Privacy Notice and Cookies Policy for the IdentityWorks℠ Global Services

Access to our Web Portal

Our Web Portal is the gateway via which you can access our other Services, to the extent you are entitled to use those other Services. If you are entitled to access the Web Portal, you will have been provided with an activation code by our relevant third party Client who has arranged for you to use our Services, or that Client will have provided alternative registration webpages to establish the entitlement to receive the relevant Services we provide. In this initial set up process you will create an account log-in, set a password and provide your name and email address – all of which will constitute personal information about you (“Account Set Up Data”). We will collect this Account Set Up Data directly from you or, where relevant, from our Client. We will use this Account Set Up Data to enable you to access the Web Portal on subsequent visits.

Dark Web Monitoring Service

This Service is available to all subscribers to our Services. In order to provide this Service to you we collect compromised personal information from a number of different internet sources upon which compromised information is shared (e.g. forums and/or social media groups for sharing compromised information) and hold it on our database (the “Database”).

The personal information which, you (or they) may provide to us (via our Web Portal) in order for us to search for matches in our Database may include some or all of the following:

• your name;
• your date of birth;
• your contact details, including postal address, telephone number and email address;
• your log-in details and password (which may contain personal information);
• your credit/debit/retail card number;
• your bank account/iban details;
• your national insurance/medical ID number;
• your national identifier (ID) or social security number (if applicable), or other alpha-numeric identifiers which may be applicable in your jurisdiction (e.g. tax ID, travel ID or health ID numbers, or equivalents in your jurisdiction);
• your driver’s license number; and/or
• your passport number.

Where you have provided us with the above personal information, and we find matches in our Database, we will send you an alert (via email) to notify you of that.

Where you are an EU/United Kingdom (“UK”) resident, please also see the section in relation to Special Category Personal Information processed by us in relation to this Service.

Social Media Monitoring Service

Not all subscribers are eligible to receive this Service. If you are eligible and want to use this service you will need to provide us with your relevant social media account log-in credentials (log-in details and password via a widget). Please note that this Service will be set to “off” by default until you enter the details referred to above and select “on”. Once activated, we will access your relevant social media account/s to monitor the content of your relevant social media profiles and alert you (via email) to privacy and/or reputational risks to you, based on the content of your profile and/or postings made by you on your profile wall (including recommended steps for you to take to address those risks, for example, removing certain wall posts or removing information from your profile).

Privacy risks include making available your personal information which could be used by other people to impersonate you. Reputational risks are identified by searching the written content (not photographs) of wall posts for matches against our dictionary of terms which may present you with a reputational risk. The content of your profile and, in certain circumstances, the wall posts on your profile may constitute your personal information (for example, your name, contact details, interests, opinions and beliefs). We will collect this personal information indirectly from you when monitoring your social media profile/wall posts to identify privacy and/or reputational risks as detailed above. The monitoring undertaken by us in order to provide this Service to you will continue until you turn it “off”, which you can do at any time. You have the option to turn monitoring “on” and “off” for each of your social networks individually.

Where you are an EU/UK resident, please also see the section in relation to Special Category Personal Information processed by us in relation to this Service.

Identity Restoration Service

Not all subscribers are eligible to receive this Service. For subscribers who are eligible to receive this Service, in combination with our other Services described above, we may provide you this Identity Restoration Service. Depending on your level of eligibility for this Service, the Identity Restoration Service: (i) could be limited to providing you with advice accessible via the Web Portal in relation to steps you can take to protect your identity and address any risks identified; or (ii) additionally may include providing you (at your request, and where your service entitlement or subscription covers this element of this Service) with assistance via a helpline, where our identity restoration advisors can: (a) advise you in relation to steps you should take;

or (b) at your request (and where your service entitlement or subscription covers this element of the Service), take steps on your behalf to communicate with other parties about restoring the integrity of your identity. Where you discuss restoration with one of our identity restoration advisors (via our helpline), we may collect further personal information from you which you provide to us, in order to provide this Service to you (for example, which relevant service provider(s) you use and how to contact them in order to take steps to restore your identity).

Special Category Personal Information

We may collect Special Category Personal Information via the Dark Web Monitoring or Social Media Monitoring Services. “Special Category Personal Information” under applicable data privacy law means personal information which reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying you, data concerning your health or data concerning your sex life or sexual orientation or is otherwise a category of information for which explicit consent is required to allow us to process this information under applicable local law.

Data Accuracy

Unless you are a child or a Staff member of a business subscriber, you are responsible for the accuracy of the information that you provide (including in relation to your child or Staff member, where applicable), and you agree that any discrepancies or inconsistencies with the information you provide may result in your (or their) identity not being validated, which may prevent access to all or some of our Services. In addition, providing us with inaccurate information may mean that you will not receive the benefit of the Service – for example, if you wish to use the Dark Web Monitoring Service and you provide us with an inaccurate passport number for matching against the Database, we will not be able to check the correct passport number against the Database or alert you of any matches.

Access to our Web Portal

To enable you to set a log-in to the Web Portal in order to access our other Services.

Dark Web Monitoring Service

To search our Database to determine whether any of your personal information has been compromised, and send you (or your parent/guardian or business employer, as appropriate) alerts about this where matches are found.

Social Media Monitoring Service

To search your nominated social media profile and/or wall posts to identify privacy and/or reputational risks, and send you alerts about risks we identify.

Identity Restoration Service

To provide you with advice about how to manage identity risks and, if you it forms part of your subscription, to take steps on your behalf and on your request.

To manage your account

We also collect, store and otherwise process personal information for the following purposes related to your use of the Services

• to confirm you are entitled to receive the Services;
• to provide customer support to you as required;
• to keep a record of alerts sent in relation to the Dark Web Monitoring Service and the Social Media Monitoring Service; and
• for compliance with legal, regulatory and other good governance obligations.

General Purposes

In addition, we may also process your personal information for the following purposes:

• to administer our relationship with you (or your parent/guardian or business employer, where applicable) and (where necessary) to enforce our terms and conditions and for other internal business purposes (where lawful to do so under data privacy laws);
• to defend a legal claim against us;
• to develop our products and services for example, to refine the dictionary we use to identify reputational risks when providing the Social Media Monitoring Service to you, by identifying keywords more likely to be associated with such risks and adding them to the dictionary;
• for statistical analysis (relating to development of our products and services);
• for compliance with legal, regulatory and other good governance obligations; and
• for administrative and any related purposes, or where we have a legal right or duty to use or disclose your personal information (including for crime and fraud prevention and related purposes).

Market Research

We may convert your personal information into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from that data itself. We may then use this aggregated data to conduct market research and analysis, including to produce statistical research and reports. We may share this statistical or aggregated data in several ways, including for the same reasons as we might share personal information, please read the relevant section on that sharing in this Privacy and Cookies Policy.

Necessary in our legitimate interests

The processing of personal information for the following purposes:

• providing access to our Web Portal;
• providing the Dark Web Monitoring Service - to conduct searches;
• confirming you (or your parent/guardian or business employer, where applicable) are entitled to receive the Services;
• keeping a record of alerts and the information you (or your parent/guardian or business employer, where applicable) have provided to us, for your (or their) benefit (for example, should you or they require additional Services or support from us) and also for compliance with legal, regulatory and other good governance obligations;
• processing your personal information for the general purposes explained under that heading in the “How we use your information?” section above;
• conducting market research; and
• disclosures to third parties, such as in the event of a merger (unless the disclosure is to comply with our legal obligations in which case the lawful basis for processing will be legal obligations; or your consent for the disclosure is necessary in accordance with applicable data privacy law, in which case the lawful basis for processing will be consent)

is performed on the lawful basis that it is necessary in our legitimate interests and does not prejudice your rights, freedoms or personal legitimate interests. The legitimate interests that this is necessary for include providing (and improving and developing) Services which benefit our subscribers and Clients who have procured our Services on their behalf, undertaking tasks to enable that to happen and our businesses to function and protecting our business against legal and other risks.

Necessary for compliance with a contract

The processing of personal information for the purposes of providing the Dark Web Monitoring and Social Media Monitoring Services is necessary for us to perform our contractual commitments to you and provide the Services.

Necessary in order for us to comply with our legal obligations

The processing of your personal information for the purposes of keeping a record of alerts, to protect against a legal claim against us, for compliance with legal and regulatory purposes, or where we have a legal right or duty to use or disclose your information (including for crime and fraud prevention and related purposes) is necessary to comply with our legal obligations.

Consent

In some jurisdictions, in accordance with applicable data privacy law, the processing of your personal information (including Special Category Personal Information) for some or all of the purposes described in “What information do we collect and why” and “How do we use your information?”) must be conducted on the basis of your consent (whether you are providing this on your own behalf, or that of a child). Therefore, when registering to obtain the relevant Services from us, we ask that you provide your consent to the processing of your personal information. Where local data protection laws require consent our processing of your personal information is on the lawful basis of your consent. However, where consent is not required, we will process your personal information because either it is necessary in or legitimate interests, is necessary to enable us to perform the contract or it is necessary for us to comply with our legal obligations.

Where you are (or your child is, as relevant) an EU/UK resident, our lawful basis for processing the following personal information is based on your explicit consent, (given by you on your own behalf and/or as parent or guardian on behalf of your child as relevant).

1. Dark Web Monitoring – General

To the extent that you provide Special Category Personal Information to us via the Dark Web Monitoring Service or it is contained on a compromised record along with this personal information, we may use it to:

• conduct searches to determine whether any of the personal information provided for matching appears to have been compromised, by checking for matches with personal information already held in our Database (or which we subsequently obtain), which we collect from various sources on the internet, and send you alerts about this where matches are found;
• provide customer support to you as required;
• retain the personal information for the purpose of queries
• keep a record of alerts and the information you have provided to us, for your benefit (for example, should you require additional Services or support from us) and also for compliance with good governance obligations (where not required to comply with legal or regulatory obligations);
• process for statistical analysis purposes (including conversion to statistical or aggregated form);
• disclose the personal information to third parties (apart from our service providers who process information on our behalf) unless the disclosure is required to comply with our legal obligations; and
• administer our relationship with you.

2. Dark Web Monitoring – Children

The personal information of your child (including Special Category Personal Information belonging to your child - or any other category of information where explicit consent is required to allow us to process this information under applicable local law) which you (as a parent/guardian) provide to us via the Web Portal (or is contained on a compromised record along with this personal information) and which we use to:

• conduct searches to determine whether any of the personal information provided for matching appears to have been compromised, by checking for matches with information already held in our Database (or which we subsequently obtain), which we collect from various sources on the internet, and send you alerts about this where matches are found;
• provide customer support to you (as parent/guardian) as required;
• retain the personal information for the purpose of queries
• keep a record of alerts and the information you (as parent/guardian) have provided to us, for your (or your child’s) benefit (for example, should you or they require additional Services or support from us) and also for compliance with good governance obligations (where not required to comply with legal or regulatory obligations);
• process for statistical analysis purposes (including conversion to statistical or aggregated form)
• disclose the personal information to third parties (apart from our service providers who process the personal information on our behalf) (unless the disclosure is required to comply with our legal obligations); and
• (only to the extent that the personal information constitutes Special Category Personal Information - or any other category of information where explicit consent is required to allow us to process this information under applicable local law) to administer our account with you (as parent/guardian).

3. Social Media Monitoring Service

This Service is not provided in relation to children.

Any Special Category Personal Information (or any other category of information where explicit consent is required to allow us to process this information under applicable local law) included on your social media profile or wall posts which are monitored by us in order to provide this Service and which we use to:

• provide the requested services of searching your relevant social media profile and/or wall posts to identify privacy and/or reputational risks, and sending you alerts about risks identified;
• provide customer support to as required;
• retain the personal information for the purpose of queries;
• keep a record of alerts and the information you have provided to us, for your benefit (for example, should you require additional Services or support from us) and also for compliance with good governance obligations (where not required to comply with legal or regulatory obligations);
• develop this Service (for example, to refine the dictionary we use to identify reputational risks when providing the this Service to you by identifying keywords more likely to be associated with such risks which are added to the dictionary in order to provide a better service to subscribers);
• process for statistical analysis purposes (including conversion to statistical or aggregated form);
• disclose the personal information to third parties (apart from our service providers who process the personal information on our behalf) (unless the disclosure is required to comply with our legal obligations); and
• administer our relationship with you.

Please note that where your consent is requested as our lawful basis for processing you are entitled to refuse to give your consent or to withdraw it any time. Withdrawing your consent does not affect the lawfulness of our processing based on your consent before it was withdrawn. However, where your consent is necessary in order for us to process your personal information, by not providing your consent (or withdrawing it), we will not be able to process that information and, or provide the Services to you.

Corporate subscribers

Where you are a Staff member of a business subscriber, our lawful basis for processing your personal information are that the processing is necessary in our legitimate interests or to comply with legal obligations

Suppliers

In order for us to provide you with the Services and for the prevention and detection of fraud, we will share your personal information with third parties who perform services on our behalf, for example IT companies providing data storage, contact center providers (if you are eligible for the helpline element of our Identity Restoration Service) or other communications providers (for example who may send you email alerts if you are using the Dark Web Monitoring Service). These third parties are authorized to use your personal information only as necessary to provide such services to us.

Government bodies, law enforcement, regulators

In certain situations, we may disclose personal information in response to lawful requests by governmental and regulatory bodies, and other public authorities, including to meet regulatory, national security or law enforcement requirements (for example, in relation to investigations of crime). This may be because we are required by law to comply with our legal obligations, or where the disclosure is necessary in our legitimate interest or those of a third party.

Lawful disclosures

We may also disclose your personal information (including as required by law), for example, to comply with a subpoena, or similar legal process, when we believe in good faith that the disclosure is necessary to protect our rights, protect your safety or the safety of others, to investigate fraud, or to respond to a government request.

Third parties

In addition, in the event of a merger, acquisition, or any form of sale of some or all of our assets to a third party, we may also disclose your personal information to the third parties concerned or their professional advisors. In the event of such a transaction, the personal information held by us will be among the assets transferred to the buyer.

When you close your account with us, we may continue to process your personal information, to the extent permitted by applicable law, for the purposes detailed above (disclosures in relation to suppliers, government bodies, lawful disclosures and third parties).

Experian does not disclose your personal information in a form from which you can be identified to any affiliates within the Experian group (including its parent company), unless otherwise stated elsewhere in this Policy.

Personal information processed by us on behalf of our Clients

In other cases we process your personal information (e.g. Account Set Up Data) on behalf of a Client who is responsible for determining how and why we process it, in which case we will share such personal information with that Client.

The United States Department of Commerce and the EU Commission have agreed on a set of data privacy principles and frequently asked questions (the “Privacy Shield Principles”) to enable United States companies, to satisfy the requirement under EU law that adequate protection be given to personal information transferred from the EU to the United States.

Experian participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework. Experian is committed to subjecting all personal information received in connection with the provision of identity theft protection and fraud prevention services from EU member countries (and the UK, during the UK’s transition period following its departure from the EU and any equivalent replacement framework as regards the UK after the expiry of such transition period), in reliance on the Privacy Shield Framework to the Framework’s applicable Principles. To learn more about the Privacy Shield Framework, and our certification under the name of CSIdentity Corporation, Inc, please visit the United States Department of Commerce’s Privacy Shield List.

Experian is responsible for compliance with the Privacy Shield Principles in relation to the processing of personal information it receives in connection with the services described above, from EU (and UK) Clients, including where it subsequently transfers the personal information to a third party acting as an agent on its behalf. Experian complies with the Privacy Shield Principles for all onward transfers of personal information from the EU (and UK), including the onward transfer liability provisions.

With respect to personal information received or transferred pursuant to the Privacy Shield Framework, Experian is subject to the regulatory enforcement powers of the United States. Federal Trade Commission. In certain situations, Experian may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our United States-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

Under certain conditions, more fully described on the Privacy Shield website, you may invoke binding arbitration, which is a private form of alternative dispute resolution, when other dispute resolution procedures have been exhausted.

Upon request, Experian will provide you with information about whether we hold, or process on behalf of a third party, any of your personal information. To request this information, please contact us at eu.data.privacy@experian.com.

In relation to how you can exercise your rights in relation to your personal information processed by us, please see the section below entitled “Your Rights – Including Access and Deletion”.

The criteria we use to determine data retention periods include the following:

Retention in case of queries

We may keep your personal information for a reasonable period after you have enquired about Services, in case of follow up queries from you (or your parent/guardian or business employer, where applicable). Examples of personal information falling within this category are data from product alerts, documents received for ID verification, Account Set Up Data transaction history, correspondence, call notes and personal information submitted for monitoring.

Retention in case of claims

We may keep your personal information for the period in which you (or your parent/guardian or business employer, where applicable) might legally bring claims against us if and to the extent this is relevant. Examples of such personal information are transactional and Account Set Up Data.

Retention in accordance with legal and regulatory requirements

Where we are required to keep your personal information to comply with legal and/or regulatory requirements, we will store it for the length of time which we are required to in order to comply with such legal or regulatory requirements (unless we already keep it for a longer period in line with the other reasons stated in this section). Examples of such personal information is transactional (including credit card data for ID verification) and Account Set Up Data.

Retention for legitimate interests, as permitted under applicable law

We will continue to store personal information, where necessary, to provide our Services to you (or your parent/guardian or business employer, where applicable) and the retention of such personal information is necessary for the purposes of pursuing our legitimate interests. An example of this type of personal information is information collected in connection with the Dark Web Monitoring Service. This is retained for 25 years from the date of first collection. We keep this information for 25 years because it is necessary to ensure that the Dark Web Monitoring Service is fit for purpose. This is because the Dark Web Monitoring Service relies on observing and analyzing historical records in order to detect if such records have been compromised. Compromises from many years ago can have current impacts for enduring data records.

We review and cleanse the personal information we hold annually to ensure that we only keep what is necessary in order to provide our service and assist our subscribers., You should be aware however that, although reasonable efforts will be taken, it may not always be possible to completely remove or delete all of your personal information from our databases because of back-ups and other technical reasons. Where this is the case, we will take steps to ensure that your personal information is suppressed in order to render it unusable.

The following are some examples of information we may collect:

• Experian web-site pages you view
• Emails that you open or forward
• Links you click on
• Forms you complete

In connection with the use of the Services, for example during the enrolment process or upon log-in to the Web Portal, information about your computer, such as the device ID and other accompanying technical information, will be accessed, stored and used by us or our service provider solely to analyze trends, track users’ movements on the Services, and to gather demographic information about the user base as a whole. If you access the Services through a mobile device, we also may collect information about your device, such as the device ID or another identifier as permitted by the manufacturer.

Unless you are a Global IdentityWorks subscriber (in which case the only cookies used are technical rather than analytical and solely for the purpose of ensuring that our Services function correctly), Experian and our clients have access to reports produced by these service providers that contain aggregated trends and statistics about usage on our proprietary platforms. However, neither Experian nor any other third parties are able to tie any of the aggregated analytics data to your personal information. At no time will this information be provided or sold to any third party affiliates for advertising or marketing purposes. The use of cookies by our partners and the third parties we engage to perform analytics services is not covered by this Privacy and Cookies Policy.

As is true of most websites, we gather certain information automatically and store it in log files. This information may include internet protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and/or clickstream data. We do not link this automatically collected data to other information we collect about you.

Third parties with whom we partner to provide certain features on our website also use HTML5 to collect and store information. Various browsers may offer their own management tools for removing HTML5.