Privacy policy

The information needed depends on the service and the stage of your relationship with us. It may include:

• Your name, contact details and account information.
• Information about your citizenship, residence, household and the programs you are considering.
• Identity documents, background information and evidence of the origin of funds or wealth when needed for a review or application.
• Correspondence, agreements, invoices and payment records.
• Technical information relating to website use, including device, browser and security information.

Information may come from you, a person authorised to act for you, professionals involved in your case, verification providers, or relevant public and official sources.

We use personal information to respond to enquiries, manage accounts, review access requests, coordinate agreed services, process payments, maintain records and protect the platform against fraud and misuse.

Where data protection law requires a lawful basis, we rely on:

• Steps taken at your request or performance of a contract for the services you engage us to provide.
• Legal obligations that apply to us, including relevant verification and record-keeping requirements.
• Legitimate interests in administering our business, maintaining security and preventing fraud, subject to your rights and interests.
• Consent for marketing or other uses where consent is required.

If information needed for a review or service is not provided, we may be unable to process your request or continue an engagement.

We may share relevant information with providers supporting hosting, account access, communications, document handling, verification and payments, and with the professionals and government authorities involved in your application.

We may also disclose information where required by law or where lawfully necessary to establish, exercise or defend legal claims. Some recipients are independently responsible for the information they receive and apply their own privacy notices.

Our Data processing notice explains these roles in more detail.

An application or service provider may involve processing outside your country. Where a transfer is subject to data protection requirements, the applicable protections must be in place. These may include recognition that a destination provides adequate protection or appropriate contractual safeguards.

Our retention periods for key records are:

• Identity, due diligence and screening records: 10 years after the client relationship ends.
• Transaction, invoice and payment records: 10 years after the client relationship ends.
• Rejected access requests: 5 years from the decision.

Other information is kept for as long as reasonably needed for the purpose for which it was collected, taking account of applicable legal requirements and the need to resolve disputes. Retention requirements may limit our ability to delete particular records on request.

Access requests are reviewed by our team. Website comparisons and program tools help you explore options; they do not determine eligibility for citizenship or residence. Government authorities make application decisions independently.

You can withdraw consent to marketing or object to the use of your information for direct marketing at any time. Use the unsubscribe option where provided, or raise your request with the Empire Passports team. Withdrawing consent does not affect the lawfulness of earlier processing.

Messages needed to manage an account or engagement are separate from marketing communications.

Depending on the law that applies, you may have rights to access or correct your information, request deletion, restrict or object to its use, or receive a portable copy. These rights are subject to applicable conditions and exceptions.

Make a privacy request to the Empire Passports team in writing, identifying the account or enquiry it relates to. If you are a client, you can also raise it through your case manager. We may need proportionate information to verify your identity before responding.

You may complain to the data protection authority responsible for your jurisdiction where the applicable law provides that right.

Provide another adult's information only where you are authorised to do so, and share this policy with them. Information about a child should be provided by a parent, guardian or another person with appropriate authority.

We may update this policy when our services or information practices change. The version published on this page explains our current approach.