Privacy, made clearer

RRSource is operated by [CONTROLLER FULL NAME], an individual based in the United Kingdom, trading as RRSource (“we”, “us”). RRSource is not yet incorporated as a registered company — as an unincorporated business, the individual named above is the data controller responsible for your personal data under UK GDPR.

Postal address for data protection purposes: [REGISTERED/BUSINESS ADDRESS]. Because the controller is UK-based, RRSource does not need a separate UK representative under Article 27 — you can contact us directly.

For any question about this notice or to exercise your rights, contact: privacy@rrsource.com.

If you are not satisfied with our response, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

We receive information you choose to provide and information needed to operate RRSource safely:

• Account details — your contact, sign-in and profile information.
• Reputation Record details, where you choose to create one — your full name, date of birth (for age verification), and government-issued photo ID plus a live selfie, checked against each other by our identity verification provider.
• Activity data — information created when you use reports, searches, verification and other requested features.
• Technical and security data — limited information needed to protect accounts, prevent misuse and keep the service reliable.

Creating a verified Reputation Record requires proving you are who you say you are. A specialist identity-verification provider compares a live selfie with your government-issued photo ID. This comparison involves biometric data, a special category of personal data under UK GDPR Article 9.

Lawful basis: we rely on your explicit consent (Article 9(2)(a)) for this specific processing, captured separately from our general terms acceptance — you can decline identity verification and use RRSource without a verified Reputation Record.

Privacy: identity-verification material is kept private, is not used as your public profile image and is handled only for verification, security and related dispute purposes.

Withdrawing consent: you can withdraw consent to identity verification by deleting your Reputation Record's verified status through account settings, or by contacting us at the address above. Withdrawing consent does not retroactively make past verification unlawful, but stops further use of that biometric data.

Your RR Score is calculated from your report and dispute history — factors include the number and evidence-status of reports, witness activity, and resolution outcomes. A report, dispute, thread, or witness action alone never changes your score; only a completed Resolution does. Automated tools may help organise, search, or flag unusual activity, but do not make a final decision about you without human review — you can dispute any report or outcome through the Resolution Centre, which is reviewed by a person.

• Account information: while your account is active and afterwards where required for legal, regulatory or dispute purposes.
• Reputation Records and reports: while relevant to the record and for an appropriate period afterwards to preserve integrity, resolve disputes and meet legal obligations.
• Identity-verification material: only for as long as needed to support verification, security and related disputes.
• Technical and security records: according to a limited retention schedule based on security, fraud-prevention and legal needs.

We share personal data only where needed to provide and protect RRSource. Recipient categories include:

• secure hosting, storage and account-service providers;
• identity-verification providers when you request verification;
• communications providers used to deliver service messages; and
• professional advisers, regulators or authorities where legally required.

Service providers are contractually restricted to the agreed purpose. Where data is processed outside the UK, we use appropriate transfer safeguards. We do not sell personal data.

We use strictly necessary cookies (keeping you signed in safely, remembering your session) which don't require consent. We do not currently run optional analytics or marketing cookies; if that changes, we will ask for your consent first via a cookie banner, in line with UK PECR.

See our Cookie Policy for the cookies and browser storage currently used, their purposes, typical durations and your choices.

RRSource is intended for people aged 18 and over. We check your date of birth as part of identity verification and do not knowingly allow accounts for under-18s. If we learn an account belongs to someone under 18, we will close it and delete the associated personal data.

Subject to some exceptions, you can ask us to:

• tell you what personal data we hold about you and why (access);
• correct inaccurate data (rectification);
• delete your data (erasure);
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent — including biometric identity verification.

We respond to rights requests within one month, as required by UK GDPR Article 12(3).

Requesting deletion submits a tracked request that we review and action within one month. Deletion erases your identifying profile information and biometric verification data, and disables sign-in permanently. Your Reputation Record and report history may be retained per the retention periods above, delinked from your identity, so the record remains reliable for other users who rely on it — see “How long we keep data” above.

For privacy concerns, contact us at: privacy@rrsource.com