About ICC Group and this policy
International Corporate Check, known as ICC Group, provides employee background screening, corporate due diligence, third-party risk management, business intelligence and investigative services.
This policy explains the handling of personal information associated with iccverify.com, enquiries and business relationships. It applies to website visitors, prospective clients, client and supplier representatives, and other people who communicate with ICC Group.
ICC Group has company registrations in the United States, Pakistan and the United Arab Emirates. The entity responsible for a particular relationship depends on the relevant engagement.
Individuals undergoing checks commissioned by an ICC client should also read our Candidate Privacy Notice. Our Privacy Notice for Due Diligence and Investigative Services addresses information used in those assignments.
Browse sections
Information provided through our website
When you contact us or request a quotation, the information you provide may include your name, business email address, job title, organisation, required solution, expected implementation timeframe, how you heard about ICC, and details of your request.
We use this information to understand the enquiry, communicate with you, prepare a relevant response and manage the resulting business relationship.
Please limit initial enquiries to information needed to explain your request. Before sending identity documents, candidate records, confidential investigation material or other sensitive information, contact our team to arrange the appropriate submission channel.
Business and service information
Business relationships may involve contact details, proposals, instructions, contracts, correspondence, invoices and records needed to administer an engagement.
Screening and investigation assignments may involve additional personal information. The information depends on the service, its agreed scope, relevant sources and applicable law.
For example, HireSmart screening can involve identity, qualifications and employment verification. DD360 due diligence can involve information about companies and associated individuals. Corporate records may contain personal information about directors, owners or business principals even where the subject of the assignment is a company.
A general website enquiry does not authorise every possible screening or investigation activity.
Sources of information
Information may be provided directly by you or by the organisation you represent. In a service engagement, relevant sources can include the commissioning client, the individual concerned, verification institutions, professional referees, public records, databases and other sources appropriate to the assignment.
Public availability does not remove the need for a lawful purpose, proportionate collection and appropriate handling.
Information collected indirectly may require additional notice to the individual concerned. Any lawful exception to that requirement must be assessed in the circumstances.
Purposes and responsibility
The purposes of handling information can include:
- Responding to enquiries and preparing service proposals.
- Managing client, supplier and professional relationships.
- Carrying out instructed verification and research.
- Preparing and communicating findings.
- Addressing questions, complaints and accuracy concerns.
- Maintaining necessary business records.
- Protecting confidential information and responding to misuse.
- Meeting applicable legal requirements and handling disputes.
Responsibility for personal information depends on the activity. A controller determines the purposes and essential means of processing; a processor handles information on a controller’s documented instructions.
The relevant engagement and applicable notice should identify these responsibilities. ICC is not described in this policy as exclusively a controller or exclusively a processor for every activity.
Where the law requires a particular processing basis, that basis must be appropriate to the activity. Consent, contractual necessity, legal obligations and legitimate interests are distinct grounds with different requirements. A client’s agreement with ICC does not automatically establish contractual necessity for every individual’s information.
Sharing information
Information needed to respond to an enquiry or administer a relationship may be accessed by relevant ICC personnel. Service work may also require information to be disclosed to verification sources, the commissioning client and other recipients necessary for the assignment.
Business support providers, professional advisers and public authorities may receive information where their involvement is necessary and lawful.
The applicable service notice and engagement arrangements should explain relevant recipient categories. Disclosures should be limited to their authorised purpose and subject to appropriate confidentiality and legal requirements.
International engagements
ICC’s services include cross-border screening and research. Verification may require contacting sources in a country where an individual has lived, studied or worked, or where an organisation operates.
An international service does not necessarily mean that all information is stored in every country involved. Storage, overseas access and onward disclosure must be distinguished.
Where international transfer restrictions apply, the relevant processing requires a lawful transfer arrangement and any additional safeguards required in the circumstances. Details relevant to an enquiry or engagement can be requested through our published contact.
Retention
Information should be retained for the period justified by its purpose, applicable legal duties and the need to address a complaint, dispute or claim.
Different records may require different treatment. Enquiry correspondence, financial records, supporting verification documents and completed reports do not necessarily have the same retention period.
Where ICC processes information on a client’s behalf, return or deletion also depends on the client’s lawful instructions and the relevant processing agreement. A justified legal hold may affect the normal disposal date.
Privacy and information security
The objective of ICC’s information security policy is to protect information against unauthorised access, inappropriate disclosure, loss and alteration, while supporting access for authorised business purposes.
Our Information Security Policy Statement explains our policy principles for information handling. No website statement can guarantee complete security in every circumstance.
Website technologies and external content
Websites can involve server logs, cookies, embedded content and other technical processing. The details applicable to iccverify.com must reflect its actual configuration.
External services linked from or embedded within the website may have their own privacy information. A link to another service does not make its practices identical to ICC’s.
For questions about website technologies, contact our team. Any published cookie notice and preference controls should describe the technologies actually enabled.
Your rights and choices
Depending on applicable law and the circumstances, you may have rights to request access, correction, deletion, restriction or portability of information, object to certain processing, or withdraw consent where it is the applicable basis.
These rights are subject to relevant conditions and lawful exemptions. Withdrawal of consent does not affect processing that was lawful before withdrawal.
A request may require proportionate verification of identity. Where ICC handles records on a client’s behalf, the client may need to decide the response, with ICC providing appropriate assistance.
You may also have a right to complain to the data protection authority or regulator competent to consider the matter. Contacting ICC does not remove that right.
Contact and policy updates
For privacy questions or requests, email gcc@iccverify.com with the subject “Privacy enquiry”.
For screening-related requests, include the commissioning organisation and a case reference if available. Avoid including full identity document numbers or unnecessary sensitive attachments in an initial email.
We may update this policy to reflect changes in our activities or applicable requirements. Material changes should be communicated as required by applicable law.