Privacy notice

Last updated 17 September 2026

This notice explains how TrueFortis handles personal information. It is written for two groups of people: accountants and advisers who use TrueFortis, and the people they ask to verify their identity.

If you have been asked to verify your identity

Who is responsible for your information

Your accountant, tax adviser or bookkeeper asked you to verify your identity. They decide why your information is collected and what happens to it, so they are the controller under UK data protection law. TrueFortis processes your information on their behalf and only on their instructions.

Why they are asking

Firms that provide accountancy and tax services in the UK must identify and verify their clients under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. They must also check whether their clients are subject to financial sanctions or are politically exposed persons.

What is collected

• Your name and email address, entered by your accountant.
• Images of your identity document, and the details on it, such as your name, date of birth, nationality, document number and expiry date.
• A selfie, and a comparison between your face and the photo on your document.
• The results of screening your name against sanctions lists and lists of politically exposed persons.
• Technical information about the device you use, such as its IP address, to help detect fraud.

Comparing your face with your document uses biometric data, which is special category data. It is used only to confirm that you are the person named on the document.

The legal basis

Your accountant relies on their legal obligation under the Money Laundering Regulations. For biometric data and any information about criminal offences, they rely on the substantial public interest conditions in Schedule 1 of the Data Protection Act 2018, including preventing or detecting unlawful acts and meeting regulatory requirements.

Decisions about you

The check produces a result, but it does not decide whether your accountant acts for you. Your accountant reviews the result and makes that decision.

How long it is kept

Your accountant must keep records of their checks for five years after their business relationship with you ends. The report is stored in TrueFortis for your accountant until they delete it or close their account.

Your rights

You can ask for a copy of your information, ask for it to be corrected, and in some cases ask for it to be deleted or object to its use. Because your accountant is the controller, please contact them first. You can also email support@truefortis.com and we will pass your request to them. Your accountant may have to keep some records even if you ask them to delete them, because the law requires it.

If you use TrueFortis as an accountant or adviser

What we collect

• Your email address, used to sign you in.
• The names and email addresses of the clients you check, and the results of those checks.
• Records of when you use TrueFortis, including IP addresses, to keep the service secure.
• Anything you tell us when you contact support.

Why and on what basis

We use your information to provide TrueFortis to you under our terms, which is necessary for our contract with you. We keep security records because we have a legitimate interest in protecting the service and the people whose information it holds.

How long we keep it

We keep your account information while your account is open. When you close your account, we delete your account and your clients' reports within 90 days, unless you ask us to return them first or the law requires us to keep them for longer.

For everyone

Who we share information with

We use these suppliers to run TrueFortis. Each one only processes information on our instructions.

• Didit carries out the identity verification and screening. Processing takes place in the European Union.
• Supabase hosts our database and stores reports, in London.
• Vercel hosts the TrueFortis website. Our application runs in London. Vercel is a company based in the United States.

We do not sell personal information and we do not use it for advertising. We will disclose information to the police, the National Crime Agency, HMRC or another authority only where the law requires us to.

Transfers outside the UK

Information processed in the European Union is covered by UK adequacy regulations. Where a supplier may access information from outside the UK and the European Union, we rely on the safeguards in that supplier's data processing terms.

Security

Information is encrypted in transit. Reports are held in private storage and each accountant can only see their own clients.

Cookies

TrueFortis uses only the cookies needed to keep you signed in. We do not use analytics or advertising cookies, so we don't ask for your consent to cookies.

Complaints

If you are unhappy with how your information has been handled, email support@truefortis.com. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

We will update the date at the top of this page when we change this notice.