Website & Business Interactions

1.Scope and Who This Notice Is For

• This Website Business Interactions Privacy Noticepplies when you interact with Shufti's public websites and business contact channels, including when you browse our site, accept/reject cookies, submit forms, request a demo, contact our teams, or interact with our marketing content.
• This notice does not cover identity verification or AML screening carried out through Shufti for a Client's end-users. That is covered in the Services Privacy Notice (Services Privacy Notice ) and also in the Client's own privacy notice.

2.Controller Identity and Contact Details (UK GDPR / GDPR)

Controller: Shufti Pro Limited ("Shufti", "we", "us", "our"). Office 408 Coppergate House, 10 Whites Row, London E1 7NF, GB.

Privacy contact: [email protected] (Data Protection Team).

DPO: [email protected]. The DPO operates independently and reports to the highest level of management in accordance with Article 38 UK GDPR.

Representative (EU/EEA): Nikolett Horvath — [email protected]

3.What Personal Data We Collect

4.Why We Use Your Data (Purposes and Lawful Bases)

5.Who We Share Data With (Recipients)

• Our website vendors, cloud service providers and other service providers (e.g. analytics, chat, forms, bot management), as listed in our Cookie Policy. All third-party vendors who process personal data on our behalf are subject to data processing agreements (DPAs) incorporating appropriate data protection obligations, as required under Article 28 UK GDPR. Transfers to advertising or analytics partners are subject to valid PECR consent and, where data is transferred internationally, to appropriate safeguards as described in Section 6.
• Other companies within the Shufti group. In some circumstances, Shufti Pro Limited and its group companies may act as joint controllers of your personal data. Group companies include:
  • Shufti Pro Limited (UK)
  • Shufti AB (Sweden)
  • Shufti Pro Limited (Cyprus)
  • Shufti LLC (Delaware)
  • Shufti Digital ID Verification Services Limited (Dubai)
  • Shufti PTE Limited (Singapore)
• Professional advisers and insurers where reasonably necessary, subject to confidentiality obligations.
• Authorities or counterparties where required for legal compliance, fraud prevention, or protection of rights.

6.International Transfers

Your data may be processed or accessed internationally depending on vendor locations and Shufti's operations. All international transfers of personal data are recorded in Shufti's transfer register. Where a Transfer Impact Assessment (TIA) / Transfer Risk Assessment (TRA) is required to assess whether the law and practice in the destination country allows the safeguards to be effective, such assessment is conducted and documented prior to the transfer taking place. This is consistent with the approach taken across all Shufti privacy notices, including Services Privacy Notice .

Where appropriate, we apply supplementary measures consistent with EDPB or ICO recommendations. You may request further information regarding applicable transfer mechanisms by contacting [email protected].

7.Retention (Purpose-Specific Schedule)

• Cookie records and consent preferences: cookie consent records are retained for 1 year to evidence consent. Individual cookie durations are set out in the Cookie Inventory in Section 15. Analytics and marketing cookie data is deleted upon expiry of the applicable cookie duration or upon consent withdrawal, whichever is sooner.
• Enquiries and demo requests: up to 7 years after last contact, based on legitimate interests in defending against or pursuing legal claims. This period is reviewed periodically.
• Support tickets via website: up to 7 years after closure.
• Marketing list entries: retained until you unsubscribe or withdraw consent. Upon opt-out, contact details are moved to a suppression list retained only for the purpose of preventing re-contact.
• Legal holds: retained for the duration of a dispute or legal claim. Data subject to a legal hold is reviewed at conclusion and deleted promptly once no longer required.

8.Security (Technical and Organisational Measures)

• We use technical and organisational measures appropriate to the risk. Shufti's Data Protection & Security Policy describes encryption and access controls, DPIAs, sub-processor evaluation and standards (ISO 27001, SOC 2) used to evaluate infrastructure and operations.
• We maintain records of processing activities (ROPA) and documentation consistent with UK GDPR/GDPR expectations.

9.Your Rights (UK GDPR / GDPR)

• Information — privacy information must be provided at the time of collection.
• Access — get a copy of your data.
• Rectification — correct inaccurate data.
• Erasure — delete data in certain cases.
• Restriction — limit how we use data in certain cases.
• Data portability — receive data in a usable format, in certain cases.
• Object — object to processing based on legitimate interests or direct marketing.
• Withdraw consent — where we rely on consent, including cookie consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Cookie consent withdrawal: You can withdraw consent to non-essential cookies at any time by accessing our cookie management tool on our website, or by clearing cookies from your browser settings. Withdrawing cookie consent will result in non-essential cookies being removed and not re-set until fresh consent is given.
• Right not to be subject to solely automated decisions with legal or similarly significant effects (where Article 22-type rules apply).
• Right to complain to a regulator (see Section 11).

10.How to Exercise Your Rights

• Email: [email protected]. Privacy requests can be sent to this address; Shufti will respond and may verify your identity for security reasons. Please use this Data Subject Rights Request form to exercise your rights.
• We may ask for information to confirm your identity before responding (to protect you and prevent fraud).

11.Complaints and Supervisory Authorities

• You can submit your complaints to us via [email protected] or [email protected]. We encourage you to raise concerns with us in the first instance so that we can seek to resolve them promptly and fairly. Complaint form link attached.
• UK supervisory authority: Information Commissioner's Office (ICO). Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; phone 0303 123 1113.
• EEA supervisory authorities: Each EEA country has its own data protection authority; contact details are listed by the EDPB at edpb.europa.eu/about-edpb/about-edpb/members_en.

12.Whether You Must Provide Data

You are not legally required to provide marketing or enquiry data. However, if you do not provide information needed to respond to your request (e.g. email address), we may not be able to reply or provide a demo.

13.Shuftiduct-to-Processing Map

This table maps Shufti products to typical processing activities, data categories, lawful bases and retention.

14.Children's Data

Our Services are not directed to children under the age of sixteen (16) and we will never knowingly collect personal or other information from anyone we know is under such age.

15.Cookie Policy

Shufti does not use website interaction data for purposes unrelated to the operation of the website, such as training AI or machine learning models, biometric analysis, or profiling for purposes beyond those described in this notice, unless such use is separately disclosed to users, supported by an appropriate lawful basis, and subject to a Data Protection Impact Assessment where required.

16.Prohibited Uses of Website Interaction Data

Shufti does not use website interaction data (including data collected via cookies, analytics tools, session recording, or behavioural tracking technologies) for purposes unrelated to the operation, improvement, security, or marketing of Shufti's website and services, as described in this notice.

In particular, Shufti confirms that website interaction data is not used for:

• Training, fine-tuning, or developing artificial intelligence or machine learning models, unless separately and specifically disclosed to website users in advance, supported by an appropriate lawful basis, and subject to a Data Protection Impact Assessment;
• Biometric analysis or identification of individuals through behavioural or device data;
• Creating profiles of individuals for purposes unrelated to the business interactions described in this notice;
• Selling, renting or otherwise commercialising personal data collected through the website to third parties for their own marketing or profiling purposes.

If Shufti were to introduce any processing of website interaction data for purposes beyond those set out in this notice, a separate disclosure would be provided, an appropriate lawful basis would be identified, and user consent would be obtained where required.

17.Changes to This Notice

We may update this notice from time to time to reflect changes in law, regulatory guidance, or our internal practices. We will publish updated versions and update the "Last updated" date. Where changes are material, we will take reasonable steps to bring them to your attention.