Legal information
Privacy notice
Last updated 14 September 2026
The data controller is Amal UK Express Ltd, Company number 06013583 · Suite 104 Cumberland House, 80 Scrubs Lane, London, England, NW10 6RF. Data protection enquiries may be sent to privacy@veridex.uk.
Who this notice covers
This notice covers agents, applicants, authorised representatives and users of Veridex. Staff privacy information may also be provided through internal employment documentation.
Information we use
We process identity and contact details, business and company information, regulatory and tax-payment records, uploaded identification and compliance documents, training records, agreements and signatures, communications, review decisions, account-security information, audit trails and technical access records.
Why we use it and our lawful bases
- To assess, onboard and administer agents and agreements: steps before entering a contract and performance of a contract.
- To meet financial-services, anti-money-laundering, tax, record-keeping and other legal duties: legal obligation.
- To protect accounts, investigate misuse, maintain audit evidence and operate an effective agent network: legitimate interests.
- Where the law requires consent, we will ask for it separately and it may be withdrawn.
Who receives information
Access is limited to authorised Amal personnel and service providers supporting hosting, storage, security scanning, communications and professional advice. Information may be disclosed to regulators, law-enforcement bodies or other parties where the law requires or permits it. Our principal infrastructure providers include Cloudflare and OVHcloud.
International transfers
Where a provider processes information outside the UK, we use an applicable UK adequacy regulation or approved contractual safeguards and carry out the required transfer assessment.
How long we keep it
Records are retained only while needed for the stated purpose, contractual administration, legal or regulatory duties, claims and audit evidence. Approved category-specific periods are maintained in the Veridex retention schedule. At the end of the period, records are reviewed for secure deletion, anonymisation or a documented legal hold.
Your rights
Depending on the lawful basis, you may ask for access, correction, erasure, restriction, portability or object to processing. You may complain to the Information Commissioner’s Office at ico.org.uk. Contact us first at privacy@veridex.uk if you would like us to resolve a concern.
Security and automated decisions
Veridex uses role-based access, multi-factor authentication, encryption, malware scanning and audit records. Compliance decisions and agent activation require authorised staff action; the system does not make solely automated decisions with legal or similarly significant effects.