quality assurance record.

Induct programme data. Two years from the completion of the programme.

Sustain audit trail data. Three years following termination of the relevant subscription.

Readiness Review, administrative data. Up to twelve months from the date of issue of the report, except for accounting, transaction or contractual records retained under Integri's applicable financial and legal retention schedule.

Readiness Review, assessment working material. Up to twelve months from the date of issue of the report.

Readiness Review, report and quality assurance record. Up to twelve months from the date of issue of the report.

Identity confirmation record. Confirmation that identity confirmation took place, the method used, the date and the type of document displayed. Retained for up to twelve months from the date of issue of the report.

Identification document copies. Not routinely collected. No copy, scan, photograph or document file is requested or retained. Any unsolicited copy is deleted promptly, and only a minimal record that a copy was received and deleted is kept.

Client contact and account data. Duration of the client relationship and six years following its end.

Data protection complaints. Three years from the date of final resolution.

Enquiry and communications data. Two years from the date of the last communication where no service agreement is entered into.

The twelve-month Readiness Review retention periods are intended to support quality assurance, factual correction, complaints handling, contractual administration, insurance requirements and, where necessary, the establishment, exercise or defence of legal claims.

These are maximum standard periods. Personal data may be deleted earlier where it is no longer necessary and no other lawful basis requires its retention.

Readiness Review information is not retained to create a continuing historical profile of the client and is not used for unrelated research, monitoring, marketing or profiling.

8. Your Rights

Access. Request a copy of the personal data we hold about you.

Rectification. Ask us to correct inaccurate or incomplete personal data.

Erasure. Ask us to delete your personal data in certain circumstances.

Restriction. Ask us to restrict processing of your personal data in certain circumstances.

Portability. Receive your data in a structured, machine-readable format where processing is based on consent or contract.

Object. Object to processing based on legitimate interests. See Section 8.1 below.

Withdraw consent. Withdraw consent at any time by contacting office@integri.uk.

To exercise any of these rights, contact office@integri.uk with the subject line 'Data Subject Rights Request'. We will respond within one calendar month.

You also have the right to complain to Integri under section 164A of the Data Protection Act 2018, and to the Information Commissioner under section 165. Section 9 explains how.

8.1 Your right to object

Where Integri processes your personal data on the basis of its legitimate interests, you have the right to object on grounds relating to your particular situation. You do not need to use legal terminology, but it helps if you explain how the processing affects you.

If you object, Integri will suspend the relevant processing while it considers your objection. The right is not absolute. Integri may continue only where it can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims. Integri will tell you its decision and the reasons for it, and will tell you how to complain if you disagree with it.

To object, contact office@integri.uk with the subject line 'Objection'.

Note on Verify assessments

Where the subject of a Verify assessment wishes to exercise their data subject rights, they should contact us at office@integri.uk. We will handle all such requests in accordance with our UK GDPR obligations.

9. Your Right to Complain

If you consider that Integri has infringed data protection law in connection with your personal data, you have the right to make a complaint to Integri Limited under section 164A of the Data Protection Act 2018.

• Email: office@integri.uk
• Post: Data Protection Contact, Integri Limited, 124 City Road, London, EC1V 2NX

You do not need to use a particular form or describe your concern using legal terminology. It helps if you mark your message 'Data Protection Complaint', but a complaint is treated as a complaint however it reaches us.

We will acknowledge receipt within five working days, investigate the complaint without undue delay, keep you appropriately informed and communicate the outcome to you. If that takes longer than one calendar month because of the complexity of the complaint or the need to obtain further information, we will explain the reason, provide a revised timetable and keep you informed of progress. Every complaint is assigned a unique reference number.

If you need to make a complaint in another format, or require any adjustment to the process, tell us and we will make appropriate arrangements.

You also have the right to make a complaint to the Information Commissioner under section 165 of the Data Protection Act 2018. The Commissioner generally recommends giving the organisation an opportunity to complete its complaints process first, although you may contact the Commissioner at any time.

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Security

Integri takes appropriate technical and organisational measures to protect personal data. These include preparation and storage of assessment material on a dedicated system, full-disk encryption and authentication before system start, storage of case material in an encrypted container, transfer of commission material using hardware-encrypted removable media, encrypted client transfer channels, use of internal matter references in place of subject names when third-party research services are used, and physical access controls over the equipment and encrypted storage media. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by UK GDPR.

11. Changes to This Notice

We may update this Privacy Notice from time to time. The current version will always be available at integri.uk/privacy-notice.

12. Contact Us

Email: office@integri.uk

Post: Integri Limited, 124 City Road, London, EC1V 2NX

Subject lines: Data Subject Rights Request · Objection · Data Protection Complaint · Data Protection Enquiry

ICO registration: ZC029967

Advisory notice

This Privacy Notice relates solely to personal data processed by Integri Limited in connection with its own services. It does not constitute legal advice. If you require legal advice on data protection matters, you should consult a qualified solicitor or data protection specialist.