Privacy Notice

If you visit our website:
We process data about your electronic device, pages visited and time stamps to monitor website performance and to prevent and detect cybercrime as a legitimate business interest.

If you contact us via the website, we will process any data you provide to help us respond as a legitimate business interest.

If you need a check for regulatory purposes:
If you have applied to one of our clients (a Reliant Party) for a service, and that client needs a digital check to comply with their legal obligations, we provide technologies to help perform that digital check.

These digital checks are provided in accordance with the UK Digital Identity and Attributes Trust Framework (UKDIAFT) rules, as set out by the UK Government’s Department for Culture, Media and Sports (DCMS). These rules cover digital DBS, Right to Work and Right to Rent checks.

Our digital check provides a single use verification, so we do not create an account for you.

Our client will pay us for this digital check, so that you don’t have to.

We will share the data you provide to us, and associated information about your identity that we obtain, with the client who requested the check.

If you do not agree to our checks or do not agree to provide the required information, we will notify our client who will seek other ways to perform the necessary checks, which may include face to face meetings with you and additional document checks.

This service must not be used by anyone below 16 years of age.

With your agreement, our client will send you an invite to download the Spotlite identity check app, via SMS from 07480 569386 or by email from [email protected].

It is very important that you only download Spotlite from the official Google Play Store or Apple App Store.

When you download Spotlite and agree to our Terms of Use, you will enter an agreement with us, to perform the check that has been requested by our client.

We will only process personal data that is necessary for our agreement with you, such as your phone number, email address, selected identity documents, nationality, age, address, a live photo of your face, and details about the device you are using. When you provide these details, it is very important that you ensure they are correct.

If we need to process biometric data for the check, such as digital facial recognition templates or age estimates, we will require your explicit consent.  If you do not want to consent, and it is entirely your choice, we can continue with other checks under the agreement with you, but our client may require you to complete additional verifications to meet their legal obligations.

As part of our checks, we engage specialist third-party organisations, to help prevent fraud and money-laundering, and to help verify your identity. We will share the data you provide with those organisations, which include credit bureaus and fraud prevention agencies. If any party determines that you pose a fraud, money laundering or legal risk, they may refuse to provide the services you have requested, or they may stop providing existing services to you. We are part of a network who are working for a safer community, so a record of any fraud or money laundering alerts will be retained by the fraud prevention agencies, as independent data controllers, and may subsequently result in others refusing to provide services, financing or employment to you. We will appear in their systems as Spotlite Business Services. For further information please visit those organisations’ privacy notices at:

Equifax: https://www.equifax.co.uk/About-us/Privacy_policy.html

Experian: https://www.experian.co.uk/privacy/privacy-and-your-data

GB Group (GBG): https://www.gbgplc.com/en/legal-and-regulatory/privacy-policy/

DBS Privacy Policies: DBS Privacy Policies – GOV.UK (www.gov.uk)

If the processing triggers any alerts for further investigation, we will process them under the UK Data Protection Act’s exemption for crime and taxation.

Once the identity checks are complete, we will share all the information you have provided to us, and our findings, with our client who you originally applied to. Our client is required to manually review the information before making any decisions that may deny you access to a service.

As part of our service, we also anonymise your data and aggregate use of our services, which is essential to check that our systems are working correctly and improve our services. We do not use any personally identifiable information in our analytics.

If you engage us on behalf of your business:
This includes clients, agents, reliant parties, vendors, processors, fraud prevention services, etc.

We process your contact details and relevant details in relation to your company and role, in order to provide our services to your business as a legitimate business interest.