TruSignal Privacy Policy
Version: 1.1 — Draft
Last updated: 26 October 2026
1. Introduction
TruSignal Assets Ltd (“TruSignal”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you visit our website, contact us, enquire about our services or engage with us in connection with the TruSignal Network.
TruSignal is the owner and governing organisation of the TruSignal Network, a global digital trust and data exchange network comprising interoperable Data Wallet Networks operating under a common governance framework.
The TruSignal Network is designed to enable individuals and organisations to exchange trusted information while preserving individual agency and legal control over personal data.
2. Who We Are
TruSignal Assets Ltd is responsible for the governance, development, licensing and commercialisation of the TruSignal Network.
For personal information collected through our corporate website, business enquiries, contractual relationships, network governance and related corporate activities, TruSignal Assets Ltd acts as the data controller where it determines the purposes and means of processing.
Company: TruSignal Assets Ltd
Company Number: 17318446
Registered Office: 75 Ermine Way, Arrington, Royston, SG8 0AG, England
Website: https://trusignal.org
Privacy Contact: office@trusignal.org
3. Scope of This Policy
This Privacy Policy applies to personal information processed by TruSignal in connection with:
● Visits to our corporate website;
● Enquiries submitted through our website or other communication channels;
● Relationships with prospective and existing Network Licensees;
● KYC, due diligence and verification of Network Licensees and their authorised representatives;
● Verification and administration of Delegated Authority;
● Relationships with Technology Providers, Badge Issuers, business partners and other organisations;
● Events, meetings, research collaborations and other corporate activities;
● Network governance, constitutional oversight and compliance activities undertaken by TruSignal.
This policy does not govern personal data maintained within individual Data Wallet Accounts.
Each TruSignal Data Wallet Network operates under a licensed Network Licensee, which is responsible for its Wallet Accounts, custody arrangements and applicable Data Wallet Privacy Policy.
Where you use a Data Wallet through an application such as CheckD, the relevant Network Licensee’s privacy policy explains how your Wallet Account information is processed.
4. Information We Collect
Depending on how you interact with us, we may collect the following categories of personal information.
4.1 Information You Provide
When you contact us or submit an enquiry, we may collect:
● Your name;
● Email address and telephone number;
● Organisation, position and professional contact details;
● Information included in your messages, enquiries or applications;
● Other information you choose to provide.
4.2 Business and Partnership Information
Where you represent an organisation engaging with TruSignal, we may collect information necessary to establish and manage that relationship, including:
● Professional identity and contact information;
● Your role and authority to represent the organisation;
● Information required for contractual, regulatory or compliance purposes;
● Records of communications, meetings and business transactions.
4.3 Website and Technical Information
When you visit our website, certain technical information may be collected automatically, including:
● Internet Protocol (IP) address;
● Browser and device information;
● Pages visited and general website activity;
● Information necessary for website security, performance and maintenance.
Where cookies or analytics technologies are used, additional information about their operation will be provided through an appropriate notice or consent mechanism.
We do not intentionally collect personal information that is unnecessary for the purposes described in this Policy.
4.4 Network Licensee KYC and Delegated Authority
As the owner and governing organisation of the TruSignal Network, we conduct Know Your Customer (KYC), due diligence and authority verification procedures in connection with the admission, appointment and ongoing governance of Network Licensees.
We may collect and process:
● Organisation information: Legal name, registration details, registered address, ownership and corporate structure.
● Identity information: Names, positions, contact details and, where required, identity verification documents of directors, beneficial owners and authorised representatives.
● Delegated Authority: Information establishing an individual’s legal authority to represent and act on behalf of a Network Licensee, including appointments, corporate authorisations and relevant Delegated Authority records.
● Compliance information: Information reasonably required for due diligence, regulatory screening, risk assessment and ongoing compliance monitoring.
● Network participation records: Information relating to the authentication, status and administration of Network Member Badges and Delegated Authority recognised within the TruSignal Network.
We collect and process this information only to the extent necessary to establish and verify the identity, legitimacy and authority of Network Licensees and their representatives, and to discharge our network governance and applicable legal responsibilities.
5. How We Use Your Information
We use personal information for legitimate corporate, operational and governance purposes, including:
Responding to enquiries: To communicate with you and respond to requests for information.
Managing business relationships: To establish and administer relationships with Network Licensees, Technology Providers, partners and other organisations.
Providing information: To communicate about TruSignal’s activities, services, programmes and developments where permitted by applicable law.
Network governance: To administer contractual relationships, maintain governance records and support compliance with the TruSignal Network Governance Framework.
Network Licensee verification and compliance: To conduct KYC and due diligence on prospective and existing Network Licensees, verify their legal identity and organisational authority, identify and authenticate individuals acting under Delegated Authority, administer Network Member Badges, and maintain the integrity and accountability of the TruSignal Network.
Constitutional oversight: To maintain and provide information reasonably required for the exercise of constitutional oversight by the HAT Community Foundation, subject to applicable law.
Website administration: To maintain, secure and improve our website and associated services.
Legal and regulatory compliance: To fulfil applicable legal obligations, maintain appropriate records and protect our lawful interests.
We do not use personal information collected through our corporate website for purposes incompatible with those described in this Policy.
6. Legal Basis for Processing
Where the UK General Data Protection Regulation (UK GDPR), EU GDPR or equivalent data protection legislation applies, we process personal information on one or more of the following lawful bases:
● Consent: Where you have given consent for a specific purpose, such as receiving optional marketing communications.
● Contractual necessity: Where processing is required to enter into or perform a contract with you.
● Legitimate interests: Where processing is reasonably necessary to manage business relationships, respond to enquiries, maintain website security or administer our operations, provided those interests are not overridden by your rights and freedoms.
● Legal obligations: Where processing is required to comply with applicable law or regulatory requirements.
6.1 Network Governance and Verification
We process KYC, due diligence and Delegated Authority information where necessary to comply with applicable legal obligations, perform contractual responsibilities or pursue our legitimate interests in establishing and maintaining a secure, accountable and properly governed network.
Where identity verification or regulatory screening involves additional categories of personal information, we apply the further legal safeguards required by applicable data protection law.
6.2 Constitutional Oversight
We may process and disclose relevant governance and compliance information where necessary to fulfil our constitutional responsibilities under the TruSignal Network Constitution and to support oversight by the HAT Community Foundation.
Such processing must be supported by an applicable lawful basis, including legitimate interests or legal obligations where appropriate, and must remain necessary and proportionate to the relevant purpose.
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
7. Privacy and the TruSignal Network
The TruSignal Network is founded on the principle that individuals should retain legal control over their personal data.
TruSignal establishes the governance framework, standards and protocols through which licensed Data Wallet Networks operate.
Each Network Licensee is responsible for establishing and operating its Wallet Network, including the administration and custody of Wallet Accounts in accordance with the applicable agreements, trust arrangements and laws.
Personal data held within a Wallet Account is governed through the Data Wallet, the applicable Badge Programme Rules and the Wallet User’s authorised instructions.
7.1 Network Governance Information
TruSignal, as Network Owner, processes information necessary to govern the TruSignal Network, including information relating to Network Licensees, their authorised representatives, KYC verification, Delegated Authority and Network Member Badges.
This governance function is distinct from the custody and processing of personal data within individual Wallet Accounts.
TruSignal does not ordinarily access or process personal data contained within individual Wallet Accounts merely by virtue of owning or governing the Network.
The responsibility for administering and securing Wallet Accounts remains with the relevant Network Licensee under the applicable legal and custody arrangements.
TruSignal may nevertheless process identity, authority and compliance records necessary to verify the legitimacy of Network participants and maintain the integrity of the TruSignal Network.
7.2 Constitutional Oversight by the HAT Community Foundation
The HAT Community Foundation (“HCF”) serves as the Constitutional Guardian of the TruSignal Network in accordance with the TruSignal Network Constitution.
As Network Owner, TruSignal Assets Ltd is subject to constitutional oversight by HCF, including oversight of the Network’s constitutional principles, the integrity of the Data Wallet Protocol and the interests of Wallet Users.
In exercising its constitutional responsibilities, HCF may request information from TruSignal reasonably necessary to perform its oversight functions. This may include information concerning Network Licensees, their authorised representatives, KYC and due diligence records, Delegated Authority, network compliance and governance activities.
Where such information includes personal data, TruSignal will disclose only information that is necessary and proportionate to the relevant oversight purpose, subject to applicable data protection law, confidentiality obligations and appropriate safeguards.
HCF’s constitutional oversight does not confer general access to personal data contained within individual Wallet Accounts. Any access to such data must have a separate lawful basis and comply with the applicable Network Governance Framework, Wallet Trust arrangements and data protection requirements.
7.3 Responsibilities of Network Participants
Participating organisations, including Badge Issuers, Data Providers, Data Verifiers and Merchants, remain responsible for the personal data they process in their respective activities, subject to applicable law.
Where TruSignal receives operational, compliance or network reporting information, it will process any personal information contained in those reports only for appropriate and lawful purposes.
8. Sharing Your Information
We may share personal information where reasonably necessary with:
● Service providers: Organisations supporting our website, communications, administration or business operations.
● Professional advisers: Legal, accounting, audit and regulatory advisers.
● Network participants: Network Licensees, Technology Providers or business partners where necessary to respond to an enquiry or manage an authorised relationship.
● Constitutional Guardian: The HAT Community Foundation, where disclosure of relevant governance, compliance, KYC or Delegated Authority information is reasonably necessary for it to exercise its constitutional oversight responsibilities under the TruSignal Network Constitution.
● Public authorities: Regulatory authorities, courts or other public bodies where disclosure is required by law.
All disclosures are subject to applicable data protection law and appropriate confidentiality and security safeguards.
We require service providers processing personal information on our behalf to comply with appropriate confidentiality, security and data protection obligations.
We do not sell personal information collected through our corporate website or in connection with our network governance activities.
9. International Data Transfers
TruSignal operates in an international environment and may engage with organisations and service providers in different jurisdictions.
Where personal information is transferred internationally, we will take appropriate steps to comply with applicable data protection laws and use required safeguards, such as recognised adequacy arrangements or approved contractual protections, where relevant.
The existence of international Wallet Networks does not, by itself, mean that TruSignal receives or transfers personal information stored within individual Wallet Accounts.
10. Data Security
We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
Access to personal information is limited to authorised personnel and service providers who require it for legitimate business, network governance or compliance purposes.
KYC records, identity verification information and Delegated Authority records are subject to access controls appropriate to their sensitivity.
No internet-based service can guarantee absolute security. We regularly review our arrangements in light of our processing activities and applicable requirements.
11. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying contractual, legal, regulatory, governance and legitimate business requirements.
Retention periods depend on the nature of the information and the purpose for which it is processed.
KYC, due diligence, Delegated Authority and compliance records may be retained during the relevant Network Licensee relationship and for an appropriate period afterwards where necessary to meet legal, contractual, audit or governance obligations.
Where information is no longer required, we will delete, anonymise or securely dispose of it, subject to applicable legal obligations.
12. Your Data Protection Rights
Depending on the laws applicable to you and the circumstances of processing, you may have the right to:
● Request access to personal information we hold about you;
● Request correction of inaccurate or incomplete information;
● Request deletion of personal information;
● Request restriction of certain processing activities;
● Object to processing based on legitimate interests or for direct marketing;
● Request portability of information where applicable;
● Withdraw consent where processing is based on consent;
● Lodge a complaint with an appropriate data protection supervisory authority.
To exercise your rights in relation to information processed directly by TruSignal, please contact us at office@trusignal.org.
Where your request concerns personal information maintained within a Data Wallet Account, you should contact the relevant Network Licensee responsible for that Wallet Account.
Certain requests may be subject to exemptions or limitations under applicable law, including where retention of information is necessary to comply with legal obligations or establish, exercise or defend legal claims.
13. Cookies and Website Analytics
Our website may use cookies or similar technologies necessary for its operation, security and performance.
Where optional analytics or other non-essential technologies are used, we will provide appropriate information and obtain consent where required by applicable law.
You may manage cookies through your browser settings and any cookie preferences made available on our website.
14. Third-Party Websites and Services
Our website may contain links to independent websites, applications or services, including those operated by Network Licensees, Technology Providers and other participating organisations.
Those organisations maintain their own privacy policies and are responsible for their own processing activities.
We encourage you to review the applicable privacy policy before providing personal information to a third party.
15. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our activities, legal requirements, network governance responsibilities or data protection practices.
The latest version will be published on our website with its effective date.
Where changes materially affect how we process personal information, we will take appropriate steps to notify affected individuals where required by law.
16. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data protection rights in relation to personal information processed by TruSignal, please contact:
TruSignal Assets Ltd
Company Number: 17318446
75 Ermine Way
Arrington, Royston
SG8 0AG
England
Email: office at TruSignal dot org
Website: https://trusignal.org
If you are dissatisfied with our handling of your personal information, you may also raise a complaint with the relevant data protection authority, including the UK Information Commissioner’s Office where applicable.
TruSignal Assets Ltd
Governance for a trusted, human-centred data economy.