ID Verification - Data Processing Notice

We are Oakwood Corporate Services Limited (Oakwood), a company which provides outsourced company secretarial, registered office and incorporation services to corporate clients in the UK.  At the request of a corporate client, or on instruction to incorporate an entity, following submission to us of our New Company Checklist, duly completed by you or on your behalf (Incorporation Instruction),  we will also provide identity verification (IDV) services to ensure that officers and people having significant control of the client (or prospective officers and people having significant control of a new entity), and certain other individuals who are or will be associated with a corporate entity, meet their obligations to have their identity verified as required by the Economic Crime and Corporate Transparency Act 2023 (ECCTA). An individual referred to in this paragraph is, for the purposes of this Data Processing Notice, referred to below as an IDV Individual.

If you are an IDV Individual and it has been requested that we provide IDV services to you, by a corporate client or as part of an Incorporation Instruction, the notice below will be relevant to you.

We have registered with Companies House as an Authorised Corporate Service Provider (ACSP), for the purposes of providing IDV services.

References to “we”, “us” and “our” are references to Oakwood.

This notice informs you (the Data Subject) of our processing of your personal data.  We may request that you provide us with personal data to enable us to provide IDV services to you, at the request of a corporate client of Oakwood with which you are associated (Client), or your personal data may be provided to us as part of an Incorporation Instruction.  By providing us with your personal data, whether directly or via an Incorporation Instruction, you guarantee that all such personal data is complete and accurate.

Please note that your failure to provide complete and accurate personal data will mean that we are unable to provide IDV services to you.  There are alternative ways in which you can have your identity verified in accordance with ECCTA, and you may choose not to use Oakwood’s IDV services for this purpose.  If, however, you fail to have your identity verified as required by ECCTA, you may incur civil or criminal liability.

For further information, please refer to the Oakwood Privacy Notice: https://oakwood-corporate.com/privacy-notice/.

In accordance with Articles 13 and 14 of the UK-GDPR (https://uk-gdpr.org/), we inform you of the following:

  1. The data controller of your personal data

Oakwood Corporate Services Limited is the controller and is responsible for any personal data that you provide to us for the purposes set out in this Data Processing Notice.

  1. The purpose of the data processing

We will process your personal data to ensure that you comply with your obligations under ECCTA to have your identity verified as a condition of being, or becoming, a director, or a person having significant control (PSC), of a UK company, or an individual member or PSC of a limited liability partnership.

If you are an individual for whom we require identity verification to enable us to comply with our anti-money laundering obligations under UK law, we may retain such personal data, on the terms set out in our Privacy Notice, as a condition of providing services to the Client or completing an incorporation.

  1. The legal basis for the data processing

By:

  • countersigning this Data Processing Notice, or
  • submitting, or permitting to be submitted on your behalf, a New Company Checklist,

you consent to our processing of your personal data to enable us to provide IDV services to you.  You may withdraw this consent at any time.  If you do withdraw your consent, we may be unable to provide IDV services to you, but this will not affect the validity of any processing that we have already undertaken on your behalf.

To the extent that we require your personal data to enable us to comply with our anti-money laundering obligations and to provide services to the Client, we do not require your consent and will process such personal data for one or more of the following lawful purposes:

  • our legitimate interests for running our business as a provider of company secretarial, incorporation and other services;
  • if appropriate, taking steps at your request prior to entering into a contract with the Client;
  • complying with our legal obligations under UK anti-money laundering legislation.
  1. The categories of personal data concerned

For the provision of IDV services, we may process your personal data including your full name, any former names, residential address, address history for the past twelve months, e-mail address, mobile telephone number, title, company and occupation, gender, date of birth, nationality, state of residence, photographic ID and any other personal data (including biometric data) that may be included in the identification documents provided to us by you or by another person at your request, either directly or through one of our third party identity verification service providers listed below.

  1. The recipients of your personal data

We may share your personal data with one or more of our third party identity verification service providers.  At the date of this notice, these providers include: First AML Limited and Thirdfort Limited.  More details, and links to each third party provider’s privacy notice, are set out below and also in our Privacy Notice.

Personal data that you send to us via Outlook will be stored by Microsoft Corporation in the cloud. A link to Microsoft’s privacy notice appears below.

Your personal data will also be shared with those of our personnel who need to see this for the purposes of providing IDV services.  All such personnel are bound in their employment contracts by a duty of client confidentiality.

As part of the IDV process, your personal data will be shared with Companies House, to the extent required under ECCTA and any associated legislation.

  1. Transfers

Whenever we transfer, or permit the transfer of, your personal data out of both the UK and the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

  • we will only transfer, or permit the transfer of, your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission;
  • where we use third party service providers, we may use, or require our providers to use, standard contractual clauses approved by the European Commission which give personal data the same protection it has in the EEA.

The recipients of your personal data identified in paragraph 5 above will store your personal data in the locations set out below:

  1. Data retention

We are required by ECCTA to retain the personal data that you provide to us for the provision of IDV services for a minimum period of seven years. This requirement applies whether or not we determine that we are able to verify a person’s identity based on the information and evidence provided.

For more information on data retention generally, please see our Privacy Notice.

  1. Your rights

In addition to your right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority for data protection issues (https://ico.org.uk/), you have the following rights as a Data Subject:

  • rights to ask us for access to, or for rectification or erasure of, your personal data;
  • a right to object to, or to ask that we restrict, our processing of your personal data; and
  • a right to data portability.

For more information about these rights, please see our Privacy Notice.

  1. The source from which your personal data originated

We expect that you will provide to us all of your personal data required for the provision of IDV services, either directly or indirectly through a third party at your request.

  1. Contact details

If you have questions about our privacy practices, or if you would like to submit a request exercising your privacy rights, please contact us.  You can:

  • email us at: enquiries@oakwood-corporate.com; or
  • contact our directors at 0161 942 4700, or by post to 3rd Floor, 1 Ashley Road, Altrincham, Cheshire WA14 2DT.

Oakwood Corporate Services Limited