The short version
- We use this site to check it's really you when you ask us to do something to your account, such as resetting a password. This protects you from someone pretending to be you.
- We hold your name, organisation, role, work email and mobile number, which your organisation gives us.
- We keep a record of each check. This site sets no cookies for visitors and uses no analytics or tracking.
Who we are
This policy covers verify.actrand.com, run by Actrand. We provide IT support to your organisation. Our contact details are at the top of this page.
What we hold and where it comes from
Your organisation gives us a list of the people we support: name, organisation, role, work email address and mobile number, and whether you can confirm requests for colleagues. We use these details only to check who we're speaking to. We never use contact details given to us during a call for this, because that's exactly what someone pretending to be you would do.
When we check it's you
Depending on the check, we may text a code to your mobile, email you a link, ask a nominated person at your organisation to confirm it's you, or ring you back on the number we hold. For each check we record:
- who it was for, what was asked for, how we checked and the result
- when each step happened, and which of our staff carried it out
- if you use a link on this site: your answer, the name you type, your browser type, and a scrambled (hashed) version of your IP address that can't be turned back into the address
Codes are never stored in a readable form. We keep check records for 2 years, so we can investigate if someone tries to impersonate you. Our lawful basis is legitimate interests: keeping your account and your organisation's systems secure, and performing our contract with your organisation.
Cookies
Pages you visit from a link set no cookies and store nothing on your device. There is no analytics, advertising or tracking, and nothing is loaded from other companies. The only cookie on the site is used by our own staff when they sign in. Our web server keeps a short log of requests (IP address, time, page and browser type) to keep the site secure; these logs are deleted automatically after 8 days.
Who we share it with
- DigitalOcean, which hosts the site in its London data centre, acting on our instructions
- your organisation, if it asks about checks made for its staff
- if we're required to by law
We don't sell or rent your information.
Your rights
Under UK data protection law you can ask for a copy of your information, ask us to correct or delete it, ask us to restrict or stop using it, and ask for it in a portable format. Contact us using the details at the top of this page. It's free, and we'll reply within one month. We don't make any automated decisions about you: a member of our staff always decides what to do after a check.
Complaints
If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.