Transparency data: Fraud Risk Assessment Accelerator Privacy Notice

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR). 

The purpose for which we are processing your personal data is: 

To provide access to the Fraud Risk Assessment Accelerator in order to enhance cyber security, and prevent/detect fraud. The nature and scope of personal data processing are strictly limited to administrative data necessary for user authentication, access control, and application security. Specifically, the system processes user profile credentials, including the full name, work or business email address, job role, and organisation or department name of authorised counter-fraud professionals. This data is collected directly from individuals and public bodies during the onboarding process via secure corporate email. A subset of personal data (names, departments, work or business emails) is retained to conduct user research and direct user feedback which is anonymised on a quarterly basis.

Additionally, the system processes residual personal data that may be incidentally contained within the policy scheme documents uploaded by users. This processing is strictly limited to passing the documents through an automated redaction tool to identify and permanently remove personally identifiable information (PII) before the source documents are analysed by the underlying AI model.

We will process the following personal data: 

• Name
• Email address
• Job title or grade
• Organisation name

• Incidental personal data contained within uploaded policy scheme  documents (prior to automated redaction)

The legal basis for processing your personal data is that it is in our legitimate interest to: