Summary
You’re always in control of your data when using Konfir. Once your verification is submitted, all data connections close automatically - there’s no ongoing access to your accounts.
If you’d like to access, correct, or delete your data, you can submit a GDPR request at any time. What happens next depends on whether Konfir holds your data directly or processes it on behalf of your verifier.
Who’s responsible for your data
Under UK GDPR, every organisation that handles personal data has a defined role:
The data controller decides why and how your data is processed.
The data processor handles data on the controller’s behalf, following their instructions and ensuring it’s kept secure.
Here’s how this applies to your Konfir verification:
Your verifier is usually the data controller. They decide why your data is needed and how long it’s stored.
Konfir acts as a data processor for most data collected during your verification - meaning we process it securely on your verifier’s behalf.
In some limited cases (e.g. if you gave Konfir consent to store your data for future verifications or interacted directly with us), Konfir is also a data controller for that part of your information.
Your options
Under UK GDPR, you can:
Request access – to see what data is held about you.
Request deletion – to ask for your data to be erased where possible.
Request correction – to fix any inaccurate information.
(Other rights, such as restricting processing, may also apply.)
How to make a request
Email us at [email protected] with your request type (e.g. access, deletion, correction).
Include your full name and, if possible, your Verification ID to help us locate your record.
We’ll confirm next steps - what happens depends on our role:
If Konfir is acting only as a data processor, we’ll forward your request to your verifier (the data controller) and support them in responding.
If Konfir is a data controller for any of your data, we’ll verify your identity before proceeding and respond directly within one calendar month.
If Konfir is both processor and controller, we’ll do both - assist your verifier for their data and handle ours directly.
How your request is handled
For processor data: your verifier is responsible for approving and fulfilling the request. Konfir won’t act without their documented instruction.
For controller data: Konfir will securely verify your identity, process your request, and confirm completion within one month.
If your verifier also holds a copy of your data, they may need to take additional steps before full deletion or access is complete.
If you’re unsure who your verifier is, check your original invite or verification link - it will show their name and logo.
Timeframes and confirmation
We aim to complete all requests within one calendar month. If your request is complex or involves data we process on behalf of a verifier, we’ll update you if more time is needed.
You’ll receive confirmation once your request is complete or handed over to your verifier.