Privacy notice
Last updated: 8 October 2026
Who we are
Verafor is a service that verifies professional credentials and introduces verified candidates to verified employers.
The controller of your personal data is GBNP Ltd, a company registered in England and Wales, number 16545255, trading as Verafor. Its registered office is 82a James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE.
You can reach us about anything on this page at founders@verafor.com.
We have not appointed a data protection officer. We are not a public authority, and at our current size we do not meet the thresholds that would require one. The person responsible for data protection is Nic Prioleau.
What we collect, and where it comes from
- Your identity and contact details. Name, email address, date of birth, nationality and address. Some of this you give us, and some of it is read from your identity document by our verification provider.
- Your identity document. Its type, number, issuing country and expiry date.
- The results of a biometric check. A facial similarity score, whether the liveness check passed, and a fraud breakdown. The biometric data itself stays with our verification provider and never reaches our systems.
- Your professional history. Employment, education, skills and certifications, including structured data taken from a CV you upload.
- Your verified credentials, their cryptographic hashes and who issued them.
- What you are looking for. Desired roles, industries, salary and whether you are open to work.
- Matching and consent records. Match scores, the reasons recorded against them, outreach we sent you, and whether you consented or declined and when.
- Payment records. Stripe identifiers, amounts and status.
- Account and security data. Your password hash, session and API tokens, and IP addresses in our rate limiting counters.
We do not process criminal offence data. You may see a criminal records check priced on our site. It is not purchasable and we do not carry it out.
Why we use it, and our lawful basis
| What we do | Our lawful basis |
|---|---|
| Run your account, your passport and your credentials | Performance of our contract with you |
| Verify your identity | Performance of our contract with you. The verified identity credential is what the activation fee buys |
| Ask an issuer to confirm a credential | Performance of our contract with you. You start each request |
| Score and match you against roles | Performance of our contract with you. You opt in by setting your seeking status, and matching is the service you asked for |
| Disclose your details to an employer | Your consent, given per match, which you can decline, and which expires if you do not answer |
| Run the biometric check on your identity document and selfie | Your explicit consent under Article 9(2)(a). We ask for it specifically, before the check runs, and we record when you gave it |
| Email you about a role you have been matched to | Performance of our contract with you. You asked to be contacted about roles |
| Prevent fraud, keep audit logs and secure the platform | Our legitimate interests. We use the minimum data for this and we take no decisions about you from it |
| Keep payment records | Performance of our contract, and our legal obligations for tax and accounting |
We use consent narrowly and on purpose. It covers the two things you would expect to control: releasing your details to an employer, and the biometric check. It does not cover the service itself, because you could not meaningfully withdraw consent to your own account while using it.
If you decline the biometric check you can still use the platform. The identity credential raises your trust score; it does not gate access.
Who we share it with
These are our processors. They act on our instructions and may not use your data for their own purposes, except where noted.
| Who | What they handle | Where they are |
|---|---|---|
| Onfido | Your identity document, your selfie and the biometric comparison. This is special category data | Onfido's EU region, inside the European Economic Area. The United Kingdom's adequacy regulations cover it, so no separate safeguard applies. Onfido also acts as its own controller for fraud prevention, which its own terms set out |
| OpenAI | A pseudonymised summary of your profile for matching, and the full text of a CV you upload during onboarding | United States |
| Stripe | Payment data and your email address. Your card details are entered directly into Stripe and never reach our servers | United States and Ireland |
| Brevo | Your email address and the content of messages we send you | France |
| Render | Hosting, so everything above, at rest and in transit | A United States company, hosting our systems in Frankfurt, Germany |
| Amazon Web Services | Signing our credentials. What is sent is a hash and contains no personal data | London, United Kingdom |
| Companies House and HM Revenue and Customs | Company and VAT lookups when we verify an employer | United Kingdom |
| Cloudflare | The bot check on our signup forms. It sees your IP address, your browser's user agent, a fingerprint of your network connection, and which site the check ran on. We send it nothing you typed into the form, and the check happens before you have an account with us | United States. Cloudflare also acts as its own controller when it uses these signals to improve its own bot detection, which its privacy terms set out |
We also use Google Analytics on this website, which only loads if you accept it. See our cookie policy.
An employer becomes responsible for your data once you consent to share it. Before you consent they receive nothing at all. After you consent, what that employer does with your data is their responsibility under their own privacy notice, and we cannot control it. Your consent is the only thing that releases it, which is why we ask for it per match rather than once.
Sending data outside the United Kingdom
We are a UK company and our systems are hosted in Frankfurt. Transfers from the United Kingdom to the European Economic Area are covered by the UK's adequacy regulations, so our hosting needs no separate safeguard.
Some of our processors are in the United States, which is not covered by those regulations. They are OpenAI, Stripe, Cloudflare and Render's United States parent company. We rely on the United Kingdom's International Data Transfer Addendum to the European Commission's standard contractual clauses, which forms part of our data processing agreement with each of them. We have not yet completed a transfer risk assessment for OpenAI. The same assessment is outstanding for Cloudflare.
How long we keep it
We keep your data for as long as you have an account with us, and we delete it when you ask us to. We do not delete accounts automatically after a period of inactivity.
When you ask us to delete your account, we withdraw you from the market straight away, so no employer can find you. A 30 day period then runs, during which you can change your mind and cancel the request. After that your account is erased.
Two things are not ours to decide:
- Payment records, which we keep for as long as tax and accounting law requires.
- The biometric data held by Onfido, now part of Entrust, which it keeps under its own retention policy: "Biometric Data is retained by Entrust only until the initial purpose for which it was collected has been satisfied and will be securely deleted within three-hundred and sixty five (365) days (or a shorter period set by the Company [that is, by us]) after you submit your Images and ID Doc." Images and identity documents may be stored for up to three years. We have not set a shorter period.
Automated decisions
We use a model to rank candidates against a role. A person at the employer reviews that shortlist and decides, and nothing reaches you until they do. No decision about you is made by software alone.
You can stop being matched at any time by changing your seeking status, and you can decline any individual approach. If you want to question how you were matched, write to us at founders@verafor.com and a person will answer.
Your rights
- See your data. You can export everything we hold about you from your account at any time. The export says what it leaves out and why.
- Take it with you. You can export your credentials in Comprehensive Learner Record, CSV, Open Badges 3.0 and Blockcerts formats.
- Correct it. You can edit your profile yourself. A verified credential cannot be edited by you, because being unalterable is the whole point of it; a correction goes through the organisation that issued it, and we will help you ask.
- Delete it. You can request deletion from your account, as described above.
- Limit what we do with it. Withdrawing from the market removes you from search, browsing and matching. We do not currently offer a general "restrict processing" switch beyond that; if you need one, write to us.
- Object. Setting your seeking status to not looking stops all matching.
- Withdraw consent. You can decline any match, and change your seeking status at any time. Consent to the biometric check cannot be withdrawn after the check has run, because by then it has happened. You can delete the credential it produced.
- Complain. You can complain to the Information Commissioner's Office at ico.org.uk, or to us first if you would rather. Complaining to us does not affect your right to go to the ICO.
Giving us your data is your choice
You do not have to give us anything. Without an account we cannot build you a passport, and without an identity check we cannot issue a verified identity credential, which is the thing employers rely on. Those are the only consequences.
Changes to this notice
If we change how we use your data we will update this page and change the date at the top. If the change is significant we will tell account holders by email.