Privacy Policy

Who we are

MasterID is a verification platform operated by Universal Grid SMC Ltd, registered in Uganda. For data submitted by a customer organisation for verification, that organisation is the data controller and MasterID acts as a processor on its instructions.

For account, billing and website data, Universal Grid SMC Ltd is the controller.

Data we handle

Verification data: identity numbers, names, dates of birth, business registration details, taxpayer numbers, bank account numbers, licence numbers, email addresses and phone numbers submitted for a check.

Result data: the verdict returned, the attributes that matched or did not match, and the reference, timestamp and requesting user recorded against the check.

Account data: the names, work email addresses and roles of the users in a customer organisation.

Technical data: log records such as IP address, request time and API key used, kept for security and troubleshooting.

Why we handle it

To carry out the verification checks a customer requests, to return a result and to keep evidence of that result for audit and regulatory purposes.

To operate accounts, provide support, prevent abuse and meet legal obligations, including anti money laundering and know your customer requirements that apply to our customers.

Who we share it with

Verification requests are passed to the record source needed to answer the check, such as an identity register, company registry, tax authority record, credit reference bureau, bank or network operator.

We share data with service providers who host and secure the platform, and with authorities where the law requires it. We do not sell personal data and we do not use verification data for advertising.

Retention

Check records are retained for as long as the customer organisation needs them as evidence, and for the period required by the laws that apply to that organisation. When a contract ends, records are deleted or returned in line with the Data Processing terms.

Your rights

Individuals may request access to their data, correction of inaccurate data, deletion where no legal obligation to retain applies, and an explanation of how a check was carried out.

If your data was submitted by a bank, lender or other organisation, contact that organisation first. Requests sent directly to us are forwarded to the responsible customer where we act only as a processor.

Security

Data is encrypted in transit and at rest, access is restricted by role, and every check is logged. Further detail is set out on the Security page.