Effective 12 August 2026
Who we are and how decisions are made. Kabware Services Ltd operates CharityVerify. Kabware decides how account, billing, security and optional analytics information is used to operate and protect the service. Your practice decides why it submits charity and application information. Kabware uses that information to carry out the requested checks and retain the resulting evidence under the service. Your practice also decides who in its team may use CharityVerify.
What we process and why. We process team account details, including names and work email addresses, to create and secure workspaces, manage access and provide support. We process charity application information submitted for verification and public information returned by the applicable charity register and, when the relevant company check is available, a supplied or authoritatively linked company number. This may include trustee and officer names. We use it to perform due diligence and produce an evidence record. We rely on our legitimate interests in providing and protecting the service, and on the customer's instructions where it supplies the information.
Register coverage. Charity register checks are available in England and Wales through the Charity Commission for England and Wales (CCEW), in Scotland through the Office of the Scottish Charity Regulator (OSCR), and in Northern Ireland through the Charity Commission for Northern Ireland (CCNI). A separate company check runs only when a company number is supplied or authoritatively linked by the selected charity register. Republic of Ireland primary-register delivery remains controlled and release-gated while we verify a supported official route. We do not currently claim a live official-register feed. Republic of Ireland annual-report evidence is disabled pending a recorded licence decision. CRO company checking is disabled unless the required credentials are configured and the terms have been accepted. When available, Companies Registration Office information is used only for a supplied or authoritatively linked Republic of Ireland company number. Register information may contain errors, so customers must review it and request corrections where needed. Primary-register information is provided by the Charities Regulator under CC BY 4.0. The Charities Regulator does not endorse CharityVerify.
Where information is stored and who can access it. Account, verification and service records are held with our secure hosting provider. Access is limited to authorised members of your practice and authorised Kabware staff who need it for support, security or service operation. Other suppliers may process information for us under contract where needed to provide the service. We do not sell personal data.
AI-assisted research (Complete plan). For Complete-plan checks, we may send a charity's name and registration number, together with trustee names, to an AI research provider. The purpose is to gather publicly available context such as the charity's website and social-media presence, adverse media and published annual report information. The provider states that request and response content is not retained and is not used to train its models. It keeps limited usage records only as needed to operate and bill its service. The resulting research is retained with the verification evidence. Access is limited to authorised members of your practice and authorised Kabware support staff who need it to provide the service. The research is advisory and does not determine a verification outcome by itself. Email privacy@kabware.co.uk to ask us not to use AI-assisted research for your practice.
Verification retention. We retain verification records for at least seven years to preserve the customer's due-diligence evidence trail and support legal claims. Related records may remain for longer where they are still needed for those purposes or to meet a legal obligation. We review whether continued retention is necessary. Records cannot be deleted during the minimum retention period where they form part of the evidence trail.
Payments. Stripe processes subscription payments and keeps payment details under its own privacy terms. CharityVerify does not see or store full card details. We receive payment references and status information so we can activate and manage the subscription.
Billing records and service emails. We keep payment-event references, processing status and billing-notice delivery records with our secure hosting provider. We use them to activate subscriptions, prevent duplicate processing and investigate a missed service message. We retry unsent billing and account emails, and unfinished billing operations, for up to seven days. When an email is marked sent, we remove its address and message content from the delivery queue. If delivery or an operation has not completed after seven days, we stop retrying and remove its address, content and operation details. We retain only a minimal service reliability record, available to authorised support staff, for 30 days after the item is sent, completed or stopped. Payment-event records are deleted 30 days after processing.
Billing notices and account messages are required while an account is active, so you cannot opt out of them. Email privacy@kabware.co.uk if a required message has not arrived or to change the account email address. Contact us to request account closure. We will explain what can be removed and what must be retained. We do not send marketing email without separate consent.
Optional product analytics. If you choose "Allow analytics", we send pseudonymous page views and selected interaction outcomes to operational monitoring to understand use of the website and improve service reliability. A random CharityVerify-only visitor ID is stored in this browser and a random session ID lasts for the current tab. We do not include charity inputs, uploaded data or filenames, reports, email addresses, payment details or error bodies. Optional analytics records are kept for up to 90 days. Access is limited to authorised Kabware staff for service operation, security and reliability. You can withdraw consent below. This clears both browser IDs and stops future optional analytics from this browser. It does not erase optional analytics records already collected.
Your choices and rights. You can ask for access to your personal data or ask us to correct, erase or restrict it. You may also object to processing or ask for a portable copy where those rights apply. Some requests may be limited by the seven-year evidence retention described above or another legal obligation. Contact privacy@kabware.co.uk. You can also complain to the Information Commissioner's Office.