This United States Privacy Supplement ("Supplement") applies to the extent that HelloVerify processes personal data in connection with individuals located in the United States, including where data is received from clients, data sources, or other authorized parties. Where such processing occurs, HelloVerify is committed to handling personal data in a manner consistent with applicable U.S. legal and regulatory frameworks and recognized data protection standards. This Supplement should be read in conjunction with the Global Privacy Policy. In the event of any inconsistency, this Supplement will govern with respect to U.S.-related data processing.
Applicability of U.S. laws
To the extent applicable, HelloVerify aligns its practices with relevant U.S. federal and state laws governing personal data, including:
- Fair Credit Reporting Act (FCRA)
- Driver's Privacy Protection Act (DPPA)
- Gramm-Leach-Bliley Act (GLBA)
- Applicable U.S. state privacy laws (e.g., California Consumer Privacy Act (CCPA), as amended by CPRA, and other state-level privacy laws)
Where HelloVerify operates as a Consumer Reporting Agency (CRA) or provides services that fall within the scope of FCRA, it aligns with FCRA obligations, including permissible purpose requirements, consumer disclosure rights, dispute resolution and reinvestigation obligations, accuracy and data minimization standards, and user certification and monitoring. HelloVerify applies these principles where relevant to the nature of the service being delivered and the role it performs (e.g., service provider, processor, or contractor), even where it is not directly subject to jurisdiction.
Role in background screening
HelloVerify generally acts as a service provider to its clients and does not independently determine the purpose of processing U.S. personal data in most cases. Where services provided by HelloVerify fall within the scope of consumer reporting activities under U.S. law, HelloVerify supports its clients in meeting applicable obligations, including processing data only for legitimate and authorized purposes, supporting accuracy and data quality measures, enabling dispute resolution workflows where applicable, and implementing appropriate safeguards for sensitive personal data. Clients remain responsible for ensuring compliance with their specific regulatory obligations, including providing notices, obtaining authorizations, and managing consumer rights where required.
Distribution of personally identifiable information
HelloVerify seeks to limit the distribution of personally identifiable information consistent with the nature and sensitivity of the information. HelloVerify strives to make available personally identifiable information from sources other than public records or publicly available information only to its authorized users or clients. Similarly, where applicable, HelloVerify strives to restrict access to information in accordance with privacy laws such as the FCRA, the GLBA, and the DPPA and comparable state statutes. In the case of public record information available to the general public (such as bankruptcy, liens, judgments, criminal records and Uniform Commercial Code filings) and publicly available information, we may limit disclosure to authorized parties.
If, upon investigation, HelloVerify finds that personally identifiable information has been used or accessed inappropriately or unlawfully, HelloVerify strives to take reasonable steps to stop the misuse or access, educate the user concerning the appropriate use of the information, and prevent similar future misuses. Such steps may include discontinuation of the user's access to HelloVerify information products and services, pursuit of other legal remedies, and referral of misuse to the appropriate authorities.
Data accuracy and rights
HelloVerify strives to accurately report information in its products and information received from its data sources. HelloVerify takes reasonable steps to maintain data accuracy and encourages individuals to report inaccuracies through the appropriate client or designated contact channels. HelloVerify recognizes that reporting errors may occur and, where applicable, provides consumers with the opportunity to dispute and correct information we report, as described further in Access & correction below.
Sensitive information safeguards
HelloVerify strives to provide additional safeguards for sensitive personally identifiable information, such as Social Security numbers and driver's licence numbers. HelloVerify strives to limit the availability and access to full Social Security Numbers ("SSNs"), Driver's License Numbers and State Identification Numbers, and to protect the confidentiality of SSNs by limiting access to certain legitimate and authorized users. A limited number of public records may contain SSNs already available to the public; if such public records are accessed through HelloVerify services, our services may provide access to such SSNs. HelloVerify prohibits the unlawful disclosure of SSNs and takes steps to limit the availability of DLNs and state identification card numbers.
Education
HelloVerify is committed to promoting responsible data handling practices and raising awareness among its employees, clients, and users regarding the appropriate use of its products and services. HelloVerify provides guidance on privacy and security considerations associated with HelloVerify information products and services, and on the responsible use of personally identifiable information. HelloVerify also seeks to make information available to the public, where appropriate, regarding responsible use of personally identifiable information, measures HelloVerify has undertaken to enhance consumer privacy, and choices available to consumers regarding information access and the ability to opt out of certain products and services which utilize personally identifiable information.
Reputable sources
HelloVerify strives to acquire personally identifiable information from established, reputable sources in the government and private sectors. HelloVerify takes reasonable steps to assess the reputation and reliability of its private sector data sources before incorporating personally identifiable information from the source into its products and services. HelloVerify also strives to obtain assurances from its data suppliers that they have the legal right to license or sell the data to HelloVerify.
Cross-border processing
Where U.S.-origin personal data is transferred outside the United States, such transfers are conducted in accordance with contractual obligations with clients, applicable data protection requirements, and appropriate safeguards to ensure data protection standards are maintained.
Access & correction
HelloVerify provides a central point of contact for individuals seeking information about its privacy practices and the processing of personal information. HelloVerify strives to inform individuals about the nature of the public records, non-public information, and publicly available information that HelloVerify makes available in its information products and services. HelloVerify also strives, whenever practicable, to provide consumers, upon request, with meaningful opportunities to review personally identifiable information we maintain about them, and to provide opportunities for consumers to dispute and correct information by assisting them in identifying potential information sources at which corrections should be made.
Accountability
HelloVerify maintains internal policies, procedures, and controls designed to support compliance with applicable data protection requirements. It promotes responsible data handling practices across its operations and engages with relevant stakeholders to maintain appropriate privacy and security standards.
Online privacy
HelloVerify strives to protect the privacy of personally identifiable information obtained over the Internet and strives to apply our data privacy principles and evolving standards to the online environment.
Identity theft
HelloVerify strives to prevent the acquisition of information from its products and services for improper purposes, such as identity theft. Where a state law requires notice, HelloVerify complies with the law. In those states where notification laws do not exist, HelloVerify follows its Information Security Breach Response and Notification Policy, which provides that affected individuals will be notified when sensitive personally identifiable information owned or licensed by HelloVerify is acquired by an unauthorized individual and whenever HelloVerify has a reasonable basis to believe the breach has resulted in, or there is a significant risk that it will result in, identity theft to the consumer to whom the information relates.
Compliance
HelloVerify maintains a comprehensive information security and privacy program, which may be subject to periodic internal and external assessments. Such measures are designed to evaluate the effectiveness of administrative, technical, and physical safeguards and to support ongoing compliance with applicable standards and contractual obligations.
Consumer reporting activities (where applicable)
In limited circumstances, the services provided by HelloVerify may align with activities regulated under the U.S. Fair Credit Reporting Act ("FCRA"). HelloVerify primarily operates as a service provider to its clients and typically processes personal information on their behalf. To the extent applicable, HelloVerify supports its clients in complying with relevant legal requirements, including use of personal information for legitimate and authorized purposes, data accuracy and quality, and processes for dispute resolution and correction of information. Clients are responsible for ensuring compliance with applicable legal obligations, including establishing permissible purpose, providing required notices, and managing consumer rights.
Regulatory framework
Where relevant, HelloVerify aligns its practices with applicable U.S. laws, including the FCRA, the California Investigative Consumer Reporting Agencies Act (ICRAA), where applicable, and other relevant federal and state privacy laws. Regulatory oversight of such frameworks may involve authorities such as the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB).
Investigative consumer reports (California)
Under California law, an investigative consumer report may include information regarding an individual's character, general reputation, personal characteristics, or mode of living. To the extent HelloVerify supports the preparation or processing of such reports on behalf of clients, such activities are conducted in accordance with client instructions, applicable law, and appropriate safeguards.
Contact us
To obtain additional information about the privacy practices and policies of HelloVerify in connection with its preparation and processing of investigative consumer reports, please contact: Email: privacy@helloverify.com
