Privacy Policy

We collect personal information that you provide directly to us and information generated as you use our services.

Personal Data You Provide

• Identity data: Full name, date of birth, aliases, nationality
• Contact data: Email address, phone number, mailing address
• Professional data: Employer, job title, professional credentials, CV/resume
• Account data: Username, password (hashed), account preferences
• Payment data: Billing address, last four digits of card (full card data is processed by our payment provider and never stored by us)
• Communications: Support requests, feedback, and correspondence

Usage & Technical Data

• Log data: IP address, browser type, pages visited, timestamps
• Device data: Device type, operating system, screen resolution
• Interaction data: Features used, buttons clicked, session duration

Publicly Available Data

To generate your reputation score, we process publicly available information including news articles, professional directory listings, court records, company filings, and social media profiles. We only process data that is already in the public domain.

We use your personal information for the following purposes, each grounded in a lawful basis under GDPR:

• Service delivery (Contract): Processing your reputation assessment, generating your score, delivering reports, and providing access to your dashboard.
• Account management (Contract): Creating and maintaining your account, authenticating your identity, and managing your subscription.
• Service improvement (Legitimate Interest): Analysing aggregated usage patterns to improve product features, accuracy, and the experience.
• Legal compliance (Legal Obligation): Maintaining records required by applicable laws, responding to lawful requests from authorities.
• Security (Legitimate Interest): Detecting and preventing fraud, abuse, and unauthorised access.
• Communications (Consent or Contract): Sending service notifications, product updates, and, where you have opted in, marketing communications.

We will never sell your personal data to third parties. We will never use your data for advertising purposes unrelated to our own services.

All personal data is stored exclusively within the European Union. Our infrastructure is hosted in Frankfurt, Germany (EU).

Security Measures

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3.
• Encryption at rest: All stored data is encrypted using AES-256.
• Access controls: Role-based access control with multi-factor authentication for all staff. Principle of least privilege enforced.
• Penetration testing: Regular independent security assessments.
• Incident response: Documented procedures for detecting, containing, and reporting security incidents.

While we take all reasonable measures to protect your data, no system is completely secure. We encourage you to use a strong, unique password and to notify us immediately if you suspect unauthorised access to your account.

As a data subject under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of Access: You may request a copy of all personal data we hold about you at any time.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where there is no compelling reason for us to continue processing it.
• Right to Data Portability: You may request your data in a structured, machine-readable format (JSON or CSV) for transfer to another service.
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances (e.g., while a dispute is resolved).
• Right to Object: You may object to processing based on legitimate interests at any time.
• Rights Related to Automated Decision-Making: You may request human review of any fully automated decisions that significantly affect you.

To exercise any of these rights, contact our Data Protection Officer at dpo@reputationscorecard.ai. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected.

• Active accounts: Data is retained for the duration of your account and subscription.
• Account deletion: Upon account deletion, personal data is permanently erased within 30 days, except where retention is required by law.
• Financial records: Billing and transaction records are retained for 7 years in accordance with EU accounting regulations.
• Security logs: Access and audit logs are retained for 12 months for security investigation purposes.
• Support records: Customer support communications are retained for 3 years following resolution.

You may request early deletion at any time through your account settings or by contacting dpo@reputationscorecard.ai.

We work with carefully selected third-party service providers to operate our platform. All providers are contractually bound to process data only on our instructions and in compliance with GDPR.

Categories of third-party processors include:

• Cloud infrastructure: Hosting, database, and compute services (EU-only)
• Payment processing: Secure card processing (PCI DSS compliant)
• Analytics: Anonymised, aggregated usage analytics only. No individual tracking or profiling
• Customer support tooling: Secure ticket management

We do not share your personal data with advertisers, data brokers, or any other parties for their own commercial purposes. A full list of sub-processors is available on request.

We operate a referral programme where approved partners (influencers, retail venues, sales representatives) can promote Reputation Scorecard using a unique partner code. When you sign up using a partner code, a limited and strictly minimised set of metadata is shared with that partner for commission tracking.

What We Share with Partners

Partners only ever see, on their commission ledger:

• Your initials only (for example, "J.D."), never your full name or email address
• The subscription plan you chose
• The signup date and individual invoice dates
• The net invoice amount, applicable tax, currency, and the partner's commission

We never share your full name, email address, payment card details, address, profile content, reputation score, or any other personal data with partners.

What We Hold About Partners

For partners themselves, we hold the partner's name, contact email, payout details (bank account or equivalent), tax identifiers where required, and a ledger of accrued and paid commissions. Partner data is held under the same security and access controls as customer data.

GDPR Roles

For all customer personal data, Reputation Scorecard remains the sole data controller. Partners receive only the initials-only feed described above and are not granted controller rights over your data. Where any limited processor relationship arises with a partner, an Article 28 GDPR data processing agreement applies, binding the partner to process data only on our documented instructions and to comply with all GDPR security and confidentiality obligations.

Retention

Partner-programme records, including the commission ledger that lists your initials and invoice metadata, are retained for 7 years to satisfy EU and UK accounting, tax, and audit obligations. Your underlying customer account data continues to follow the retention rules in the "Data Retention" section above; deletion of your account removes your customer record but does not erase historic commission ledger entries that we are legally required to keep.

We use cookies and similar tracking technologies to operate our service and improve your experience. Essential cookies are required for the platform to function. Non-essential cookies (analytics) are only set with your explicit consent.

For full details of the cookies we use and how to manage your preferences, please see our Cookie Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to all registered members
• Display a prominent in-app notice for 30 days following the change

Your continued use of Reputation Scorecard after the effective date of an updated policy constitutes acceptance of the revised terms. If you do not accept the revised policy, please delete your account before the effective date.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer:

Data Protection Officer
Reputation Scorecard / CISO Assurance Ltd
Email: dpo@reputationscorecard.ai

You also have the right to lodge a complaint with your national supervisory authority. In Ireland, this is the Data Protection Commission (DPC): www.dataprotection.ie.