Gdpr compliant.jpg


Registered & regulated by the information commissioners office Reg: Z1106333

Our compliance and criteria we need to adhere to


GDPR compliancy will become a lawful requirement in 2018. We strive to comply and surpass our obligations to data protection and want all our clients and associates to know how we go about meeting these obligations.


According to details passed down by the Information Commissioners Office (ICO) the draft states: “if you are a private-sector organisation, you can process personal data without consent if you have a genuine and legitimate reason (including commercial benefit), unless this is outweighed by harm to the individual’s rights and interests.” Most trace submissions we undertake do fall within this category. However, their other lawful reasons that tracing a person can be undertaken without consent. All cases must fall within one or more of the criteria’s. The five lawful conditions for processing are:


• A contract with an individual

• Compliance with a legal obligation

• Vital Interests

• A public task

• Legitimate Interests


As a tracing agent, most of the work we undertake for people and businesses will have (vital Interests) or (Legitimate Interests) in the person they are tracing.


If you are looking for old friends or long-lost family, we would consider this (Legitimate Interests). Some instances may mean we need to obtain consent before we can supply our clients with contact details.


If you are a creditor your lawful reason would be (A contract with an individual) which has been breached. This may also include (Compliance with a legal obligation) so you may progress court actions.


If you are a solicitor looking for a witness, beneficiary or for a legal matter your lawful reason would be under (Compliance with a legal obligation)


Tracing Freeholders and property owners or people named on title deeds would fall under (Legitimate Interests)


These are a few of the reasons we look for people and most clients do have a lawful right to trace the person. We do seek to validate each case on its own merit and on occasion, we may not be able to assist you with your trace as it may not fall within these lawful conditions for us to process the data and supply you with our findings.


If you are unsure if your specific case meets one of these requirements speak to one of our experienced team who will assess your case and ensure the trace meets GDPR policy.


An example of noncompliance would be locating individuals in order to sell or offer products or services. However, if you have their consent, and you would need evidence of the consent given, we may well be able to assist.




How we may use and store your data


At People Location and our holding company Rainbow Promotions UK Ltd we take our lawful obligations seriously. As such, we are committed to protecting our client’s privacy and ensuring that compliant and stringent safeguards are in place at all times which ensures compliance with GDPR legislation.


All information provided to us by you will be held securely on 256-bit encrypted hard drives.


New cases and ongoing work is stored on a standalone hard-drive. The drive has no online connection, so it can’t be remotely accessed, and it is encrypted with a 256-bit encryption.  You must physically be at the terminal to transfer the data and you must have the passwords and data protection training to access, transfer, and use the data.


Whilst a case is being worked it is passed to the agent who again stores case data on a separate encrypted drive at their terminal.


As data processers, we know that client data and case data is personal and protected. With this in mind, our attitude is now, and has always been, if we have no use for the data, don’t keep it!


So, once we have completed our searches, reported our findings, and closed our case file, we then destroy all case notes and client information within about 2-3 weeks. We tend to hold the notes for this short period in case the client reverts to us for further details or queries. We are clear that after two weeks we cannot refer to our case notes.


We do keep, for tax and audit trail purposes, the invoice data.


But what the best way to destroy data to an unrecoverable state? It’s simple and easy to find. We use a Gutman style erasing technique which overwrites files and documents 35 times before deletion.  This is similar to the USA DOD technique to erase and secure their own data.


For the purposes of UK data protection law, the data controller under this agreement is The Managing Director of Rainbow Promotions UK Ltd, Blackwell House Guildhall Yard London EC2V 5AE




The personal information supplied by you may be recorded and processed by us for the following purposes:


  • To contact you about your search and ask you questions about the search

  • We may need to verify your identity to ensure your reasons for searching are legitimate

  • To adhere to our obligations to fight crime, fraud, money laundering and terrorism, or any other unlawful activity

  • To fulfil our obligations to ensure your case is handled to the highest professional standards.

  • for our legitimate business reasons and searches

  • If you are a business and instruct us, you will need to ensure your compliance procedure adheres to the GDPR. Your end client may have the right to ask what information is supplied to us and how we have processed and stored their data. This may be via your own firm or direct with People Location or its holding company Rainbow Promotions UK Ltd.





We never share your data with any other person, company or government agency unless a lawful court order is produced


At People Location and its holding company, Rainbow Promotions UK Ltd, all client data and case data is protected. Hence were obligated by law to ensure the data held and processed by us is safe, secure and is not shared with any other third party without the client’s permission.


If a lawful court order is produced, we will have to oblige and adhere to the order.




Your Rights of Access


GDPR legislation states that clients have certain rights in relation to personal information held on them by corporate entities. Hence you have the right to request us for the information held on you (the client). This will be supplied to you in a typed readable format. We may charge an administration fee to undertake the tasks set out.


If you wish to exercise any your rights to check or obtain copies of the information we hold on you please contact us at




Client data, storing data, and sharing of client data


At People Location we protect and secure client data and case data. New cases and ongoing work is stored on a standalone hard-drive. The drive has no online connection, so it can’t be remotely accessed, and it is encrypted with a 256-bit encryption.  You must physically be at the terminal to transfer the data and you must have the passwords and data protection training to access, transfer, and use the data.

Whilst a case is being worked it is passed to the agent who again stores case data on a separate encrypted drive at their terminal.




Online submissions and our web presence


We do have an online form submission which again needs to be secure and GDPR compliant. Our web forms are outsourced to a professional web design firm who take data privacy very seriously. when it comes to secure user data and storage we are provided with the very best security measures to ensure our clients are always protected from network abuse, spam and more.


All forms must be protected by..

✔ Spam Protection

✔ Virus and Malware protection

✔ HTTPS connection on sign up

✔ SSL Encryption

✔ Backups

✔ Data recovery


The platform is carefully monitored 24/7 for potential threats and unauthorized activities, such as Man in the Middle Attacks or IP Spoofing. Our online forms have the latest packages installed, updated whenever needed with a 256-bit SSL connection path between users and their online form submission.


All our online form data is encrypted and securely kept on highly encrypted and legally compliant servers in multiple data centers.


We use spam, virus and malware protection services provided by McAfee

Security measures include McAfee Virus and Malware Protection, Spam protection and virus protection.


McAfee is a world-renowned cyber security firm who monitor all the latest threats and each threat is carefully monitored and cleaned on a daily basis so that our online submissions and form users can navigate in a secure and safe online environment.

So, feel free to submit online order forms on your phone, Mac or PC without encountering any external threats at all!






Our E-mail is protected by one of the most advanced online security firms in the world, Google. According to Google sources their email is now the most secure on the planet and is virtually un-hackable!

Bypassing encryptions and firewalls on this type of email is, so far, unheard of. The only way to gain access to the email data is by a 2-step verification procedure which is unparalleled in today’s email security industry. Google has supported and leads the way in encrypted connections, which makes it harder for anyone to access what we are sending or receiving. Google also monitors and warns us about any possible security risks, such as suspicious email’s that are not sent over an encrypted or secure connection.




Our Team


We are a small group of hardworking and closely-knit tracing experts with a passion for tracing people. Everyone who is employed by People Location, or its holding company Rainbow Promotions UK Ltd, are vetted, approved, and trained to adhere, comply and surpass the company’s regulatory obligations and client’s expectations.




Contact us if you want to know more


If you have any questions about how we keep data safe, how we ensure compliant destruction of data or who we may share your data with or if you wish to check what data we hold on you or make a request for the data we hold about you, please feel free to email us at and mark the email subject line or for the attention of the data compliance officer.


We aim to respond to data compliance requests within one month of receiving the request. Administration fees may be applicable for data compliance requests.



The People Location websites and online presence is owned and operated by Rainbow Promotions UK Ltd, Co No: 05739104, VAT No: 423 5693 92. ICO registration number Z1106333. (Rainbow Promotions UK Ltd)