Privacy Policy
Version 4 / Effective Oct 30, 2026
Certn Privacy Statement
We are a technology company providing background checks and identity verification services. As privacy is at the core of our business, we put a lot of effort into ensuring we adequately protect the Personal Information of the individuals interacting with us. Your trust is crucial for us, and we are confident that this privacy policy will give you the information you need.
Key points you should know when we process your Personal Information
Our role in the processing of your Personal Information
We act as a “processor” when providing services to clients (e.g., employers, landlords), following their instructions on data collection and processing. Clients are responsible for obtaining necessary consent and ensuring data accuracy. We act as a “controller” when you interact directly with us (e.g., using our services, visiting our website, applying for a job). In these cases, Certn is responsible for protecting your data and respecting your rights.
Main Processing Activities:
Certn processes Personal Information to:
- Provide services (background checks, identity verification)
- Communicate with you
- Ensure security and prevent fraud
- Comply with legal obligations
- Manage job applications (if applicable)
- Improve our services
We only process information with a legal basis, such as your consent, a contract, legal obligation, or legitimate interest. We do not use your information for automated decision-making.
Information About Processing Activities:
Detailed information about specific processing activities, including biometric identification, Certn’s subcontractor list, and details about individual checks (e.g., criminal check, OneID, etc.), can be found in the full Privacy Policy below. You can also contact us directly for further information.
Main Information Security Safeguards:
Certn maintains SOC2, SOC3, and ISO27001 certifications. We employ robust security controls, including:
- Regular security audits and penetration tests
- Security vetting and data protection training for staff, suppliers, and contractors
- Limited access to Personal Information
- Encryption for data at rest and in transit
Individuals’ Rights and Dispute Resolution:
We review any privacy request free of charge and take steps to support you in exercising your privacy rights to: (i) be informed, (ii) access, (iii) rectification, (iv) erasure, (v) processing restrictions, (vi) data portability, (vii) withdraw consent and object to processing, (viii) not be subject to a decision based solely on automated processing, and (ix) file a complaint.
To exercise any of these rights or raise a dispute, please contact our Privacy Office at [email protected]. For residents of specific jurisdictions (Canada, US, EU, Brazil, Australia), specific contact details are available in the full Privacy Policy. We will respond to your request promptly and within legal timeframes.
Certn’s Privacy Statement may be updated periodically. Please review it regularly for any changes.
I. What is Certn, and does this policy apply to you?
- Certn is a technology company that provides background checks and identity verification services.
- This privacy policy explains how Certn collects, uses, and shares Personal Information of individuals applying for jobs at Certn, those being screened by Certn, clients using Certn’s services, potential clients, and website visitors.
- Certn does not knowingly collect information from children under 13.
Certn is an information technology company that provides a wide range of products and services in the sphere of background screening and identity verification (“Services“). This privacy policy (“Policy“) describes how Certn Holdings Inc. and its affiliates, including Certn (Canada) Inc., Certn (USA) Inc., Certn UK Ltd. and any other wholly owned subsidiary (collectively “Certn” or “we” or “our“), collects, uses, discloses, and processes Personal Information in connection with websites owned by Certn (“Website(s)”), as well as its Services.
This Policy applies to you if you are:
- A “Candidate“: An individual applying at Certn.
- A “Consumer“: An individual about whom we have received information for the purpose of using our Website(s) or performing our Services.
- A “Client“: An individual representing an organization or an individual using our Services.
- A “Prospect“: An individual representing an organization or an individual we are contacting in order to learn about their interest in using our Services.
- A “Website Visitor“: An individual, a Consumer or a Client of legal age accessing our Websites.
Please note that we do not knowingly solicit information from anyone under the age of thirteen (13). If you become aware of any Personal Information shared by or on behalf of a child, please contact us using the contact information provided in the relevant section below.
II. What is Personal Information and what do we do with it?
- Personal Information is any information that can identify an individual directly or indirectly, but it doesn’t include general business contact details.
- Certn collects, uses, stores, and shares only the necessary Personal Information to provide its Services.
- Broadly speaking, we process your Personal Information (i) to provide our Services, (ii) to communicate with you, (iii) for security and fraud prevention, and (iv) to comply with the law. We may also use Personal Information for other purposes, subject to your consent.
- We will not process your Personal Information unless we have the legal right to do so. We process your Personal Information based on legal grounds like consent, contract, legal obligation, or legitimate interest.
- Certn doesn’t use your information for automated decision-making.
- You can choose to limit the Personal Information you share, but this might affect the Services Certn can provide.
For the purposes of this Policy, “Personal Information” is any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to or with an identified or identifiable individual.
Personal Information does not include business information, such as our Clients’ business address and telephone number.
We process only the Personal Information required in the course of providing our Services. “Processing” (or “processes” or “processed“) includes any operation or set of operations which is performed on Personal Information, or on sets of Personal Information, whether or not by automated means. This includes the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, transfer, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of Personal Information.
Some information, including criminal records, credit information, and biometric data, may be considered sensitive or may be subject to special protections in some jurisdictions. Such information will not be collected in every case, and will not be collected where prohibited by law, and where permitted, will only be collected and used in accordance with applicable law.
We do not make decisions about you, automated or otherwise, and we do not attempt to analyze or predict your behavior, preferences, interests, health, or other personal characteristics. However, we may carry out automated processing on our Client’s instructions.
By using our Website or our Services, you consent to the processing of your Personal Information subject to the provisions of this Policy. If you do not agree with this Policy or do not wish to provide your Personal Information to us, please do not use our Website or Services.
If you choose to provide us with a limited scope of Personal Information, we may not be able to provide our full range of Services or deliver the best experience on our Website.
Broadly speaking, we process your Personal Information (i) to provide our Services, (ii) to communicate with you, (iii) for security and fraud prevention, and (iv) to comply with the law. We may also use Personal Information for other purposes, subject to your consent. We will not process your Personal Information unless we have the legal right to do so.
To process your Personal Information lawfully, we rely on at least one legal basis as set forth by applicable law. Depending on your relationship with us, the legal basis to process your Personal Information may include, among other things, your consent, the requirement to process data for the performance of a contract with you, to comply with a legal obligation, or on the basis of legitimate interest.
If our legal basis for collecting and using Personal Information is your consent, you can withdraw or modify your consent for future collection or use of your Personal Information at any time, and we will explain the consequences of doing so. If we use your Personal Information for sales or marketing purposes, you can ask us to stop at any time and we will do so.
II.1. When Certn conducts verification on behalf of its clients
- Certn acts as a “data processor” for its clients (like employers or landlords) who use Certn’s services for background checks and identity verification. This means that Clients instruct Certn on what information to collect and how, ensure they have legal grounds and necessary consent for the collection, and are responsible for the accuracy and protection of the data. Certn carries out the client’s requests, protects the data, and complies with applicable laws. While Certn interacts with individuals, it does so on behalf of its clients and may share information with them.
- Clients must have a “Permissible Purpose” (e.g., employment, tenancy) for processing data. Certn won’t reuse data without consent, legal requirement, or compatibility with the original purpose.
- Personal information is collected with your awareness and consent, except where permitted or allowed by law.
- Clients are responsible for obtaining consent if Certn doesn’t do so directly. You can withdraw consent, which doesn’t invalidate prior processing.
- Different checks need different information, so not all of the information described in the policy might be collected for every check. You can look up the specific check you’re going through in the policy to learn more.
Our Clients, such as your employer or your landlord, may ask you to use our Services for background screening or identity verification related purposes. In these circumstances, please note that Certn acts as a “processor” in the processing of your Personal Information. This means that we act only on behalf of our Clients as a service provider when processing your Personal Information.
When we provide Services to Clients:
- The Client provides instructions on what Personal Information to collect, and how to collect it;
- If appropriate, the Client ensures that Consumers are notified of, or provide consent for, the collection and processing of their Personal Information in accordance with applicable laws;
- The Client ensures that Personal Information is collected and processed lawfully, fairly and in a transparent manner, consistent with the identified purposes;
- The Client confirms that Personal Information is accurate and, when necessary, kept up to date, rectified or erased; and
- The Client ensures that appropriate safeguards are in place to protect Personal Information.
We are generally responsible for the following aspects of collection and processing of Personal Information:
- Carrying out the Services requested by our Client or Consumer, in accordance with their instructions;
- Protecting your Personal Information in our custody against loss, theft, or any unauthorized access, disclosure, copying, use or modification, in a way that is appropriate to how sensitive it is, and in accordance with our Client’s instructions, and applicable laws;
- Complying with any legal obligations we may have as a data processor, custodian, service provider or similar under applicable laws.
In that regard, please keep in mind that while we may interact directly with you in the course of the Services requested by our Clients, we do it on behalf of our Clients, and that any information or inquiries shared with us may be communicated to our Clients whenever it is necessary for providing the Services.
II.1.1. Permissible Purpose for processing
Our Clients must certify that they have a Permissible Purpose before we can process Personal Information for the purposes of providing the Services. “Permissible Purpose” includes employment purposes, tenancy purposes or in accordance with the written instructions of the Consumer with whom the Client intends to contract.
We will not reuse Personal Information for any purpose other than the one for which it was originally collected, unless one or more of the following is true:
- the new use is compatible with the original one, meaning you should reasonably expect it;
- we have notified you of the new use and given you an opportunity to object to it; or
- the new use is otherwise permitted or required by law.
We collect, use, and disclose Consumer Personal Information when the Consumer is aware of the Permissible Purpose for which the information will be processed, and has given his or her consent to such processing, except where the processing of Personal Information without consent is permitted or required by law. Subject to regulatory requirements, operating our Services in certain jurisdictions requires us or our Clients to obtain additional or specific consents in the form of additional consent form/s, telephone call/s, through an online platform or other methods. Where the Consumer does not provide such consent or specific consent directly to us, but to our Clients, we require our Clients to obtain the Consumer’s consent prior to providing us with the Consumer’s Personal Information subject to verification for any of our Services. The Consumer may withdraw such consent previously granted at any time by contacting us. Withdrawing such consent does not affect the lawfulness of any processing based on the consent before the withdrawal.
You can find more information on the types of Services our Clients may ask you to use in the relevant section of this Policy. Please note that, depending on the type of checks you are required to perform by our Clients, we may not process all the Personal Information listed in this section. You can refer to the name of the check you are required to do in the policy to obtain more information about the processing of your Personal Information.
SMS and WhatsApp reminders: When a Client orders a check, Certn may send you reminders about that check by SMS or WhatsApp on the Client’s behalf. The Client must obtain your consent to receive these messages before providing us with your phone number. These messages relate only to your check and do not contain marketing. Message and data rates may apply. You can opt out at any time by replying STOP or UNSUBSCRIBE, or by using the unsubscribe option provided. We keep a record of your opt-out so that we can honour it. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.
II.2. When you are directly interacting with Certn
- Certn acts as a “Controller” of your Personal Information in certain situations, such as when you directly use our services, navigate our website, consent to marketing contact, or apply for a job with us. In these instances, we are responsible for protecting your data and respecting your rights.
- We may process your Personal Information to provide services, manage job applications, monitor performance, comply with laws, improve our offerings, ensure quality, train employees, maintain security, and prevent fraud.
- When providing services, we do not collect financial information directly; payments are processed securely by third-party providers.
- We may record calls for quality assurance and training purposes.
There are situations where Certn does not act on behalf of its Clients when it processes your Personal Information. This may occur in the following circumstances:
- When you directly require us to provide you with our Services or when you navigate on our Website.
- When you consent to be contacted by us for marketing purposes.
- When you apply for a job at Certn.
In these circumstances, we act as “Controllers” under the applicable data protection laws. This has implications for you because, when we are Controllers, we are primarily responsible for ensuring that your rights regarding your Personal Information are respected, and that your Personal Information is adequately protected under the applicable data protection laws.
In these circumstances, subject to your consent or applicable legal basis and in compliance with applicable laws, we may need to process your Personal Information for the following purposes:
- To provide you with the requested Services
- If you are applying at Certn, to process your application or contact you about job opportunities
- To monitor the performance of our Services and Websites
- To comply with applicable laws and regulations
- To improve our Services
- Quality assurance and quality controls
- To train our employees
- To ensure the security of our Services, Websites and assets
- To detect and combat fraud
More information relating to call recordings: We may record calls for training and quality assurance purposes. While we rely on our legitimate interest to do so, we also make sure that you are informed beforehand of such recordings. In the event you don’t want your call to be recorded, you can use our chat agent or contact us via email at [email protected].
More information relating to quality assurance and controls: Our processes for collecting and transcribing Personal Information are automated to the extent possible and are subject to rigorous quality controls. Information that is found to be inaccurate, either through our own audits or following your request for correction, is updated.
To ensure that our processes and systems are effective and efficient, we frequently audit them. These audits may involve the processing of your Personal Information (e.g.: to ensure that the checks performed are accurate).
More information relating to the provision of our Services: When you subscribe to our Services, you may be asked to enter your full name, e-mail, business name, business address, phone number, billing address, card address, and other information provided by customer through custom fields, if any. Financial information, such as data related to your payment method (e.g., valid credit card number, card brand, expiration date) is never collected by us either through our Website or otherwise. Upon processing payments, you are transferred to a secure page on the Website of Stripe or some other PCI DSS-certified payment service provider. That page may be dressed in our “livery”, but it is not managed by us. All financial information is processed by our payment processor, and you are encouraged to review their privacy policy and contact them directly for responses to your questions.
More information related to the monitoring of the performance of our Services and Websites: When we monitor the performance of our Services and Websites, we use information that can’t directly identify you, notably by aggregating it or by using other de-identification and anonymization techniques.
Please also note that we may log your operating system name and version, device identifier, browser type, operating system, Internet Protocol (IP) address, screen resolution, the pages you viewed on our Websites, how long you spent on a page, access times, general location information such as city, state or geographic area, and information about your use of and actions on our Website/s. We can use this information for fraud prevention and security purposes.
Collection of Personal Information for security purposes is done based on our legitimate interest and legal obligation to ensure Personal Information in our custody is protected.
II.2.1. Things to Know When You Use MyCertn Wallet
MyCertn Wallet is designed to give you greater control over your Personal Information. It allows you to order specific checks and decide when, to whom, and for how long you want to share the results of these checks.
Here are some key points you need to be aware of when using MyCertn Wallet:
- As we operate under your instructions, it is your responsibility to ensure that you know and authorize the recipient before sharing your Personal Information via MyCertn Wallet. We recommend you consult the recipient’s privacy policy before disclosing your Personal Information.
- You can access the results of the checks, request their deletion, dispute or correct any inaccuracies associated with your Personal Information within the MyCertn Wallet app.
- You can find more information on how we process your Personal Information depending on the checks you order via MyCertn Wallet in the relevant section of this policy.
II.2.2. Certn’s use of artificial intelligence
We utilize artificial intelligence technologies to automate and optimize our internal processes and service delivery. This includes the use of AI agents such as AI-powered chatbots and AI voice agents. We do not employ AI for making automated decisions that would produce legal effects or similarly significantly affect you. Our AI implementation is designed to enhance operational efficiency while maintaining full human oversight.
II.2.3. Certn’s use of cookies and similar technologies
Certn uses cookies to enhance website functionality and personalize your experience. Some cookies are essential for the site to operate, while others help us analyze site usage and remember your preferences, with your consent. You can manage your cookie choices through your browser settings.
Our Website uses cookies and other similar technologies to provide functionality, analyze traffic and personalize some of your web content.
II.2.3.1. What are cookies?
Cookies are small text data files that are sent to your computer or mobile device by a Website while browsing.
There are different kinds of cookies with different functions:
- Session cookies: these are only stored on your computer during your web session. They are automatically deleted when the browser is closed. They usually store an anonymous session ID allowing you to browse a Website without having to log in to each page. They do not collect any information from your computer.
- Persistent cookies: a persistent cookie is one stored as a file on your computer, and it remains there when you close your web browser. The cookie can be read by the Website that created it when you visit that Website again.
- First-party cookies: the function of this type of cookie is to retain your preferences for a particular Website for the entity that owns that Website. They are stored and sent between Certn’s servers and your computer’s hard drive. They are not used for anything other than for personalization as set by you. These cookies may be either session or persistent cookies.
- Third-party cookies: the function of this type of cookie is to retain your interaction with a particular Website for an entity that does not own that Website. They are stored and sent between a third-party’s server and your computer’s hard drive. These cookies are usually persistent cookies.
First-party cookies are necessary for the proper operation of our Website. Our Website also allows for the use of third-party cookies, which can be read externally by other organizations. As such, we cannot be responsible for third-party cookies, i.e., cookies that are not initiated by us. Our service platforms, which we use to collect information from Consumers and Clients, do not use third-party cookies.
II.2.3.2. Using cookies
Necessary Cookies: By using our Website, you agree that we can store and access necessary cookies on your device. These cookies do not gather information about you that could be used for marketing or remembering where you have been on the internet.
Statistic cookies: These are anonymous and cannot be used to identify you. Statistic cookies help us improve our Website functions and collect information on how you use the Website (such as how often you visit our Website, the links you clicked on, the pages you prefer most). Consenting to those cookies will allow us to produce anonymous statistical reports for Website improvement purposes.
Preference cookies: In order to remember the choices you have previously made (such as selected language or saved username and password), to allow for quicker browsing and to provide enhanced features, we need to enable preference cookies. The information these cookies collect is usually anonymized.
Marketing cookies: These may be set across Websites by third parties. They do not store Personal Information but identify your browser and your internet device to help advertisers in showing you relevant advertisements.
Website log data: Certn’s web servers log the following information during visits to our Website: IP addresses, type of operating system, time and duration of visit, web pages visited and browser type. We do not link server log information to any other information in a way that would enable the identification of Website Visitors to our Website. Apart from analyzing such logs to provide you with a better experience on our Website, server logs may be reviewed for security purposes and if necessary, to detect unauthorized activity on our Website. In such cases, server log data, containing IP addresses, would be shared with law enforcement bodies in order that they may identify users in connection with their investigation of the unauthorized activities.
II.2.3.3. How can I manage my Cookie preferences?
You will be presented with information about our cookies and an option to accept all cookies or customize your cookie preferences when you first visit our Website and occasionally from the cookie banner thereafter. You can consent to or refuse all cookies at any time while browsing the Website. You can choose and manage all of your cookies at any time through your browser settings. If you disable cookies, you may be unable to access or fully use certain parts or functionalities of the Website.
II.3. Things you should know depending on the checks that are performed by Certn
- Certn processes minimal identification information, including full name, date of birth, address history, phone number, and email, for all checks to ensure accurate verification. We use this information, along with data required for specific identity checks, to verify the correct individual.
- This section presents the main checks performed by Certn and may not contain information about the specific check you want or are asked to perform. Additional details regarding specific checks like drug tests or Right to Work checks are available in their respective consent forms and documentation, or by contacting us.
- Each check is unique, and we may not always process all listed Personal Information.
- Processing may also involve information from various jurisdictions depending on your personal circumstances.
All of our checks require us to process the following minimal identification-related Personal Information:
- Full name, including maiden name and aliases
- Date of birth
- Address history
- Phone number and email.
This information, coupled with the information required for any identity verification check, is used to ensure we conduct the verification on the right person. We also use your phone number to send you reminders about checks you have been asked to complete. If you are requested to conduct multiple checks, you can use the titles below to obtain more information about which Personal Information we need to process for each check, the reasons for such processing, the source of the information, and for how long we retain your Personal Information.
Please note that each check is unique and that we may not need to process all the Personal Information listed below. Depending on your personal situation, we may also need to process your Personal Information from different jurisdictions (e.g.: if you’ve worked or lived in various countries).
The list below is not exhaustive and may not contain the information related to the check you are performing. For example, in some countries, like the United States, Certn can offer the possibility to conduct drug tests, or in the United Kingdom, we may offer Right to Work checks. To obtain more information about how we process your Personal Information in these specific checks, please refer to the related consent form and documentation or contact us.
II.3.1. OneID
| One ID | Personal information involved | Full name, including maiden name and aliases |
| Date of birth | ||
| Address history | ||
| Phone number and email | ||
| Identification documents such as passport or drivers license | ||
| Biometric data (facial characteristics) | ||
| Processing Purposes | Identity verification | |
| Fraud detection and prevention | ||
| Source(s) | Provided by you | |
| Retention periods | 30 days from the date of collection for biometric data | |
| 3 years from the date of collection for the contact information and the results of the check. | ||
| More information | For more information, please read our Biometric Notice. |
II.3.2. Identity Verification
| Identity Verification | Personal information involved | Full name, including maiden name and aliases |
| Date of birth | ||
| Address history | ||
| Phone number and email | ||
| Identification documents such as passport or drivers license | ||
| Biometric data (facial characteristics) | ||
| Processing Purposes | Identity verification | |
| Fraud detection and prevention | ||
| Source(s) | Provided by you | |
| Retention periods | 30 days from the date of collection for biometric data | |
| 3 years from the date of collection for the contact information and the results of the check. | ||
| More information | For more information, please read our Biometric Notice. |
II.3.3. Canadian Criminal Record Check
| Canadian Criminal Record | Personal information involved | Sex |
| Place of birth | ||
| Police records | ||
| Court records | ||
| Criminal history | ||
| Sex offender registry status | ||
| Processing Purposes | Verification of your criminal background | |
| Source(s) | Provided by you | |
| Law enforcement and government agencies | ||
| Courts and public records | ||
| Retention periods | 3 years from the date of collection |
II.3.4. International Criminal Check
| International Criminal Check | Personal information involved | Sex |
| Police records | ||
| Court records | ||
| Criminal history | ||
| Passport details or similar information such as ID number, Visa information, and jurisdiction specific documents | ||
| Processing Purposes | Verification of your criminal background | |
| Source(s) | Provided by you | |
| Law enforcement and Government agencies | ||
| Courts and public records | ||
| Retention periods | 3 years from the date of collection |
II.3.5. Employment Verification
| Employment Verification | Personal information involved | Employment history (including company name, contact information, fiduciary or directorship responsibilities, positions, titles, income, or start and end dates) |
| Processing Purposes | Employment or activity history verification over a certain period of time | |
| Source(s) | Provided by you | |
| Previous employers | ||
| Employment verification vendors | ||
| References you have provided | ||
| Retention periods | 3 years from the date of collection |
II.3.6. Education Verification
| Education Verification | Personal information involved | Post secondary information (including institution name, institution address, degree/certification title, and dates of enrolment) |
| Processing Purposes | Education or activity history verification over a certain period of time | |
| Source(s) | Provided by you or our Client (where applicable) | |
| Educational institutions | ||
| Education verification vendors | ||
| Government education authorities | ||
| Retention periods | 3 years from the date of collection |
II.3.7. Credit Report (Canada)
| Credit Report (Canada) | Personal information involved | Employment history (including name, contact information, fiduciary or directorship responsibilities, positions, titles, income, or start and end dates) |
| Financial information (including credit history, bankruptcy or financial judgments) | ||
| Processing Purposes | Credit and bankruptcy history verification | |
| Source(s) | Credit bureaus | |
| Government agencies | ||
| Public records | ||
| Retention periods | 3 years from the date of collection |
II.3.8. Income Verification
| Income Verification | Personal information involved | Bank account details (including bank name, account balance, account activity trends, account balance trends, recurring deposits, recurring payments, and account age) |
| Income information (including sources of income, average monthly income, estimated gross annual income, employer income, non-employer income, or income trends) | ||
| Processing Purposes | Verification of your income | |
| Sources | Financial institutions | |
| Income verification vendors | ||
| Retention periods | 3 years from the date of collection |
II.3.9. Adverse Media Check
| Adverse Media Check | Personal information involved | Social media activity (posts, interactions, etc.) |
| Mentions in online or print media | ||
| Processing Purposes | Verification of adverse media | |
| Sources | Print and digital media outlets | |
| Law enforcement and government agencies | ||
| Retention periods | 3 years from the date of collection |
II.3.10. Politically Exposed Persons (PEP) Check
| Politically Exposed Persons (PEP) Check | Personal information involved | Work address |
| Inclusion on watch or sanctions lists | ||
| Financial Conduct Authority reference number (if applicable) | ||
| Familial or business relationships with politically exposed persons | ||
| Processing Purposes | Verification to determine whether you hold, or have held, a prominent public position or a role that exposes you to potential risks of corruption, bribery, or money laundering. | |
| Global sanctions regimes and sanction lists verification | ||
| Verification of adverse media | ||
| Sources | Global watch lists and registries | |
| Law enforcement and government agencies | ||
| Regulatory bodies | ||
| Retention periods | 3 years from the date of collection |
II.3.11. Global Sanctions and Watchlists
| Global Sanctions and Watchlists | Personal information involved | Inclusion on watch or sanctions lists |
| Processing Purposes | Global sanctions regimes and sanction lists verification | |
| Sources | Global watchlists and registries | |
| Law enforcement and government agencies | ||
| Regulatory bodies | ||
| Retention periods | 3 years from the date of collection |
II.3.12. Questionnaire
| Questionnaire | Personal information involved | Any additional information voluntarily submitted by you |
| Processing Purposes | Provide additional necessary information to Certn’s Clients in the course of the requested checks | |
| Sources | Provided by you | |
| Retention periods | 3 years from the date of collection |
III. How do we protect your Personal Information?
III.1. Our approach to data protection
At Certn, we are committed to protecting your privacy and Personal Information. We’ve implemented a comprehensive privacy framework based on key principles. We are accountable for protecting your information, and we have implemented a privacy officer to oversee our practices and ensure compliance with applicable laws. We identify the purposes for collecting your information beforehand and only collect it when legally allowed or with your consent. We limit data collection to what’s necessary, minimizing it throughout its lifecycle with strict retention policies. We maintain accuracy through technical controls and audits, making it easy for you to correct inaccuracies. We protect your information with strong safeguards and train everyone who handles it. We are transparent about our data practices and ensure our documentation is clear. We also respect your rights regarding your Personal Information and provide a process for complaints. We regularly audit our compliance. Our services are designed with confidentiality (state-of-the-art security), manageability (individual control over data), and predictability (transparent practices) in mind.
At Certn, we are committed to protecting your privacy and Personal Information. We have implemented a comprehensive framework that outlines our objectives and principles for processing Personal Information and settles our privacy governance as an organization. This framework is based on the following key principles:
- Accountability: We take responsibility for protecting your Personal Information. We’ve implemented a privacy office to oversee our privacy practices and ensure we follow all relevant laws.
- Identifying Purposes: We have processes in place to ensure that the purposes for which your Personal Information is collected are identified beforehand.
- Legal Basis including Consent: We only collect and use your information when the law allows us to, or when you give us your consent. We’ll make sure you understand what you’re agreeing to.
- Limiting the processing of Personal Information: We only collect the Personal Information necessary for the purposes we’ve identified.
We also ensure that we minimize the Personal Information needed during its whole lifecycle. This is notably done by implementing strict retention periods. You can find more information regarding our retention practices in the relevant sections of this policy.
- Accuracy: We keep your information accurate and up to date, notably, by implementing rigorous technical and quality controls and audit processes. We make it easy for you to correct any mistakes or inaccuracies.
- Safeguards: We protect your information with strong security measures, including physical, technical, and administrative safeguards. We also make sure anyone who handles your information is properly trained.
- Transparency: We’re open about how we collect, use, and protect your Personal Information. We make sure that our documentation related to the processing of your Personal Information is written in clear and understandable form.
- Individuals’ Rights: You have rights regarding your Personal Information, including the right to access, correct, or delete it. We make it easy for you to exercise these rights.
- Challenging Compliance: We have a process for you to make complaints or ask questions about our privacy practices. We also regularly check our own compliance with privacy laws.
We take great care to ensure that your Personal Information is processed in a manner that is consistent with these principles.
Moreover, in accordance with our privacy framework, our Services are designed to pursue these three main objectives:
- Confidentiality: We implement state-of-the-art security measures to protect Personal Information and train our Workforce Members on best practices.
- Manageability: We design our Services to give individuals control over their Personal Information, including the ability to modify, delete, or selectively disclose it.
- Predictability: We maintain transparent practices that allow individuals to make reliable assumptions on how we process their Personal Information.
III.2. How long do we retain your Personal Information?
Certn retains your Personal Information as needed to provide services, comply with legal obligations, and enforce agreements. We delete your account and data upon request, though some information may be retained for legal reasons. Subject to our clients’ specific instructions, Consumer information is generally kept for a maximum of three years, with exceptions for specific data types like biometrics (30 days) and candidate information (3 years).
In accordance with our Retention Policy, we will retain your information for as long as needed to provide you with our Services and/or as necessary to comply with our contractual and legal obligations, resolve disputes, and enforce our agreements.
Data required to establish proof of a right or a contract will be stored for the duration provided by applicable law. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, some information may be retained in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our terms and/or comply with legal requirements.
In relation to Consumer Personal Information, unless records have been subject to a deletion request or subject to a different retention period instructed by our Clients, the retention and disposal schedule shall be no more than three (3) years. You can find more specific information about our retention periods depending on the checks we conduct in the relevant section of this policy. Exceptions may exist for specific data sets as governed by regulatory or third-party data providers’ retention requirements. For example, we will store your biometric data 30 days following the completion of your identity verification via OneID. Where required, we may keep general information as a log and for auditing purposes.
If you are a Candidate, we keep your Personal Information for no more than 3 years.
III.3. How do we protect your Personal Information?
We maintain SOC2, SOC3, and ISO27001 certifications, implementing robust security controls to protect Personal Information. Certn regularly conducts security audits and penetration tests to ensure compliance. Our staff, suppliers, and contractors undergo security vetting and data protection training. We limit access to Personal Information and utilize encryption for secure data handling.
We are SOC2, SOC3 and ISO27001 certified and maintain advanced technical, administrative, and physical security controls that comply with those standards and protect your Personal Information from unauthorized access, loss, misuse, interference or alteration during its collection, use, disclosure, and storage. We perform security audits, vulnerability scans, and penetration tests on a regular basis to ensure compliance with industry security practices and standards.
All our staff, suppliers and contractors are security vetted prior to taking up employment. All staff are data protection trained and are aware of their responsibilities. Such training is conducted repeatedly on a regular or random basis, but at least once a year.
We limit access to Personal Information to individuals with a legitimate business need consistent with the reason and purpose for which the information was provided. We implement a variety of security measures to maintain the safety of your Personal Information when orders are placed or when you enter, submit, or access your Personal Information. For example, we use encryption at rest and in transit. All supplied sensitive information is transmitted via Transport Layer Security (TLS) technology and then stored in our database and only accessed by those authorized with special access rights to our systems, who are required to keep the information confidential.
In addition, we have processes in place to encourage our Clients to comply with applicable privacy laws and security standards. Such processes include but are not limited to entering into binding agreements with our Clients and conducting mutual random audits of each other’s internal procedures and practices to ensure that regulatory standards and security levels are mutually met and exceeded at all times.
IV. How and with whom can we share your Personal Information?
Certn processes Personal Information globally, storing data in Canada, the US, the UK, and Australia. We may transfer data across borders to provide services like verifying employment or education. These transfers are based on adequacy decisions, safeguards, consent, or other legal considerations. We take measures to ensure data security and comply with specific requirements for regions like California, Quebec, the UK, Australia, the EU, and the EEA. We may share Personal Information with auditors, affiliates, partners, and service providers like payment processors and cloud providers. We do not sell or disclose Personal Information to governments, marketing services, or other clients, except as legally required or as outlined in this policy. We may disclose information to law enforcement or similar bodies when legally obligated.
IV.1. Does Certn process Personal Information across borders?
Certn operates globally and may need to transfer your Personal Information across borders in the course of its operations. Notably, we rely on storage infrastructures within Canada, as well as the United States, the United Kingdom, and Australia. We may also need to process your Personal Information across borders for the purposes of providing you the Services such as verifying your work or education history.
When we transfer your Personal Information, we notably rely on the following elements:
- Adequacy decisions
- Appropriate safeguards, including contractual safeguards
- Your consent
- Other jurisdictional considerations.
In cases where our Client is located in, or the Consumer is residing or has resided in, the state of California, the province of Quebec, the UK, Australia, the EU, and/or the EEA, specific requirements may apply to the transfer of Personal Information.
We take all measures reasonably necessary to ensure that your Personal Information is treated securely and in accordance with this Policy, and we will not transfer Personal Information to an organization or a country unless there are adequate controls in place to ensure the security of your data.
If you have any questions as to whether your information will be Processed overseas, and/or if you have any restrictions or conditions regarding the release of your information across borders, please contact us as soon as possible so we may discuss your specific requirements.
IV.2. Third Parties
We only share your Personal Information with third parties with your consent, or when permitted or required by applicable law.
In addition to the third parties listed in the section relating to the types of checks, we may need to share or disclose your Personal Information to the following third parties in the course of our business operations:
- Auditors for the performance of contracted or statutory compliance audits;
- Certn affiliates and partners who are participating in the delivery of our Services; and
- Third parties that perform services for us or on our behalf, including but not limited to payment processing, data analysis, email delivery, SMS and messaging services, Software as a Service Providers, Infrastructure as a Service Providers, or Platform as a Service Providers. These providers may use Personal Information only to provide services to Certn.
When we provide Services to a Client, the Consumer Personal Information is processed and reported through our secure platform. Apart from our Clients and in addition to authorized Certn personnel who may access your Personal Information for the purposes outlined in this Policy, we may provide your Personal Information to authorities or partner companies that provide services to help us with our business activities such as offering customer service or processing your payment. For more information on the third-party companies who provide such services to us, please click here.
Finally, please note that we do not sell or disclose your Personal Information to governments, marketing or advertising services, other Clients, or anyone else except as outlined in this Policy or as required by law.
IV.3. Governmental entities
In exceptional circumstances, we may be requested to communicate Personal Information to law enforcement agencies, national security agencies, courts, or other similar institutions as required by law. If in receipt of a production order, subpoena, warrant, or other enforceable demand, we will act in compliance as required by the applicable laws.
V. Essential information tailored to your country and how to contact us to assert your rights
- We are committed to protecting your privacy and ensuring your rights are respected. Regardless of where you live, you have the right to be informed, access, rectify, erase, restrict processing, data portability, withdraw your consent and object to processing, not be subject to automated decisions, and file a complaint. We will review your privacy requests free of charge and respond promptly, within legal time limits. We may need to inform our clients or other third parties who processed your data before taking action on your request.
- You can contact our Privacy Office via email at [email protected] or, if you are a resident of specific jurisdictions (Canada, US, EU, Brazil, Australia), use the contact details provided for your location.
- We may update this policy periodically, so please check it regularly.
V.1. Your rights
Certn is committed to ensuring that your rights regarding your Personal Information are respected across all jurisdictions in which it operates.
Regardless of your jurisdiction, we extend the following rights to individuals whose Personal Information we process. If you reside outside the jurisdictions outlined below, please consult the details provided to exercise your rights.
Regardless of your place of residence, we will review any privacy request free of charge and take steps to support you in exercising your privacy rights to: (i) be informed, (ii) access, (iii) rectification, (iv) erasure, (v) processing restrictions, (vi) data portability, (vii) withdraw consent and object to processing, (viii) not be subject to a decision based solely on automated processing, and (ix) file a complaint.
If you are not a resident of the jurisdictions outlined below, you can contact our Privacy Office at [email protected] to exercise your privacy rights. If you are a resident of one of these jurisdictions, please use the contact details provided in the section that applies to your situation.
Upon receipt of a written request, and after verifying you as the data owner, we respond to privacy right requests, disputes, and complaints as soon as practicable, and in any event, within the time limits prescribed by law. However, where we refuse to do so, we will give you a written notice setting out the reasons within 30 days of the receipt of your request.
For the purposes of compliance and where required by law or contract, prior to actioning any privacy right request, we will inform the Client connected to such request, if any, as well as any other third parties who may have processed your Personal Information. Upon their instructions, we will reply to your request accordingly. You can contest their decision by directly reaching out to them or contacting your local data protection or privacy authority.
V.1.1. Right to be informed
You have the right to be informed on the nature of the processing of your Personal Information. You have the right to know what Personal Information we process, the third parties it may be shared with, and how long we will keep it.
V.1.2. Right to access
Subject to applicable laws’ exceptions, you have the right to access the Personal Information Certn holds about you or on behalf of its Clients. You can request us to provide you with your Personal Information using the contact details provided in this Policy or the tools and forms we make available to you across our various Services.
V.1.3. Right to rectify, correct or update your Personal Information
You have the right to request us to correct, rectify or update your Personal Information that is not accurate, complete or up to date. Upon the presentation of the relevant evidence, we will take reasonable steps to correct this information or if necessary, discuss alternative actions with you.
V.1.4. Right to erasure or deletion
You have the right to request the deletion or erasure of your Personal Information. Such a right is performed in accordance with applicable laws, and may be limited depending on the nature, scope and the laws applicable to your request. Certn may keep some of your Personal Information when it is required or permitted under applicable laws. For example, we may need to keep your Personal Information to demonstrate our compliance with data protection or privacy laws. If you request the deletion of your Personal Information, we need to keep some information related to the fact that you asked for your data to be deleted and that we complied with your request.
V.1.5. Right to portability
You have the right to obtain your Personal Information in a structured, commonly used and machine-readable format and require us to transmit it to another third party that is qualified under applicable laws. This right is limited to the Personal Information you directly provided to us.
V.1.6. Right to withdraw your consent and right to object
Subject to the exceptions outlined in applicable laws, you have the right to withdraw your consent if we rely on it to process your Personal Information. If you do so, please note that we may not be able to deliver the Services anymore. If the Services are requested for a Client’s Permissible Purpose like employment or tenancy, this may affect the related processes. Whenever possible, we encourage you to contact the landlord, employer, or the organization that requested the check to gather additional information regarding the implications of withdrawing your consent.
You have the right to object to specific processing activities of your Personal Information depending on the legal framework that applies to your situation. For example, you have the right to object to processing of your Personal Information for direct marketing purposes, including profiling.
V.1.7. Right to restriction of processing
Under the circumstances provided by applicable laws, you have the right to ask us to restrict the processing of your Personal Information.
V.1.8. Right to not be subject to a decision based solely on automated processing
Certn does not use your Personal Information to render decisions based solely on automated processing.
V.1.9. Right to file a complaint
If you have any concerns regarding our data protection practices or the management of your Personal Information, we encourage you to submit a complaint by reaching out to our Privacy Office. You can find the necessary contact details in this Policy.
V.2. Canada residents
You can find detailed information about our policies and processes relating to the protection and retention of your Personal Information in the relevant sections of this Policy.
As stated in the sections above, please note that Certn may transfer your Personal Information outside Canada, including, outside the province of Quebec, whenever it is necessary for the purposes for which it has been collected.
V.2.1. Personal Information Agent (Quebec)
Certn is a registered Personal Information Agent in Quebec. In that regard, please note that:
- We hold Personal Information of other persons.
- We may communicate credit reports bearing on your character, reputation or solvency to our Clients or other co-contractors, and we may receive such information from our co-contractors such as our partners or service providers.
- You are entitled to request access or rectification of your Personal Information by following the process outlined in this Policy.
- Certn ensures that your Personal Information is up to date and accurate by implementing strong technical controls such as automated processes, and internal quality controls and audits. Certn also provides a way for you to challenge or correct the information we collect about you from you directly or from our Clients and partners.
V.2.2. Who to contact?
For any questions, complaints or inquiries regarding this Policy you can contact our appointed Privacy Officer at:
| Canada | Certn (Canada) Inc. 1006 Fort St Unit 300 Victoria, BC V8V 3K4 +1-844-987-0690 [email protected] |
V.3. United States residents
V.3.1. Your rights under the Fair Credit Reporting Act
As a resident of the United States, please note that some Personal Information processed by Certn might be subject to the Fair Credit Reporting Act (“FCRA”), and that the privacy law of your state may be pre-empted. Unless you applied for a position at Certn, we do not make any decisions relating to your employment. To have more information about the FCRA, your rights under this law and how it may apply to your situation, please contact your employer.
V.3.2. California residents
For purposes of the California Consumer Privacy Act (“CCPA”), we do not “sell” Consumer Personal Information to third parties for direct marketing purposes. Personal Information processed for the purposes of delivering a background check is exempt from CCPA.
To the extent that you are a California resident and in the event we may have processed categories of your Personal Information beyond the CCPA exemption in relation to delivering a background check, you have the right to access your Personal Information, delete it, have it disclosed, opt out of sales, and be free from discrimination. You can contact us to exercise any of these rights. For compliance purposes, we may require additional information from you in order to honor your request.
V.3.3. Nevada residents
We do not sell Consumer Personal Information to third parties for direct marketing purposes.
V.3.4. Who to contact?
For any questions, complaints or inquiries regarding this Policy you can contact our appointed Privacy Officer at:
| United States | Certn (USA) Inc. Trust Center 1209 Orange Street Wilmington New Castle County, Delaware, 19801 +1-844-987-0690 [email protected] for any privacy-related questions. |
V.4. EU, EEA, Swiss and UK residents
Because we occasionally process Personal Information of EU, EEA, Swiss and UK residents, we have taken measures to comply with those jurisdictional standards and ensure that all recipients of any such Personal Information provide an adequate level of data protection based on, but not limited to, commitments to standard contractual clauses and/or international data transfer agreement/s as applicable.
EU, EEA, Swiss and UK Consumers have certain rights regarding the processing of Personal Information. If you are an EU/EEA/UK resident, you have:
- the right to request details of the Personal Information we have about you;
- the right to ask that we update your information if it is inaccurate or incomplete;
- the right to ask that we delete your information in certain circumstances;
- the right to withdraw your consent to the use of your information where we are relying on that consent;
- in some circumstances, you have the right to receive some of your information in a usable format and/or request we transmit that data to a third party where this is technically feasible;
- the right to request that we restrict the processing of your Personal Information in certain circumstances; and
- the right to lodge a complaint with your local data protection authority if you think we have not been able to assist you.
If you would like to exercise your rights in relation to your consumer report, we will support your request in our capacity as a data processor and in alignment with our Client who ordered the report in their capacity as a controller. In such circumstances, please kindly note that our Clients are ultimately responsible for responding to your data subject request.
To log your request, please contact us. We will contact you if we need additional information from you in order to deliver the applicable information or undertake specific actions to honor your request in exercising your rights.
V.4.1. Who to contact?
For any questions or inquiries regarding this Policy you can contact our appointed Data Protection Officer at:
| United Kingdom | Certn (UK) Limited 160 London Road Sevenoaks, Kent, TN13 1BT +44 (0)1732 748 900 [email protected] for general queries and [email protected] for privacy-related queries. |
V.5. Brazil
Brazilian residents may have certain rights to:
- confirm whether we process your Personal Information;
- request access to your Personal Information that is being processed by us;
- rectify incomplete, inaccurate or outdated Personal Information;
- request the anonymization, blocking or deletion of unnecessary or excessive information or information processed in noncompliance with the provisions of the LGPD (Lei Geral de Proteção de Dados Pessoais);
- request data portability;
- be informed about third parties with whom your Personal Information has been shared; and
- request a review of automated decisions that affect your interests.
To exercise your rights in relation to your consumer report, we will support your request in our capacity as a processor and in alignment with our Client who ordered the report in their capacity as a controller.
To log your request, please contact us by using our contact details provided below. We will contact you if we need additional information from you in order to deliver the applicable information or undertake specific actions to honor your request in exercising your rights.
V.6. Australia
Certn conducts checks in Australia via its affiliate InterCheck. For more information on how InterCheck processes your Personal Information, please visit: https://intercheck.com.au/privacy-policy/.
For any questions, complaints or inquiries regarding this Policy you can contact our appointed Privacy Officer at:
| Australia | 356 Collins Street Melbourne, 3000, Victoria +61 (03) 8820 4069 [email protected] for privacy-related questions or inquiries and [email protected] for any other questions. |
VI. How is the policy updated?
We reserve the right to modify this Policy at any time. All Website Visitors are encouraged to periodically review this Policy to stay informed of updates. Your continued use of our Website and Services following the posting of changes to this Policy will mean you agree with, and consent to be bound by, the new revised Policy.