Credas Compliance Wallet Consent Policy 

The Credas Compliance Wallet is designed to protect your information and help you choose what you share, when you share it, and with who.   

This Consent Policy should be read in conjunction with our Privacy Notice available here on our website. 

Why are you asking my consent? 

To save you having to repeat identity verification and compliance checks, an organisation you are using would like to reuse the existing checks you have already successfully completed with Credas.   

For us to securely share the results of your identity verification and compliance checks with your chosen organisation, we first need to obtain your consent. 

We will do this by sending you a consent request notification via SMS/email.  We will ask you to authenticate the response by performing a selfie for facial recognition to verify that it is you giving consent. 

When you give us your consent to share your existing checks with your chosen organisation, you are agreeing to Credas sharing personal and special category data from the identity documents and photographic evidence you uploaded to prove who you are.   

This data might include your:  

  • full name; 
  • date of birth;  
  • residential address;  
  • email address; 
  • telephone number; 
  • selfie; 
  • the information extracted from the identity documents you chose to upload; 
  • the results of electronic identity verification checks to verify your address and mortality which may leave a soft footprint on your credit report (this will not impact your credit score); and  
  • the results of Politically Exposed Person and Sanctions screening checks on your full name.    

When will you share my data? 

We will only ever share your identity verification and compliance check results with an organisation you are already using that you trust, when you tell us to. 

Who will you share my data with? 

These trusted organisations will typically include central professionals that are relevant to your transaction(s) such as your estate agent, mortgage lender or conveyancer.   

How will you share my data? 

The process begins when you ask an organisation you are using to search for the identity verification and compliance checks you have already completed with Credas. The organisation will in turn contact us and ask if you have any existing checks that they can reuse. 

We will notify you by SMS/email of the request to share your identity check results and ask for your consent to share them with your chosen organisation in the same message.   

For example, you would receive an SMS/email from us asking whether you consent to share the identity verification and compliance checks that you conducted for your estate agent with the conveyancer acting for you.   

You will have the option to accept or decline this request.   

If you accept the request, the organisation you are using may then meet their requirements by getting the results directly from the secure Credas portal saving you having to repeat the checks.   

You may withdraw your consent instantly at any time. 

The Wallet’s functionality also enables you to proactively “Push” your identity verification and compliance checks to an organisation you are using.  This can be done by you sharing a unique share code that only you have access to.  

A log recording every service provider you have consented to share your data with and the date that you shared it will be available to you upon request.   

If you do not wish to provide consent, then you are able to repeat the identity verification process by way of invitation from us as you did previously. 

Where and how do you store my data? 

Data security is very important to us. To protect your data, we have taken suitable measures to safeguard and secure data collected through use of our app or via web browser. 

Steps we take to secure and protect your data include (but are not limited to): 

  • Website secured using SSL; 
  • Azure storage service encryption (SSE); 
  • Secure App; 
  • Data masking; 
  • All personal data encrypted in transit; 
  • Facial recognition authentication to give or decline consent; and 
  • The following standards: ISO 27001 certified, DIATF certified and ICO registered 

As a user of the Credas Compliance Wallet, your data will only be stored by us in the United Kingdom and in accordance with our Privacy Notice. 

How long will you store my data for? 

We will retain your Compliance Wallet data for as long as is necessary for the requesting organisation to identify you as their customer. We will erase the data upon request from the organisation(s) that needed to verify your identity in accordance with the timeframes set out by the Information Commissioner’s Office.   

Applicable legal basis for processing personal data 

When performing an identity verification check with us, we process your personal data for performance of our contract with the organisations who have commissioned us to verify your identity, as necessary to provide the service, and to comply with our legal obligations. 

When sharing your identity and compliance check results via the Credas Compliance Wallet, consent is the legal basis, and we seek it in accordance with applicable local law. 

Your rights 

As a data subject, you have the following rights under the Data Protection Act 2018 and UK GDPR, which this Policy and our use of personal data have been designed to uphold: 

  • The right to be informed about our collection and use of personal data; 
  • The right to rectification if any personal data we hold about you is inaccurate or incomplete; 
  • The right to be forgotten – i.e. the right to ask us to delete any personal data we hold about you; 
  • The right to restrict (i.e. prevent) the processing of your personal data; 
  • The right to object to us using your personal data for particular purposes; and 
  • Rights with respect to automated decision making and profiling. 

If you have any queries or cause for complaint about our use of your personal data, please contact us using the details below and we will do our best to solve the problem for you. If we are unable to help, you also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office. 

For further information about your rights, please contact the Information Commissioner’s Office or your local Citizens Advice Bureau. 

How to withdraw consent 

If you consent to Credas sharing the results of your identity check with a service provider and change your mind, you can withdraw your consent at any time. 

This can be done by emailing our dedicated Support Team on support@credas.com and stating your full name, email address and telephone number.   

You may also withdraw your consent by contacting us by telephone on 029 2010 2555 or by post in writing to Credas, The Maltings, East Tyndall Street, Cardiff, CF24 5EA. 

If you withdraw your consent to share your identity check, we will prevent any further access of these results by the client who previously had access to them.  It is reasonable that whilst your consent was valid the client may have downloaded your identity check results for their own files and record keeping purposes.   

Top