Agency and data processing terms

Effective 16 October 2026. These terms supplement the service terms between the agency represented by its account owner (“Agency”) and ForgeAttest (“Processor”), ForgeAttest, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom.

Agency responsibilities

The Agency is responsible for lawful, fair representation decisions, an accurate public identity and contact address, and its own privacy information. Its owner must be authorised to act for it. Use applications only to consider representation and communicate about that application. Do not sell data, use it for advertising, charge application fees or request intimate images. Keep notes relevant and avoid sensitive personal information. The pilot permits one named account owner; do not share sign-in codes.

Processing instructions and scope

The Agency, as controller of its application review records, instructs the Processor to collect, store, organise, display, transmit, export and erase applicant details, photos, status, notes and correspondence through ModelSubmission. Data subjects are adult applicants and agency contacts. Processing lasts for the service relationship and applicable retention period. The Processor acts only on these documented instructions, including lawful transfer instructions, unless law requires otherwise, in which case it will inform the Agency where permitted.

Confidentiality and security

The Processor restricts access to authorised people under confidentiality duties and uses HTTPS, protected sessions, hashed sign-in codes, agency access checks, private storage and request limits. It will assist the Agency with rights requests, security incidents, impact assessments and regulator consultation as reasonably required, considering the nature of processing and information available. It will notify the Agency without undue delay after becoming aware of a personal-data breach affecting its records.

Subprocessors and international transfers

The Agency authorises Cloudflare for hosting, database, storage and transactional email under written data-protection obligations. The Processor remains responsible for its subprocessors’ relevant obligations. It will provide notice of a proposed additional or replacement subprocessor, allowing the Agency a reasonable opportunity to object before use. Transfers must use an applicable lawful safeguard; current provider transfer terms are linked in the privacy notice.

Return, erasure and oversight

The Agency can export its inbox during the service. Applications are removed after 180 days, with earlier removal on applicant withdrawal or account closure under the privacy notice. On ending the service, the Processor will return or erase remaining application records as instructed, unless law requires retention, and explain any temporary recovery-copy retention. The Processor will make information needed to demonstrate compliance available and allow reasonable, appropriately scoped audits, including inspections, subject to confidentiality and security arrangements. It will promptly inform the Agency if an instruction appears to breach applicable data-protection law.

Contact privacy@forgeattest.com for processing instructions, audit arrangements and rights requests. Agency owners remain responsible for exported copies and any separate retention obligations.