TrueConfirm respects your privacy and is strongly committed to keeping secure any information we obtain from you or about you. This Privacy Policy describes our practices with respect to Personal Information we collect from or about you when you use our website and services.

​

Definitions and Scope

"Consumer" means an individual who is a current or former employee of a TrueConfirm employer client and about whom we hold employment or income information.

 

“Verifier” means an organization or individual that has been approved through TrueConfirm’s verification process, authenticated under our procedures, and required to certify a permissible purpose under the FCRA (15 U.S.C.§1681b) and other applicable law. Where required by applicable law or our procedures, a Verifier must obtain and provide required consumer authorization.

 

TrueConfirm is a consumer reporting agency under the FCRA with respect to employment and income verification services. Information we handle in that capacity ("FCRA Data") is governed primarily by the FCRA and is subject to the specific protections described below. Information we collect from website visitors, account users, and business contacts is governed by the remainder of this Policy and applicable privacy laws.

​

Information We Collect

 

Information Automatically Provided

We may receive and store the following information when you visit our site and/or use our online platforms:

 

• Client and Usage Data: As is standard practice, our access and server logging mechanisms may automatically collect information about your use of our services, such as the types of content that you view, and the actions you perform, as well as your browser user agent and version, type of computer or mobile device, IP address, time zone, country, and the dates/times of access. This data is automatically sent by your browser and is used to maintain the availability and security of our site.

• Cookies: A cookie is a short, temporary bundle of information that a website stores on a visitor’s computer, and that the visitor’s browser provides to the website throughout the session and each consecutive visit. TrueConfirm may use cookies and similar technologies and services to enable application session information and/or functionality.  Individuals can control the use of cookies at the browser level.  Doing so may limit the use of certain features or functions on our website or our service. These cookies are not used for advertising or third-party tracking services.

 

Information You Provide to Us

• Communication Information: If you communicate with us, we may collect your name, contact information, and the contents of any messages you send.

• Account Information: When you create an account, we will collect and record information associated with your account, including your name, contact information, email address, account credentials, and transaction history.

• Information Submitted Through Our Services: When you use our Services, we may collect Personal Information that is included in the input, file uploads, or feedback that you provide to our Services.

 

Information Provided by our Employer Clients and Partners

TrueConfirm works with a variety of clients to provide them with employment and income verification services.  To provide these services, TrueConfirm clients may send us summary employment and income information on their current and former employees. If you are a current or former employee of one of our employer clients, we may have employment and income data that pertains to your work history with that employer.

​

Categories of Personal Information We Collect

• Identifiers - Name, email, address, IP address, tax id, date of birth, employee ID​

• Employment and income information - Employer, job title, dates of employment, pay, status

• Internet/network activity - Logs, user agent, pages viewed

• Commercial information - Transaction history

• Sensitive or high-risk information - Tax id, date of birth, pay

​​​

How We Use Personal Information

We may use Personal Information for the following purposes:

 

• To provide, administer, maintain, improve and/or analyze our services

• To communicate with you

• To prevent fraud, criminal activity, or misuses of our Services, and to ensure the security of our IT systems, architecture, and networks

• To comply with legal obligations and legal process and to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other third parties.

 

Disclosure of Personal Information

In certain circumstances we may provide your Personal Information to third parties without further notice to you, unless required by the law:

 

• Verification Services: We disclose employment and income information to authorized third parties verifiers who have a permissible purpose to obtain said information under the Fair Credit Reporting Act (FCRA). Verification disclosures are consistent with our employer client and partner contracts and only to provide services you request, as necessary to comply with the law, and/or as otherwise permitted by the Fair Credit Reporting Act (FCRA).

• Vendors and Service Providers: To assist us in meeting operational needs and to perform certain services and functions, we may provide Personal Information to vendors and service providers, including providers of hosting services, cloud services, communication services, and other information technology services providers. These parties will access, process, or store Personal Information only while providing their services to us.

• Legal Requirements: TrueConfirm may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may also disclose personal information or other information as required by law, such as to comply with a subpoena or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

• Business Transfers: If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider, your Personal Information may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets.

​

No Sale or Sharing of Personal Information

TrueConfirm does not sell, license, rent, or disclose Personal Information to data brokers, advertisers, marketers, data miners, or other third parties for their commercial, marketing, advertising, or profiling purposes.

 

We disclose FCRA Data only through our client-authorized employment and income verification process to Verifiers that have been approved and authenticated under our procedures and that are required to certify a permissible purpose under the FCRA and applicable contractual requirements. Those disclosures are made to provide consumer reports, not for advertising or cross-context behavioral advertising.

 

We do not sell or share (as defined under the California Consumer Privacy Act, as amended, and similar state laws) Personal Information for cross-context behavioral advertising or targeted advertising. Our use of analytics services on our marketing website is described in "Cookies and Analytics" below. We do not knowingly sell or share the Personal Information of individuals under 16.

​

Cookies and Analytics

TrueConfirm uses cookies and similar technologies to enable application session information and functionality and to understand use of our public marketing website. Individuals can control cookies at the browser level, although doing so may limit certain features or functions.

​

Retention

We retain Personal Information only as long as necessary for the purposes described in this Policy, including to comply with legal obligations (such as FCRA record-retention and dispute-handling requirements), resolve disputes, and enforce our agreements. Our retention criteria are:

 

• FCRA Data: the term of our agreement with the employer client, our obligations to handle consumer file disclosures and disputes, and applicable legal and regulatory requirements.

• Account information: the life of your account and the period needed to resolve disputes, meet legal obligations, and enforce our agreements.

• Server, security, and usage logs: the period needed to maintain the security, availability, and integrity of our systems, investigate incidents, and meet legal and contractual requirements.

• Communications: the period needed to respond to you and to document   our dealings with you.

 

When information is no longer needed, we delete or de-identify it. We document specific retention periods in our internal records retention schedule.

 

Your rights

Depending on geographic location, you may have certain statutory rights in relation to your personal Information. For example, you may have the right to:

 

• Access your Personal Information.

• Correct or update your Personal Information

• Withdraw your consent to the processing or disclosure of your Personal Information where we rely on consent or legitimate interests as the legal basis for processing

• Delete your Personal Information.

 

If you are a current or former employee of a TrueConfirm employer client, you can exercise some of these rights through your TrueConfirm Employee user account. If you are unable to exercise your rights through your account, please send your Data Subject Access Request (DSAR) to privacy@trueconfirm.com.

 

To protect your Personal Information from unauthorized access, change, or deletion, we may require you to verify your identity before you can submit a request to know, correct, or delete Personal Information. If you do not have an account with us, or if we suspect fraudulent or malicious activity, we may ask you to provide additional Personal Information and proof of residency for verification.

 

We may limit or decline a request where permitted by applicable law, such as when we cannot verify your identity, the request is manifestly unfounded or excessive, compliance would interfere with legal or regulatory obligations, or an applicable legal exemption applies. If we deny a request, we will explain our decision as required by applicable law.

​

Your Rights Under the Fair Credit Reporting Act (FCRA)

As a consumer reporting agency, we provide these rights regarding FCRA Data:

 

• Access: You may request disclosure of the information in your consumer file, the sources of that information as required by law, and the identification of persons that procured consumer reports about you during the periods required by the FCRA, generally two years for employment purposes and one year for other purposes.

• Dispute: You may dispute the accuracy or completeness of any information in your file. We will conduct a reasonable reinvestigation, generally within 30 days, and notify you of the results. We may contact the employer client that furnished the information.

• Adverse action: If you receive an adverse-action notice based in whole or in part on a consumer report provided by TrueConfirm, you may be entitled under the FCRA to request a free copy of your consumer report from us within 60 days after receiving that notice. You may also be entitled to a copy of the FCRA Summary of Your Rights.

• Permissible purpose and authorization: We provide consumer reports through our controlled verification process only to Verifiers that have been approved and authenticated under our procedures and that certify a permissible purpose under 15 U.S.C. §1681b. Where required by applicable law or our procedures, we require the Verifier to provide consumer authorization before we disclose requested information.

 

To exercise these rights, contact us at privacy@trueconfirm.com. For more information, see the Consumer Financial Protection Bureau's A Summary of Your Rights Under the FCRA at consumerfinance.gov.

​

U.S. State Privacy Rights

Residents of U.S. states with applicable privacy laws may have additional rights with respect to Non-FCRA Data, subject to applicable exemptions and limitations. Depending on your state, these may include the right to:

 

• Know/access the Personal Information we hold and the categories of sources and recipients;

• Correct inaccurate Personal Information;

• Delete Personal Information;

• Obtain a portable copy of your Personal Information;

• Opt out of sale, sharing, targeted advertising, and profiling (we do not engage in these activities);

• Limit the use of Sensitive Personal Information (we use it only for the purposes described above);

• Appeal a denial of your request; and

 

FCRA exemption: Certain state privacy laws contain exemptions for Personal Information that is collected, maintained, used, communicated, disclosed, or sold by a consumer reporting agency in connection with activity that is regulated by, and conducted in compliance with, the FCRA. The availability and scope of an exemption depend on the applicable law and the particular data and processing activity. Where an exemption applies to your FCRA Data, we will handle your request under the FCRA rights above instead and disclose this to you.

 

How to submit a request: Email privacy@trueconfirm.com. We will verify your identity before responding. You may use an authorized agent, who must provide written permission, and we may verify your identity directly with you. We will acknowledge and respond to requests within the time periods required by applicable law. Where permitted, we may extend the response period and will notify you of the extension and the reason for it.

 

If we deny your privacy request, you may appeal by replying to our response or emailing privacy@trueconfirm.com with the subject line “Privacy Request Appeal.” Please describe the basis for your appeal. We will respond within the period required by applicable law. If your appeal is denied, we will provide information about any available right to contact your state attorney general or other regulator.

​

Individuals in the European Economic Area, United Kingdom, and Switzerland

TrueConfirm is based in the United States. Some of our employer clients have employees located in the European Economic Area (EEA), United Kingdom, or Switzerland. To the extent the GDPR, UK GDPR, or Swiss FADP applies to our processing of Personal Information, the additional information in this section applies.

 

For employment and income information provided by an employer client, TrueConfirm’s role may vary depending on the applicable service and contractual arrangement. In many cases, the employer client determines the purposes and means of processing and TrueConfirm processes information on the client’s behalf. In other limited circumstances, TrueConfirm may act as an independent controller, including when performing obligations applicable to a consumer reporting agency. The applicable role is described in the relevant client agreement.

 

Legal bases

• Contract: to provide our services and manage your account.

• Legitimate interests: to secure our systems, prevent fraud, and operate and improve our services, where those interests are not overridden by your rights.

• Legal obligation: to comply with applicable law.

• Consent: where we ask for it. You may withdraw consent at any time without affecting prior processing.

 

International Processing and Transfers. TrueConfirm is based in the United States, and Personal Information we receive may be processed and stored in the United States. Employer clients are responsible for ensuring that they have a lawful basis and any required notices, consents, contractual arrangements, or other safeguards necessary to provide Personal Information to TrueConfirm. Where applicable law requires TrueConfirm to implement additional safeguards for a transfer of Personal Information, we will address those requirements through the applicable client agreement or other appropriate mechanism.

 

Your rights. You may have the right to access, rectify, erase, restrict, or object to processing of your Personal Information, to data portability, and to withdraw consent. We do not make decisions based solely on automated processing that produce legal or similarly significant effects. To exercise your rights, contact privacy@trueconfirm.com. We will respond within one month, extendable where permitted.

 

Self-service portal. Individuals whose employment information is held by TrueConfirm on behalf of an employer client can access, review, and request correction or deletion of that information through their TrueConfirm Employee account. TrueConfirm does not sell Personal Information of individuals in the EEA,UK, or Switzerland. We do not provide employment or income verification reports containing Personal Information about individuals located outside the United States to third-party Verifiers. We may disclose Personal Information to service providers acting on our behalf, to the applicable employer client, in connection with a business transaction, or as required or permitted by law.

 

Complaints. You may lodge a complaint with your local supervisory authority, such as the relevant EU data protection authority or the UK Information Commissioner's Office. We encourage you to contact us first.​

​

Children’s Online Privacy Protection Act (COPPA)

TrueConfirm’s services are not designed to serve or attract children. Accordingly, we do not solicit or knowingly collect any personal information from anyone we know to be under 13 years of age.  If we learn that we have collected information from a child under 13, we will delete it to the extent we are able.

​

Security

TrueConfirm maintains administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Personal Information. Our safeguards include measures designed to protect information in transit and at rest, limit access to authorized personnel, and support the detection and response to security incidents.

 

No method of transmission or storage is completely secure. If a security incident occurs, we will take appropriate steps to investigate, contain, and address the incident and will provide notifications when required by applicable law.

​

Amendments

TrueConfirm may change this Privacy Policy at any time. When we do, we will post an updated version on this page and update the "Last updated" date, unless another type of notice is required by applicable law. We review this Policy at least every 12 months. We ask our clients and website visitors to review this page periodically.