Fair Processing Notice

FAIR PROCESSING NOTICE:


  1. FRAUD PREVENTION & DETECTION
  2. INVESTIGATION SERVICES


Effective Date: 07 October 2026


This Fair Processing Notice explains how Remington Hall Limited ("we", "us", "our") collects, uses, stores, and shares personal data when conducting fraud prevention, detection, and investigation services.


We operate as a data controller when determining why and how investigations are conducted for example during a self-initiated or independent enquiry, and as a data processor when acting strictly under the direct instructions of a corporate client without independently deciding the overarching purpose of the processing.


This notice applies to subjects of investigations, witnesses, whistleblowers, beneficiaries, and individuals associated with cases of suspected or potential fraud, financial crime, or serious misconduct.




1. Lawful Basis for Processing


We process personal data primarily under the lawful basis of Legitimate Interests (Article 6(1)(f) of the UK GDPR / Data Protection Act 2018).


  • Our Legitimate Interests: We have a legitimate business interest—and a wider public interest—in preventing, detecting, and investigating fraud, financial crime, corruption, and serious malpractice. This includes protecting the assets, finances, interests and reputations of both our business and our instructing clients (such as insurers, corporations, and legal firms).
  • The Necessity Test: Investigation requires the processing of personal data to identify bad actors, gather intelligence and admissible evidence, and prevent ongoing loss financial or otherwise. These objectives cannot be achieved through less intrusive means.
  • The Balancing Test: We weigh our interests against the rights and freedoms of data subjects. Given that fraud involves deceitful or illegal behaviour, the public interest in exposing wrongdoing and the rights of victims to seek redress generally outweigh the privacy expectations of individuals engaged in illicit activity.


Special Category & Criminal Offence Data


Where investigations involve special category data (e.g., physical health data in insurance fraud cases) or data relating to criminal convictions and offences, we process this under:


  • Section 10 and Schedule 1 of the Data Protection Act 2018: Specifically, processing necessary for the prevention or detection of an unlawful act, or necessary for the establishment, exercise, or defence of legal claims.




2. Types of Personal Data We Collect


Depending on the scope of the investigation, we may collect and verify the following categories of personal data:


  • Identity & Contact Data: Full names, aliases, dates of birth, gender, residential addresses, employment history, email addresses, and phone numbers, family members and personal/professional networks.
  • Financial & Transactional Data: Bank statements, invoice records, asset ownership details, credit histories, corporate filings, and transaction logs, consumer footprint data.
  • Digital & Technical Data: IP addresses, device identifiers, email metadata, system logs, and digital footprints related to fraudulent activity.
  • Open-Source Intelligence (OSINT): Publicly available information from social media platforms, online forums, news archives, and public registries (e.g., Companies House).
  • Evidence & Surveillance Data: Photographic evidence, video surveillance footage (where legally permissible and proportionate), witness statements, and interview recordings.




3. How We Collect Data


We gather information from a variety of sources, including:

  • Instructing Clients: Information supplied by the victim of the fraud (e.g., lawyer, employer, insurer, or business partner).
  • Public Records: Land registries, corporate registers, court filings, and electoral rolls.
  • Tracing and Intelligence Systems: Data aggregation platforms, consumer datasets, credit referencing agencies, government agencies, government fraud initiatives.
  • Third Parties: Informants, whistleblowers, industry anti-fraud databases, and professional contacts.
  • Direct Investigation: Digital forensics, lawful surveillance, and interviews.




4. How We Use Your Information


We process personal data strictly for the following purposes:


  • Verifying Identity: Confirming whether individuals are who they claim to be.
  • Case Assessment & Analysis: Analysing patterns, data points, and discrepancies to identify potential fraud or insider threats.
  • Evidence Compilation: Gathering and structuring legally admissible evidence for disciplinary, civil, or criminal proceedings.
  • Reporting: Providing detailed investigation reports to instructing clients, legal counsel, or law enforcement.




5. Data Disclosures and Sharing


We do not sell personal data. We only share investigation data with vetted third parties when it is legally justifiable and necessary.

Recipients may include:


  • The Instructing Client: The organisation or individual who formally retained our services to investigate the matter.
  • Legal Professionals: Law firms, barristers, and legal advisors preparing for civil litigation or asset recovery.
  • Law Enforcement & Regulatory Bodies: Agencies such as Action Fraud, the police, HM Revenue & Customs (HMRC), the Financial Conduct Authority (FCA), or relevant industry regulators and governance.
  • Fraud Prevention Agencies: Shared databases used across industries to flag known fraudulent entities and prevent systemic risk.




6. Data Retention


We hold personal data only for as long as necessary to fulfil the investigative purpose, comply with legal obligations, or defend or commence legal action.

  • Active Files: Retained for the duration of the live investigation.
  • Closed Files: Typically retained for a period of up to 6 years following the conclusion of the case or legal proceedings, aligned with the statutory limitation periods for breach of contract and tort claims in the UK. After this period, files are securely destroyed or permanently anonymised.




7. Your Data Protection Rights


Under data protection law, you have specific rights, including the right to access your data, rectify inaccuracies, or object to processing based on legitimate interests.


  • The Right to Object: You have the right to object to our processing of your data based on legitimate interests. However, in an investigative context, if we can demonstrate compelling legitimate grounds (such as protecting evidence, preventing crime, or preparing a legal defence), we are legally permitted to override the objection and continue processing.
  • Exemptions for Investigations (The "Prejudice" Rule): Please note that under Schedule 2 of the Data Protection Act 2018, certain rights—such as the Right of Access (Subject Access Requests) and the Right to be Informed—may be restricted or delayed if exercising them would be likely to prejudice the prevention or detection of crime, or the apprehension or prosecution of offenders. Informing a suspect during an active fraud investigation would likely result in the destruction of evidence, meaning notice may be withheld until it is legally appropriate to disclose.



8. Contact and Queries


If you have any questions about this Fair Processing Notice or how we handle data during investigations, please contact our Data Protection Officer:


  • Email: info@remingtonhall.com
  • Postal Address: 8-10 Hill Street, Mayfair, London, W1J 5NG

If you remain unsatisfied with how we handle your data or respond to a request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.